c:\Against\Began\rain\SeedPoem.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
e2381bb591d8104e5639c61751d5682d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e2381bb591d8104e5639c61751d5682d_JaffaCakes118
-
Size
376KB
-
MD5
e2381bb591d8104e5639c61751d5682d
-
SHA1
16d062a84a29e9510cb69c83e536b21441cc878c
-
SHA256
dc1f57e5ef69133536585dcdb45f2992281288e8bce7980d27af774b6f3eef98
-
SHA512
fc66fb58b00dfea88aa4b128c5f0ed84320e8c8584ed644f66756ede2dbd953a812d73c441a31e19ebc3b5ec3ce848dff7afc2c6f44e92fa98102be61b862802
-
SSDEEP
6144:tFqTpMmb37r+TiZNAqMRQzRZZxKxMFihFAzixQuLNMEC:t0NDmoNAF0RZZxKGIFAzixQuLN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2381bb591d8104e5639c61751d5682d_JaffaCakes118
Files
-
e2381bb591d8104e5639c61751d5682d_JaffaCakes118.exe windows:5 windows x86 arch:x86
fd499d619bda8779f56e774da257a7f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetStringTypeA
MultiByteToWideChar
LCMapStringA
LCMapStringW
CompareStringA
GetLocaleInfoA
GetStringTypeW
HeapSize
RtlUnwind
VirtualAlloc
CompareStringW
VirtualProtectEx
Sleep
GetCurrentDirectoryA
GetProcessHeap
HeapAlloc
GetSystemDirectoryA
LoadLibraryA
WaitForSingleObject
CreateMutexA
OpenMutexA
DeleteFileA
FindFirstChangeNotificationA
ResetEvent
GetEnvironmentVariableA
GetShortPathNameA
PeekNamedPipe
DuplicateHandle
GetCurrentThread
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
WideCharToMultiByte
GetTimeZoneInformation
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RaiseException
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEnvironmentVariableA
user32
SendDlgItemMessageA
InflateRect
SetParent
SetClipboardData
DestroyWindow
EndDeferWindowPos
IsClipboardFormatAvailable
SendMessageA
CheckRadioButton
SetForegroundWindow
IntersectRect
ExitWindowsEx
comctl32
ord17
ImageList_SetOverlayImage
DestroyPropertySheetPage
CreateToolbarEx
ord6
ImageList_LoadImageA
comdlg32
GetSaveFileNameA
ReplaceTextA
GetOpenFileNameA
ole32
OleUninitialize
OleSetContainedObject
OleInitialize
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
FreeSid
OpenProcessToken
StartServiceCtrlDispatcherA
InitializeSecurityDescriptor
RegEnumKeyA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
AdjustTokenPrivileges
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
GetTokenInformation
LookupPrivilegeValueA
rasapi32
RasGetConnectStatusA
RasEnumConnectionsA
RasHangUpA
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ