Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
ff03d0cd80728b40f25f3b7474416c43_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff03d0cd80728b40f25f3b7474416c43_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ff03d0cd80728b40f25f3b7474416c43_JaffaCakes118
-
Size
88KB
-
MD5
ff03d0cd80728b40f25f3b7474416c43
-
SHA1
dc5b6d6810fcd5139a383c8f9d84c81238eaa2ad
-
SHA256
574fffd479b4c36584008a4baa7216d3472cfcc6be36342708898efc3d73a656
-
SHA512
bdc869c1349d45dfaa1a59d2d95f7a75102a8b0053646757c7cd4ec347f15f1fced8df1964c33c0c570deda4415035798921ae98bb034437bb0b80bd3a94ede0
-
SSDEEP
1536:U20UGCrqTwaNzyMnA78OvLUUiAAd7i5tR9uO4zAOeGTvEE6TlkzmCW:d0WOzTnWrzZ0O40OyE6NCW
Malware Config
Extracted
pony
http://aromabiotenical.com.au/wp-admin/css/Panel/gate.php
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff03d0cd80728b40f25f3b7474416c43_JaffaCakes118
Files
-
ff03d0cd80728b40f25f3b7474416c43_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE