Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
e123533221de4869fe80ff4738d0fcac_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e123533221de4869fe80ff4738d0fcac_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e123533221de4869fe80ff4738d0fcac_JaffaCakes118
-
Size
27KB
-
MD5
e123533221de4869fe80ff4738d0fcac
-
SHA1
bee66fc60b469462e09a5d847080e9918cfa11cd
-
SHA256
c953bd05205de1d6206789a0d0723371149fbda6d05c5df9f7792bc9a053c536
-
SHA512
e7d4505ffa86ea9bc2a08c7af486056e77957a1691b5acc11183f6f3180dfaf88386f4b8d64e454bc3a58b8c0c8ba5189552ea3a5efe2734bb58609d4442813e
-
SSDEEP
768:Xq0ESwxfTv57ghuHiU85SdRpwDW5CxBz:a0ESCrWhzU82pw
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/shell_reverse_tcp
192.168.1.11:7890
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e123533221de4869fe80ff4738d0fcac_JaffaCakes118
Files
-
e123533221de4869fe80ff4738d0fcac_JaffaCakes118.exe windows:4 windows x86 arch:x86
8f73448cbad498b93cd954820ad17a3f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AddAtomA
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FreeLibrary
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetThreadContext
GetThreadPriority
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
LeaveCriticalSection
LoadLibraryA
OpenProcess
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_beginthreadex
_cexit
_endthreadex
_errno
_ftime
_iob
_onexit
_setjmp
_setmode
abort
atexit
calloc
exit
free
longjmp
malloc
memcpy
signal
ws2_32
WSAGetLastError
WSASetLastError
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 336B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE