Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
dd566e7915ef070377876e03019d95dd_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd566e7915ef070377876e03019d95dd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dd566e7915ef070377876e03019d95dd_JaffaCakes118
-
Size
750KB
-
MD5
dd566e7915ef070377876e03019d95dd
-
SHA1
4c2c59dace1937178b5dcbcbba136666b12f7077
-
SHA256
1c711eae53e84fe67637e394c86b18c2ce59525282fe60e18490571952d82016
-
SHA512
07c4dccdf0c12176f2b37655532863f96ec00f8fec24a63767997e333fe0dc0c540510172afcf311e159f80e2facb3f55891f72fd667818e61bec3271f41bcf9
-
SSDEEP
12288:p9gViivStpo04PFxI33u2/+ufTgWT939nAa4iq6xGJOpqCRypiI3WOw:pegDtpo5IHcufMWT9GN0GkpIpvW5
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule sample family_ardamax -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd566e7915ef070377876e03019d95dd_JaffaCakes118
Files
-
dd566e7915ef070377876e03019d95dd_JaffaCakes118.exe windows:1 windows x86 arch:x86
fc8caaf7abfd4288c685104445568f49
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateThread
ExitProcess
ExitThread
GetModuleHandleA
HeapAlloc
HeapCreate
HeapDestroy
SetThreadPriority
Sleep
WaitForSingleObject
user32
GetDesktopWindow
GetWindowDC
LoadBitmapA
MessageBoxA
ReleaseDC
winmm
waveOutClose
waveOutGetPosition
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
gdi32
BitBlt
CreateCompatibleDC
DeleteDC
SelectObject
Sections
.flat Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE