Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
e59bd6aeea74d595901f5002c60de973_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e59bd6aeea74d595901f5002c60de973_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e59bd6aeea74d595901f5002c60de973_JaffaCakes118
-
Size
173KB
-
MD5
e59bd6aeea74d595901f5002c60de973
-
SHA1
34018aa661a0cd74debe742eb86954d82c6a83b4
-
SHA256
663cf2939cfeef564535fe986a876d221bbf168b979d90c22865c7bb97d709da
-
SHA512
ab670ece5c51f3b9f5832efab39f0741bf99dafbd243b94c7da49b2c62bedf6d54dc0a644dd5be3961d844c6898ea49ac935faaca829f2fc8cf6d8fc4c523414
-
SSDEEP
3072:wVogI4ObpMTxnMrc6dsDD81wglZkZ4sivUDhBFtyS84J/XF1X5vAsV0mV2t:Co1WtMA6ddpraFyYJDX5YIfE
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e59bd6aeea74d595901f5002c60de973_JaffaCakes118
Files
-
e59bd6aeea74d595901f5002c60de973_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ