Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
d3bc0aced11fcf63e0b6fe19a2aeaa2a_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d3bc0aced11fcf63e0b6fe19a2aeaa2a_JaffaCakes118
-
Size
180KB
-
MD5
d3bc0aced11fcf63e0b6fe19a2aeaa2a
-
SHA1
cd10a0bc51c3b511c8c2d60eb62e4a7e76f0a333
-
SHA256
b5196f1a6850fcb8e9cd53c781a5833aa6b8b6b94f63af4bd93404a83eb46f8a
-
SHA512
c1f012142785464ffe32545487a3c8f19e694229fe3578091a9b3ae9058913df7748031f756b09d750dc8cedaa290da3b6b62b033213acc871fab1ec89143e82
-
SSDEEP
3072:FqDztifjcS0sagmzaYvCtvd0u7a/VJo6EuzOfXJovuqt5T3l:F9jl0ZgOaYqtvKeAw6DOfJi7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d3bc0aced11fcf63e0b6fe19a2aeaa2a_JaffaCakes118
Files
-
d3bc0aced11fcf63e0b6fe19a2aeaa2a_JaffaCakes118.exe windows:4 windows x86 arch:x86
29019d5ab7b9511aba32437a847885b6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathSkipRootW
StrDupW
PathIsUNCW
PathGetArgsW
SHRegGetValueW
PathFindFileNameW
kernel32
lstrlenW
GetCurrentProcess
GetCalendarInfoW
GetCurrentDirectoryW
GetFileAttributesW
GetModuleHandleW
LocalAlloc
GetFileInformationByHandle
LocalFree
ExitProcess
OutputDebugStringA
WideCharToMultiByte
lstrcmpiW
VirtualProtect
VirtualQuery
InterlockedExchange
EnumResourceNamesA
FreeLibrary
SetEnvironmentVariableW
GetProcAddress
DuplicateHandle
SetLastError
InitializeCriticalSection
OutputDebugStringW
MultiByteToWideChar
GetModuleHandleA
GetLastError
SearchPathW
GetModuleFileNameW
GetCurrentThreadId
GetProcessId
CreateDirectoryW
Sleep
gdiplus
GdipGetImageWidth
GdipDisposeImage
ole32
CoGetDefaultContext
StringFromGUID2
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
Sections
.text Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ