Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
e6f5d722ab06b79e34177ae3faf16432_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
e6f5d722ab06b79e34177ae3faf16432_JaffaCakes118
-
Size
2.6MB
-
MD5
e6f5d722ab06b79e34177ae3faf16432
-
SHA1
17969078d948a8f4d5d5608f398d64b91dcf3f31
-
SHA256
1092b9ff7bc06de06f58a6dfc3b0492d118ec37bb258a3ee9d01f61a39a9c3da
-
SHA512
3975cd9f42a9cd575cc08fb800662dc233e40a0622bb2a28ae582f5e5470345ebe820b74393d538f1143092994389d7f20bf0b395c78d16307b242c801e6077f
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrli:86SIROiFJiwp0xlrli
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e6f5d722ab06b79e34177ae3faf16432_JaffaCakes118
Files
-
e6f5d722ab06b79e34177ae3faf16432_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ