Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
e6f060757f382dd89eba147a02ef6c84_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e6f060757f382dd89eba147a02ef6c84_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e6f060757f382dd89eba147a02ef6c84_JaffaCakes118
-
Size
252KB
-
MD5
e6f060757f382dd89eba147a02ef6c84
-
SHA1
7225315c6b6a8c351cbcd74e029c0970e31107a6
-
SHA256
866f568a8d50e2f117e153915a1ea80fa0c25ae55d74b2acf63bdf5a281fabc7
-
SHA512
5b1ed580c826174c7a82416bb707fc652d119bc88c76777784cac48f44899473bceaca3de5bead38b2a5043eea9f3d80ee82282d40545307092d94af7dc5abbd
-
SSDEEP
6144:uXMasiHTcc1UuzTUILKwPjACish9sXaiIqr9Hu2I8DN:fapTJKw7fUXlIqhH3N
Malware Config
Extracted
gozi
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e6f060757f382dd89eba147a02ef6c84_JaffaCakes118
Files
-
e6f060757f382dd89eba147a02ef6c84_JaffaCakes118.exe windows:5 windows x86 arch:x86
c65bc0d52cb010ec037ec05fb491539c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlNtStatusToDosError
memset
NtUnmapViewOfSection
NtMapViewOfSection
memcpy
ZwClose
NtCreateSection
mbstowcs
ZwOpenProcessToken
ZwOpenProcess
ZwQueryInformationToken
NtQuerySystemInformation
RtlFreeUnicodeString
ZwQueryInformationProcess
RtlUpcaseUnicodeString
RtlUnwind
NtQueryVirtualMemory
shlwapi
StrRChrA
PathFindExtensionW
PathFindFileNameW
StrChrA
PathCombineW
StrStrIA
StrTrimW
StrChrW
PathFindFileNameA
PathFindExtensionA
setupapi
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
kernel32
SetEvent
GetTickCount
Sleep
HeapFree
CreateProcessA
lstrlenW
GetLastError
GetProcAddress
ResetEvent
LoadLibraryA
lstrcmpiW
lstrcatW
DeleteFileW
CreateWaitableTimerA
SetFileAttributesW
SetWaitableTimer
HeapAlloc
GetModuleHandleA
HeapCreate
HeapDestroy
GetCommandLineW
ExitProcess
CloseHandle
ReadFile
WaitForSingleObject
CreateFileA
CreateEventA
VirtualProtectEx
lstrcmpA
GetTempPathA
GetTempFileNameA
CreateDirectoryA
GetFileSize
lstrcpynA
GetModuleFileNameA
VirtualAlloc
lstrcmpiA
SetLastError
GetModuleFileNameW
VirtualFree
OpenProcess
SuspendThread
ResumeThread
GetLongPathNameW
GetVersion
GetCurrentProcessId
lstrlenA
ExpandEnvironmentStringsA
lstrcatA
lstrcpyA
ExpandEnvironmentStringsW
LocalFree
SetEndOfFile
CompareFileTime
CreateDirectoryW
WriteFile
CreateFileW
FlushFileBuffers
FindFirstFileA
FindClose
FindNextFileA
GetFileTime
lstrcpyW
SetFilePointer
user32
wsprintfA
wsprintfW
GetCursorInfo
advapi32
OpenProcessToken
RegDeleteValueW
RegEnumKeyExA
RegOpenKeyW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegSetValueExW
RegOpenKeyA
RegCreateKeyA
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
RegOpenKeyExA
RegQueryValueExW
RegSetValueExA
RegQueryValueExA
shell32
ord92
ShellExecuteW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 226KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ