Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118
-
Size
14KB
-
MD5
c971021b0d4d8a5f87e0dbd698dd12bd
-
SHA1
995f7814856df1226de3143a3edf4483d0d6d0fc
-
SHA256
dd3ca0ab292cef0f2075031ceabee92002a4f0bb34e37f4518fc88047f4743ff
-
SHA512
072123545ae17610d27a8c4493de6779827360a9507f46c085152b4800b81c1e4d4acfbddf0baf3a8415f41114d181e7d2817678b9b8477262fbd3776fad79a8
-
SSDEEP
192:f6CUE6u82EfdYLglIS+RJ9XYHdO5SNrh6KBMUOmOzzLcmrajhjkJ:f6o6uFmdY8lJQJ9XYHQ5S9cKImfwaGJ
Malware Config
Extracted
gozi
Signatures
Files
-
c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.bss Size: - Virtual size: 268B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ