Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
f33964ac11ec65f592f871987ab89506_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f33964ac11ec65f592f871987ab89506_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f33964ac11ec65f592f871987ab89506_JaffaCakes118
-
Size
189KB
-
MD5
f33964ac11ec65f592f871987ab89506
-
SHA1
35405f43642c84d6e32137a839d54064e2e3b787
-
SHA256
e722c9a60e47155a5d01ce058671c972964c9efe764a2213e1fdba09723bf582
-
SHA512
795e3a2cd91fa768ced118643f501ff78aa8f9f6389abbb01ff40125b3857cdddfaf4dcca70cd619b22b40b71476eabed701761989d86f3ba17e55cb43829eec
-
SSDEEP
3072:H9v9iL37yV7N4ydSI3QSypMu6dUquhRDrz1HeBN3cVnGiAzVmN8:H9vk7eNRSIUMKh5tyMGZY8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f33964ac11ec65f592f871987ab89506_JaffaCakes118
Files
-
f33964ac11ec65f592f871987ab89506_JaffaCakes118.exe windows:5 windows x86 arch:x86
b2de8ca1aaf0cd964e4e51fc5ffd0638
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleDisplayMode
GetProcessVersion
FindAtomA
GetProcessShutdownParameters
VirtualProtect
SetProcessShutdownParameters
lstrcpyA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
WriteFile
GetProcAddress
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
LCMapStringW
HeapAlloc
RtlUnwind
RaiseException
GetCPInfo
HeapSetInformation
GetCommandLineW
SetLastError
GetCurrentDirectoryW
GetLastError
FillConsoleOutputCharacterW
GetStartupInfoW
ExitThread
GetACP
FindFirstChangeNotificationW
TerminateProcess
LoadLibraryW
EnumTimeFormatsA
GetTickCount
GetModuleHandleW
GetCommProperties
ExitProcess
HeapReAlloc
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
IsValidLocale
user32
GetNextDlgTabItem
SendDlgItemMessageA
GetMessageExtraInfo
GetMenu
GetDesktopWindow
gdi32
BeginPath
FillPath
CreateDiscardableBitmap
StretchBlt
advapi32
OpenEventLogA
LookupPrivilegeNameA
shell32
ExtractIconA
msimg32
TransparentBlt
Sections
.text Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mysec2 Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ