Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d4488bfe8279954d269b21659e0cab46_JaffaCakes118
-
Size
191KB
-
MD5
d4488bfe8279954d269b21659e0cab46
-
SHA1
24256674aba5dbc7c129f12731623076db909107
-
SHA256
062bcf9f9c97976b38f50c32f80c0ff02f4ffb408d25381af3787b99d5a265e2
-
SHA512
becd4b1c8d616155cb7430e684ca0a54815d23e9284598bdfa78ace4ea530fbbe2e4cc9e4a252722c39302aabd191fa8c4248a15ca61f5321097dbdadc810ddf
-
SSDEEP
3072:vH8PiU4MMRHR3Sosv17FZa1evY6phG7M9pJ/mCT+CSpGiqAk4ON:vZUDMRxvsvA1QYikM3J/mCTaPq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4488bfe8279954d269b21659e0cab46_JaffaCakes118
Files
-
d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe windows:4 windows x86 arch:x86
f28f2c78e8701e99b03cdc33f4d2502a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
mprapi
MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName
user32
FlashWindow
ReleaseCapture
RealGetWindowClassA
EnableWindow
DestroyWindow
ValidateRect
ValidateRgn
ExcludeUpdateRgn
IsWindow
UpdateWindow
InvalidateRgn
SetCapture
IsWindowEnabled
GetCapture
GetUpdateRgn
kernel32
CreateFiber
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineW
LocalAlloc
ResumeThread
GetExitCodeThread
GetSystemDirectoryW
GetCurrentThread
TerminateThread
EnumResourceNamesA
InitializeCriticalSection
LeaveCriticalSection
CreateThread
CreateEventW
SetThreadIdealProcessor
LocalFree
SetThreadPriority
EnterCriticalSection
GetSystemDefaultLangID
MultiByteToWideChar
DeleteCriticalSection
SetEvent
GetCurrentProcess
Sections
.text Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imul Size: 512B - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ