p:\vc5\release\loader.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
eacce5633e0170dc45e8d9edf9ee5ab8_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eacce5633e0170dc45e8d9edf9ee5ab8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eacce5633e0170dc45e8d9edf9ee5ab8_JaffaCakes118
-
Size
25KB
-
MD5
eacce5633e0170dc45e8d9edf9ee5ab8
-
SHA1
b755446d4409b76fa7d4da060478f32ee9b2ae0b
-
SHA256
12727a7f93111281838c02293346232bea3b58f6d1364d725ad17d74e553808c
-
SHA512
46a697ac22f9d70cb61a3cc297162b14fb29e1d38f8da92b35693ce5d02edc97f58fa1fa60945809d4a26e2d2848145a38802817cfb9ecf0f40ae576889743c4
-
SSDEEP
384:41QOy6IC2Ha/wLJRvWMKlBK1LEhqmOkLmYTT5mgORU:41QqiHRkBK14htdLmYsRU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eacce5633e0170dc45e8d9edf9ee5ab8_JaffaCakes118
Files
-
eacce5633e0170dc45e8d9edf9ee5ab8_JaffaCakes118.dll windows:5 windows x86 arch:x86
fb1f2622a5ced7fd96677a16e7b2c579
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
ZwQueryInformationToken
strtoul
ZwQueryInformationProcess
sprintf
ZwSetInformationFile
RtlTimeToSecondsSince1970
ZwOpenEvent
RtlAdjustPrivilege
RtlNtStatusToDosError
ZwDelayExecution
ZwWaitForSingleObject
ZwOpenProcessToken
ZwDuplicateObject
ZwOpenFile
RtlDosPathNameToNtPathName_U
LdrFindEntryForAddress
RtlRandom
ZwAllocateLocallyUniqueId
RtlInitUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
LdrAccessResource
LdrFindResource_U
RtlComputeCrc32
RtlTimeToTimeFields
ZwSetValueKey
ZwCreateKey
RtlIpv4AddressToStringExW
ZwWriteFile
ZwCreateFile
swprintf
wcschr
ZwResumeThread
ZwTerminateThread
RtlPrefixUnicodeString
RtlGetCurrentPeb
ZwSetContextThread
ZwWriteVirtualMemory
ZwGetContextThread
RtlExitUserThread
ZwClose
ZwOpenKey
ZwQueryVolumeInformationFile
ZwQueryValueKey
_allshr
memset
kernel32
BindIoCompletionCallback
GetProcessHeap
HeapFree
GetLastError
HeapAlloc
Sleep
ExitProcess
GetSystemDefaultLangID
GetVersion
CreateProcessW
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime
ws2_32
WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSAStartup
WSACleanup
advapi32
MD5Final
MD5Update
MD5Init
shell32
ShellExecuteExW
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 277B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 742B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ