c:\Energytiny\Alsoengine\LittleSalt\sea.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
1a1d1c363b8fa960fa01c5aa2e3a125e_JaffaCakes118.dll
Resource
win7-20240419-en
General
-
Target
1a1d1c363b8fa960fa01c5aa2e3a125e_JaffaCakes118
-
Size
728KB
-
MD5
1a1d1c363b8fa960fa01c5aa2e3a125e
-
SHA1
c566fecef139324aa50038848d2faaf76d7b92db
-
SHA256
02ba693d75dee6a99d3a2414f6a426940696a5ec5d2d7c8f368f929697e55e54
-
SHA512
f9103433f7de855790009b22cacf6e36d076fb77e053482654485f3ae5bc955f4969d71432eebac2122fc70534d63a6bee712e26ed5fd336581c8876ded45ae3
-
SSDEEP
12288:cfoMVRvBQHTfV9QVWYjikJM6TpHjSQS/a/CzDMqT7YML8FEczX5eCX9:cfoMP5Q7VFYjif61jSQAQK7Y4QoC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a1d1c363b8fa960fa01c5aa2e3a125e_JaffaCakes118
Files
-
1a1d1c363b8fa960fa01c5aa2e3a125e_JaffaCakes118.dll regsvr32 windows:6 windows x86 arch:x86
8405284507461f31e0ea55d99890164d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
VirtualProtect
GetCurrentProcess
GetCurrentThreadId
Sleep
DeviceIoControl
FindClose
TlsAlloc
TlsSetValue
OpenMutexA
LoadLibraryA
CreateProcessA
GetDiskFreeSpaceA
RemoveDirectoryA
FindFirstFileA
FindNextFileA
CloseHandle
CreateFileW
FlushFileBuffers
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
RaiseException
RtlUnwind
GetCommandLineA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsGetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
GetCPInfo
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
IsDebuggerPresent
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetACP
IsValidCodePage
GetOEMCP
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
WriteConsoleW
rasapi32
RasEnumConnectionsA
RasGetConnectStatusA
Exports
Exports
DllRegisterServer
Sections
.text Size: 584KB - Virtual size: 583KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ