Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
5e61678fbbf80abb52d49d6a3b635707_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
5e61678fbbf80abb52d49d6a3b635707_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
5e61678fbbf80abb52d49d6a3b635707_JaffaCakes118
-
Size
19KB
-
MD5
5e61678fbbf80abb52d49d6a3b635707
-
SHA1
d687a6397a3f0a0040834eddbef18a7634614f60
-
SHA256
c0b208465fe32b5e71e4dbfa53c7cb93e75baf8ff9115f5a682c919e65b44887
-
SHA512
593bd9a83da83433ad9949c14d1fd17437bbc81173d0ce8ff47e536bdbccbdf9f2d1e257fc5c96caa3807113a3c3b500712bbd4f24cc7f15648b7a8dfca86e4f
-
SSDEEP
384:+7iM5r6pLguSKaN2+qMv/E2VXC9AskSu+w7vaq2vk9z:SlNJ971vBDsXuVvAk
Malware Config
Extracted
gozi
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e61678fbbf80abb52d49d6a3b635707_JaffaCakes118
Files
-
5e61678fbbf80abb52d49d6a3b635707_JaffaCakes118.exe windows:4 windows x86 arch:x86
647b2d25b4821905b4195ff7a6455b54
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
Sections
.text Size: 18KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE