Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
oglcache.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
oglcache.exe
Resource
win10v2004-20240508-en
General
-
Target
2f30cb924d2e28aabd74f9aaa538c45c_JaffaCakes118
-
Size
166KB
-
MD5
2f30cb924d2e28aabd74f9aaa538c45c
-
SHA1
bf12c9a0ded49bb6d9b614de646aebc99d52a32e
-
SHA256
968536a19c000fa548ed630f4a248eff791997754b1d0ccfea925bcd061625bb
-
SHA512
0d3f9a70e439062e621a99496e747ebfa416a65d0fe7a806b02d33b9ef9ba0a997a32d0de4694b49dcd9d82b14705bf3a7bf7969d07767ac71ecc604b5ad96d7
-
SSDEEP
3072:XbL93uG6BFezLx3u9LPUJyWRbCSWgxQIJGq65Sy7FuQsiWJa1ADm56TzkVa:rxVM0zxSGyWXWgxRJn6IyhuQsWWq56PB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/oglcache.exe
Files
-
2f30cb924d2e28aabd74f9aaa538c45c_JaffaCakes118.zip
Password: infected
-
oglcache.zip.zip
Password: infected
-
oglcache.exe.exe windows:4 windows x86 arch:x86
7fb9742e20b87c94ac45f9341d68e787
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocaleInfoW
GetDiskFreeSpaceA
GetModuleHandleA
SetConsoleTitleW
GetTickCount
GetStartupInfoW
ReadConsoleA
CreateDirectoryA
CreateMutexW
GetProcessTimes
ReplaceFileW
WriteFile
InterlockedDecrement
CreateFileW
WaitForSingleObject
lstrcpynA
GetCommandLineA
SetCurrentDirectoryA
GetLongPathNameA
GetProcAddress
HeapCreate
CompareStringA
clbcatq
CoRegCleanup
SetSetupOpen
ComPlusMigrate
DowngradeAPL
azroles
AzCloseHandle
AzGroupCreate
AzFreeMemory
AzGroupDelete
nddeapi
NDdeShareEnumA
NDdeShareDelA
NDdeShareSetInfoA
NDdeShareAddA
uxtheme
GetThemeSysInt
GetThemeEnumValue
GetCurrentThemeName
DrawThemeText
GetThemeSysBool
GetThemeSysFont
GetThemePosition
GetWindowTheme
CloseThemeData
GetThemeSysSize
GetThemeAppProperties
IsThemeActive
GetThemeBackgroundRegion
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 260KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ