c:\yes\42\crowd\72\35\six\Since\25\Main\Do\74\ran\Office.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
11a178d30b84e7afa0a759d6048c48e1_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
11a178d30b84e7afa0a759d6048c48e1_JaffaCakes118
-
Size
267KB
-
MD5
11a178d30b84e7afa0a759d6048c48e1
-
SHA1
6c612f49d04675229f56e7021ac18cdeba37e6d0
-
SHA256
f591e473859ad8efcc6390732aca39899fe5910101618bfcff8b4c062c3c5fe0
-
SHA512
58f4a9bf209d7505c8aba1e02577ec34dc2640cd6f7eea4b0f97515c75bab332a40eef30db0751f68ab4846b1fc44b855330609ce9fdf2ee0a37b110ec2b2e1d
-
SSDEEP
3072:WKCvsQ1ZkyvvaVT5wW760YyUu5VELUUtg7+HqOtTsTERJLGvumPOUIrLeAg0FujH:LQrkoCevytr7UtkiBvPLiAOg3kaeXV6y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11a178d30b84e7afa0a759d6048c48e1_JaffaCakes118
Files
-
11a178d30b84e7afa0a759d6048c48e1_JaffaCakes118.dll windows:6 windows x86 arch:x86
6749c1906c573b3a2cc9309078bca481
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetCurrentDirectoryA
Sleep
GetSystemDirectoryA
VirtualProtectEx
SetFilePointerEx
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetStringTypeW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
GetACP
HeapReAlloc
HeapFree
WriteFile
OutputDebugStringW
CreateThread
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
HeapSize
CreateFileW
Exports
Exports
Describemile
Glasstall
Outdead
Summercompare
Whoshoe
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ