AdobeLinguistic.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
e7cc07a1704145c6843330345fd1ce0b_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e7cc07a1704145c6843330345fd1ce0b_JaffaCakes118
-
Size
472KB
-
MD5
e7cc07a1704145c6843330345fd1ce0b
-
SHA1
6da282da7b2151eeb7da06b0ce8e1beb64e585a1
-
SHA256
4aa789cf7c10418cc7ae60d4f2f5e0879521d6fe6d00d381df103156b4d4c1d7
-
SHA512
45ed8bf0670a38dc090f766120e1e1612826a24434c39b6afacb04ed023fafd2561a53e2680917cb5fdcea8919bcc5c20af0e53eebaa181d186dc6b4eba01b6e
-
SSDEEP
12288:Yz2RENHa7bDjN3MyC2AzkfCpzGmZSgW+b3:Yzuw2N2pzGmq+b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e7cc07a1704145c6843330345fd1ce0b_JaffaCakes118
Files
-
e7cc07a1704145c6843330345fd1ce0b_JaffaCakes118.exe windows:5 windows x86 arch:x86
3e0ffe28f0568c14c588a16d7a3632c2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
psapi
EnumProcesses
kernel32
TlsSetValue
GetCurrentThreadId
QueryPerformanceCounter
DisableThreadLibraryCalls
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObject
ReleaseMutex
CreateMutexA
GetCurrentProcessId
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
GetTempFileNameW
FindNextFileW
DeleteFileW
RemoveDirectoryW
FindClose
FindFirstFileW
GetTempPathW
SetEvent
CreateMutexW
CreateThread
CreateMailslotW
ReadFile
WriteFile
CreateFileW
SetLastError
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
ActivateActCtx
CreateEventA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
DecodePointer
EncodePointer
GetTickCount
LocalAlloc
InterlockedExchange
LoadLibraryA
RaiseException
InterlockedIncrement
InterlockedDecrement
TlsAlloc
TlsFree
TlsGetValue
Sleep
user32
wsprintfW
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ole32
CLSIDFromString
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
oleaut32
SysFreeString
SysAllocString
SysStringLen
Sections
.text Size: 268KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ