��������������A!�`�7:ˉ� �����֩�95>3�P��!Nh�H �Kd�YJ7g0Us��y��h`��@���D,����G�2�����fV;^px�id`��H&�S���-����|Y`�� !�#�kLQ�k��8�Fq�ǖ���n���Xc_�����,��++���#�xN�� o�w��<Mn�>.?sb�=m��P `B�ϫG���s��}�&��v���'�@8�NNc� u�����V������� �(�m �Ya�r=X��[ư���'N�*��ӥ�u�1GSC�g����p^%t�|Wh�"���B�OxkS��]�<�*�l�Q���o��%)��Io2��L�f�KoS���I�O�3ꌾڊ-́ƪh����R\��#Hk��!'3}���7S�(�C!q�������> |��7J��HQ4A��F�n�������v�5���Qe}:��#v�W��Mn'7i<�jJ�70q��>�����DJ������ܜE�}��6O�D�����)�&nk�ޭ�`�o�Lw�鴡�\fG"n�XP�e��_{>��K#auoj��vp��2v^g�v :'B'��T��oY�1�aݠ�ހW"���P(�Q"$�V���+���"41�\� |u��������K�����ׂsY�����'_zXґL��o�M [d>�=f#��7j,�6zY���US!v5���F���?�I���X�V~��}mG���'w]�6�GH�u�.�L�W��������,����_�<nي�kXT M9t�+5�$@�g��@�9uqAL�m����2�`��^X���;����w�)P/�,�D������7�E}+�휸aU�m[;��}A$7.��b�\m��B5��%_����㍟����M����������G�=��=����leH�b�?���*�;�u\o�g}x�����(u�]/b���l"9��e�M���b���ڐ���/�����_�e�a^�F�u�����.ɍ�u@e���Z�9�\*�齀5^:�%^��q�״Eg-��������-�p�|�5ES�ړ6�@�tj)w��A�㺾���q�ά���}fw�{�k2gp�س���Y�Cx�8�5�_��Gڗ8ھ�G�FFl0����Iq����!�f]��5�zr� lĔ�JN> ��,l�@�X̠����@��m W7ۃdi��D��o@ŠB0!/(�����$F�߽�A76��p�Q�&�@�JZar��ήb}�帔=��HF8�C@糫K*��:>�����kw'��cP�f�B_y�#�:����"���=�kpi�^�`����i�^��%pT�Y�D��,�I��z�����{F:�-zG�_q�?@c벼�~ +�m����;pӚ�?�ꑳ�E��� [ʿVq9���BLłAB�a�D&dG�L�����ls�G|l�� D�G�,|c��ƨ] �KМw�L�Ӌo{I�r[,�է�J��Փ'��ۺ��Z&U��Q���H1zWZ�Ը��θ�i�j��PN�O���q,&FWd���Bה� �^�J߄qV"~�BJ�餁|�L\X�<]�� �pܗ�D�\5_�J}0��,��<��to��Q�VFDJpYQ"�U����r�x�/d M}�\L�-�� ����9�s�P=�J�;��2�~Δk]x� 4{��[?�k��-������Lv(�gܾeUU5����0���0����k�?�[P�����0I�%uS:*Bϵ~{)N�=��x[!�rҲ�[J?%Eעy,Q�'z�&�g�<�������t��X��N} ���:Vq��� ���m*��P����ȝ����m�N]j��{g�$\a���(��Ϧ�ܟqt�V��CW���4�d���:��q[<p��0)"0���t.@`W��ϣxc^�C���Zm�s#՜�pj�w�x�0d��M�����(\V��KZ:�!�H�A�����V<���+����Վk'`k���]�\t�i�����0qʔ�u-Z�喃2��=��B2g9�B����L����Z�t�{�u�i�L�8��������:�H���>���@n�@�X�L}ދM;�TyO㞤?��闤��i���SMw��l��v*���%��Us�)��X�G��s�.E���)�g7����dΆ�O =ҵ�p�7mAk0�z���~!�v]��=��y��5FZ�,;����Ɍ��� �YE�%{"����Z������G�p���X�$S�=iA�n{�|*"��:8q�{�UG����=ث��1J���dx���Ʀ�\��&�n�����-?�}J\�S�� |�����ʖJ:\����=)B���j�%r�8#k(��ΡUm�S��θ�5C"�X|���JN�7���f����Z�Pobe]���3η��� �U��)�bT��Q4Jh��� ��H�@��s��6K8J��י����C�dpΛ25�a�0�+h�-L�I�?��/7q�0&���f��$�16��S�7�����!?�L�d�̚%{��r�1��t ��`�PJ��ѬVX��H9�� ���9{�R�n2�_�ZlH�T�I��q2�2�`n�:�h�D��Nq�H"~y���GtDj'c3��-�h�념ߪ.$|FM��������ݼ �a�nYW���JVQxgz_�PAl �}�q�(�������n컾@7����)y����`��xج���G�#Z+��O���a���Qe-�]Ԡ,���������c�I+��&t��vf���);#f���� ��{��y�P�T[��8�Cx�����4�5ܴ�MU����_��:��`$�;=q�U���K�tl ��X���y�q�Wh�ɻC���<��Ac�b���V����uJa��3:rn̩r������.rAKdz�ȯ&:Lg-M�~���xD�q��Twrb��"�O|J�v����@7ڋ5��3&�9����*"g�������>���v���]C�P��ýA�_~P<�{Rd}Z��!��$��_='�: �hK<���k��ҋ-�D��
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
eacd1ed8159584d5c8a2d74aa8f88f71_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eacd1ed8159584d5c8a2d74aa8f88f71_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
eacd1ed8159584d5c8a2d74aa8f88f71_JaffaCakes118
-
Size
1.8MB
-
MD5
eacd1ed8159584d5c8a2d74aa8f88f71
-
SHA1
d11b886594fb79418e37f73746b358272d321085
-
SHA256
48bc676e4cf192547980f854601de1ba245ff0bc224faf4c34a1ac42031b75fa
-
SHA512
1a98885bbb57149facd8ab249339be2fb7545ac92fd273c3f18739e5c5a9555a4f3900ef740ca2774dd440b5cc7b5a3aa560cae1f3d3da3a0b82a6c8d7977fb2
-
SSDEEP
49152:x6F73aRietSJ27B/U+yWJmmKGutZ/3etcv8tJ:x69DJA4WJmmKntZ/V8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eacd1ed8159584d5c8a2d74aa8f88f71_JaffaCakes118
Files
-
eacd1ed8159584d5c8a2d74aa8f88f71_JaffaCakes118.exe windows:4 windows x86 arch:x86
dfe634241293def28e1b1d10b8a4a08d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetFileSize
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClientRect
advapi32
RegOpenKeyExA
oleaut32
VariantCopyInd
version
VerQueryValueA
gdi32
SetBrushOrgEx
ole32
CoInitialize
comctl32
ImageList_DragShowNolock
winspool.drv
OpenPrinterA
shell32
Shell_NotifyIconA
wininet
InternetGetConnectedState
comdlg32
FindTextA
wsock32
socket
oledlg
OleUIObjectPropertiesA
data\oscillography
CH375SetDeviceNotify
downloadagentlib
SetUserAbort
jtagagent
Jtag_MemRead8
Exports
Exports
Sections
CODE Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 15KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zoy0 Size: - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 95KB - Virtual size: 776KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zoy1 Size: - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zoy2 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE