C:\yofecalumok-cilebalasaneg.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
de5c82a34038d993e145f05a5cde9200_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
de5c82a34038d993e145f05a5cde9200_JaffaCakes118
-
Size
103KB
-
MD5
de5c82a34038d993e145f05a5cde9200
-
SHA1
aaed345b8b33206c8c82f996d01419c87ccf0868
-
SHA256
b6299143443b5390f6a4ec10492ee6e71b26f364b5d78cf07e9b144f17dd5cf8
-
SHA512
11b9f9263d400703ac1b102b987c6027a80db480e992b30a4b107de104d83aa915d1b276b9d45b5fbe58ee9154e9a6cf2465de751162e4c4742a644e28a0f569
-
SSDEEP
1536:xK+iZqwD1wyzn3/XayEzzSWJMsrJvcYUqh/DtpBtUV2F0WUrMfD:xKzZzn35Ei5srlWyppHa2FzUrM7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de5c82a34038d993e145f05a5cde9200_JaffaCakes118
Files
-
de5c82a34038d993e145f05a5cde9200_JaffaCakes118.exe windows:5 windows x86 arch:x86
e3d69040010e31f3ebdc1cb835c44a6b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB Paths
Imports
kernel32
GlobalAlloc
GetConsoleMode
CreateEventA
WriteConsoleW
TerminateProcess
lstrcatA
GetStringTypeExA
GetProcAddress
GetProcessHeaps
GetNumaHighestNodeNumber
LoadLibraryA
GetProcessWorkingSetSize
GetTickCount
TransmitCommChar
_lread
FindFirstChangeNotificationA
UpdateResourceW
PurgeComm
FindActCtxSectionStringW
InterlockedPushEntrySList
DeleteFileA
SetEvent
QueryDosDeviceA
ReadConsoleOutputAttribute
LoadResource
SetEndOfFile
EnumDateFormatsExW
GetNumaNodeProcessorMask
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapFree
Sleep
GetModuleHandleW
ExitProcess
MultiByteToWideChar
ReadFile
TlsGetValue
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
RtlUnwind
HeapAlloc
LoadLibraryW
WriteFile
GetModuleFileNameW
WideCharToMultiByte
GetConsoleCP
FlushFileBuffers
SetFilePointer
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
LCMapStringW
GetStringTypeW
CreateFileW
user32
GetCaretPos
advapi32
AccessCheckByTypeResultList
AddAuditAccessAce
DestroyPrivateObjectSecurity
Exports
Exports
@Sticky@16
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.viguyer Size: 10KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ