Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
e4102e8888cdd54defb8babef27dcaef_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
e4102e8888cdd54defb8babef27dcaef_JaffaCakes118
-
Size
4.6MB
-
MD5
e4102e8888cdd54defb8babef27dcaef
-
SHA1
135eac299e0c1ea76572c0c5705a6df4e1388318
-
SHA256
6330461af12e55ea57217260de72f3bb9b70b1eff431b6ad1801ec23ebdb1b9b
-
SHA512
20ea116d8046de3cc70e0437f4f3fccb835e849248fe35ed41fa66d3547a8ba2cc8f7183de911e85da2e74b7382cef848b46da85444968adcc075b8384e62134
-
SSDEEP
98304:MrSoPdVaKU+Ft1IUKbz4FMyjpLxA3SXsV8Fg+BkZt6k08THF:M28dVaKUZDUFEDV8FgxZtR08L
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
resource yara_rule sample family_sectoprat -
Sectoprat family
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e4102e8888cdd54defb8babef27dcaef_JaffaCakes118
Files
-
e4102e8888cdd54defb8babef27dcaef_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 192KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ