Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
fcce4333523abad4ea4618cec78d9ad9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fcce4333523abad4ea4618cec78d9ad9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fcce4333523abad4ea4618cec78d9ad9_JaffaCakes118
-
Size
282KB
-
MD5
fcce4333523abad4ea4618cec78d9ad9
-
SHA1
007517ce57284b278fdf7d1bf6924aab17b2fa11
-
SHA256
782564c1b1435543a81bed5189b2fd2977aa39a85ed78ea7acd96f62e1c35775
-
SHA512
60a5df2e75f2b0a3de7b80123a87d2f44c89edeec26d841a9c17a54570fef4af225ac65c9cd82fb929d7220fd5183773be15177b11671062605eed3701beff57
-
SSDEEP
6144:kL7Yc5D9+yx8h8XKvsRwgVbAmqdFweBXjMHqaowQPr0zaVh3wyjdU:kL7J5Dn2KXKwwgtnqwWoHywQF3Vjm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcce4333523abad4ea4618cec78d9ad9_JaffaCakes118
Files
-
fcce4333523abad4ea4618cec78d9ad9_JaffaCakes118.exe windows:4 windows x86 arch:x86
ff2c2f390336c0912958975ccbe6782c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetIpAddrTable
setupapi
CM_Get_Parent
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
user32
IsWindow
SendMessageA
CreateWindowExW
GetDlgItem
EnumChildWindows
DestroyWindow
GetWindowThreadProcessId
newdev
UpdateDriverForPlugAndPlayDevicesW
kernel32
AddAtomA
TlsGetValue
VirtualFree
VirtualQuery
TerminateProcess
GetStartupInfoA
GetCurrentProcess
GetFileType
GetLocaleInfoA
SetEndOfFile
GetCurrentProcessId
TlsFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
InterlockedExchange
GetVersionExA
WriteFile
GetSystemTimeAsFileTime
IsBadWritePtr
QueryPerformanceCounter
EnumResourceLanguagesA
GetCPInfo
TlsSetValue
HeapCreate
HeapDestroy
GetEnvironmentStrings
VirtualAlloc
SetHandleCount
lstrcpyW
UnhandledExceptionFilter
GetACP
GetSystemInfo
TlsAlloc
FreeEnvironmentStringsA
GetModuleFileNameA
HeapSize
GetStdHandle
GetOEMCP
SetLastError
SetUnhandledExceptionFilter
mprapi
MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName
shell32
SHGetFolderPathW
Sections
.text Size: 141KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ