Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
9e98369c91742701edd321076a5a16ed_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
9e98369c91742701edd321076a5a16ed_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
9e98369c91742701edd321076a5a16ed_JaffaCakes118
-
Size
179KB
-
MD5
9e98369c91742701edd321076a5a16ed
-
SHA1
8a1e149e0e1384296fcc788af23e2e174802604b
-
SHA256
154dc9e9699df911ce4998900cc9fb9362d3b77f05a922c083f24b9c58a6dd87
-
SHA512
01335ea562fa8d5003d3c71e1693c9882a2b2f821a856b2a2f3c345dc34a782e8a00a9865f1240e48e27f298017e17d9cec43e69661140d95a074c677e2c900b
-
SSDEEP
3072:+oQyEiENxBgTLRSxYZpFeILokVUbl+JJqaOToaRoNUSdUCFJCLZjnl8V8CANpFUI:P+VxMjeILZG6Cr8nA5bYQC5XvHC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9e98369c91742701edd321076a5a16ed_JaffaCakes118
Files
-
9e98369c91742701edd321076a5a16ed_JaffaCakes118.exe windows:6 windows x86 arch:x86
c64d1b42d60e6e4506177b28f9279c83
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
CreateFileW
CompareStringOrdinal
IsWow64Process
SetFileAttributesW
GetFileAttributesW
DeleteFileW
GetCurrentProcess
Sleep
FindFirstFileW
CloseHandle
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetDiskFreeSpaceExW
GetFileInformationByHandle
SetLastError
GetVolumeInformationByHandleW
GetCurrentDirectoryW
DecodePointer
GetVolumePathNameW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
GetSystemDirectoryW
MoveFileExW
ReplaceFileW
VerifyVersionInfoW
VerSetConditionMask
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
RaiseException
GetFileInformationByHandleEx
LoadLibraryA
GetProcAddress
TlsAlloc
SetUnhandledExceptionFilter
FindFirstFileA
FindNextFileA
TlsFree
TlsGetValue
GetFileType
TlsSetValue
SystemTimeToTzSpecificLocalTime
WriteFile
GetModuleHandleA
CreateFileA
GetFileSize
OpenFileMappingA
MapViewOfFile
ExitProcess
CreateFileMappingA
TerminateThread
UnmapViewOfFile
ole32
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
CoResumeClassObjects
advapi32
RegEnumKeyExW
RegGetValueW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegDeleteKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
InitializeAcl
SetNamedSecurityInfoW
shell32
SHChangeNotify
SHGetDataFromIDListW
SHBindToParent
SHParseDisplayName
ord709
SHFileOperationW
SHGetKnownFolderPath
ord526
shlwapi
PathIsDirectoryW
PathIsPrefixW
ntdll
NtQueryDirectoryFile
RtlNtStatusToDosError
gdi32
GetPolyFillMode
EndDoc
user32
SetActiveWindow
BeginPaint
EndPaint
UnpackDDElParam
ReuseDDElParam
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ