Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
1f4f8c28e684d5db5ce22f7742826700_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
1f4f8c28e684d5db5ce22f7742826700_JaffaCakes118
-
Size
248KB
-
MD5
1f4f8c28e684d5db5ce22f7742826700
-
SHA1
282a9257541437dbc586d4f953f4092f96dccaaa
-
SHA256
3fde380555135b231bdff61f8ff4a28169e4df0c6b9eab4378cbf50160f3a235
-
SHA512
5fc8d07c066114dbf1af31e0774c3c8a8a8c39c44be9b12bf28282f1daa7aa02fa335397620c3a27c3a49751983497ae656712f01be393871b359d5404949af9
-
SSDEEP
6144:SSaBi2ZFUOnhD8mc3oOpvXZ26u/6mv5gdC:SXRZHnhvfOpvXUx/6cgdC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1f4f8c28e684d5db5ce22f7742826700_JaffaCakes118
Files
-
1f4f8c28e684d5db5ce22f7742826700_JaffaCakes118.dll windows:5 windows x86 arch:x86
4627cd6003270b616a4b96f78cbc3f65
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ole32
STGMEDIUM_UserFree
CoDosDateTimeToFileTime
rpcrt4
I_RpcServerUseProtseq2W
user32
SetWindowsHookW
GetFocus
mprapi
MprAdminUserGetInfo
kernel32
LoadLibraryExW
LoadLibraryExA
OutputDebugStringA
LoadLibraryA
GetModuleHandleA
CreateFileW
msvcrt
iswalpha
winmm
midiInMessage
advapi32
RegSaveKeyExA
GetServiceKeyNameW
gdi32
GetEnhMetaFileHeader
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.datA Size: 128KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ