Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
0841f7e3cae56885f4ee4792814907c6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0841f7e3cae56885f4ee4792814907c6_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
0841f7e3cae56885f4ee4792814907c6_JaffaCakes118
-
Size
229KB
-
MD5
0841f7e3cae56885f4ee4792814907c6
-
SHA1
4b08e588a05e268790461a0d1f3bf1b2dace3e92
-
SHA256
676047897f340387e718842c45ff18d3e130f023c9156659883caf33c8b1a7cc
-
SHA512
9347e6ac1b60e3c54aedd1dfe714e95027b923e626b40610e735dd7bfc2b8a136754386da87f6b7e8d36ef9a08a005901268268834488b6807fb3cef6731c700
-
SSDEEP
6144:tOzbPpjSRkXqCJEmFt+p7GCvB/wCgVlqXAcdkRi5:tOfpGRkXqaDTaGCvB/wCgf0h5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0841f7e3cae56885f4ee4792814907c6_JaffaCakes118
Files
-
0841f7e3cae56885f4ee4792814907c6_JaffaCakes118.exe windows:4 windows x86 arch:x86
1540635bd0aa738fb4d31b50b423e1af
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentProcessId
GetOEMCP
DeleteCriticalSection
QueryPerformanceCounter
GetModuleFileNameA
GetSystemTimeAsFileTime
GetStringTypeA
GetFullPathNameW
GetCurrentProcess
LoadLibraryA
ExitProcess
LeaveCriticalSection
GetProcAddress
GetDiskFreeSpaceA
WriteFile
VirtualAlloc
user32
MoveWindow
GetKeyState
SendDlgItemMessageW
GetWindowLongW
GetWindowLongA
GetDlgItem
PeekMessageA
IsDialogMessageA
advapi32
RegCloseKey
CryptReleaseContext
FreeSid
msvcrt
_wcsicmp
??1type_info@@UAE@XZ
malloc
Sections
.text Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ