Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
dff3fb883bd41d208d344a1534c10972_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dff3fb883bd41d208d344a1534c10972_JaffaCakes118
-
Size
174KB
-
MD5
dff3fb883bd41d208d344a1534c10972
-
SHA1
92fd3eeb533a414a83cef63fda56bc52c5ca1f48
-
SHA256
8a251398871531f740093271c792314bb8d9faaac016bc452b0fb49ba59a9a4b
-
SHA512
5b3bbc757266bcf57bc9bdc6e5cb502e47f059cfa1a5f58429a976b8d5151e56a1521c22c013f3f7d726b206df3583fb58e31bce7df84973656d1527bb1463b0
-
SSDEEP
3072:c65j3F+CNfYzPvvZ88gCH+S5/946iRBbs7qe756xNcvCupCkkYbJKog6NSLkVF1H:c+2zvZ8z43wRBbsGky7zsVF1IL+tWB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dff3fb883bd41d208d344a1534c10972_JaffaCakes118
Files
-
dff3fb883bd41d208d344a1534c10972_JaffaCakes118.exe windows:4 windows x86 arch:x86
bf241a71db5053cf2cfc6155705ec47d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
setupapi
CM_Get_Child
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
kernel32
AddAtomW
GetSystemTimeAsFileTime
MultiByteToWideChar
CreateMutexA
GetVolumeInformationA
ReleaseMutex
GetLastError
CreateFileW
CloseHandle
GetVersionExA
CopyFileA
GetCurrentProcessId
GetModuleFileNameA
GetFileAttributesA
LocalAlloc
GlobalFree
CreateDirectoryA
InterlockedIncrement
SetFileAttributesA
VirtualAlloc
GetSystemTime
lstrlenA
CreateFileA
DisableThreadLibraryCalls
GlobalLock
Sleep
SetFilePointer
EnumResourceNamesA
ReadFile
LocalFree
GetTickCount
DeleteCriticalSection
DeleteFileA
CheckNameLegalDOS8Dot3W
GlobalUnlock
WaitForSingleObject
DeviceIoControl
GetFileSize
InterlockedDecrement
GetTempFileNameA
GetCurrentThreadId
WideCharToMultiByte
QueryPerformanceCounter
GetTempPathA
VirtualFree
InitializeCriticalSection
GetModuleFileNameW
FreeLibrary
advapi32
RegOpenKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyA
RegDeleteKeyA
RegQueryValueA
RegCloseKey
lz32
LZClose
LZCopy
LZOpenFileA
Sections
.text Size: 94KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ