Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
ebafe06464c9041495c988c3dee0481a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebafe06464c9041495c988c3dee0481a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ebafe06464c9041495c988c3dee0481a_JaffaCakes118
-
Size
275KB
-
MD5
ebafe06464c9041495c988c3dee0481a
-
SHA1
5abf2cee96ea2049a6c47573e437b6f6486fdc1f
-
SHA256
722a53ac4e7b5c4790e4cffb9f0cba7d59f0ff4fcb20692678b9e765a5deef96
-
SHA512
36db3ca906141069a76aeaa1878c0aa14a2643af7dabeb84da34fa1e415b4c20b8f1e2fa7d9629191379e86ff61d39f831b86d8765a76ac7862c4c57e9725f8f
-
SSDEEP
6144:kN/HLlhG/8jNQMyTfyZ1wafKa7Rs7PuJK6:kNpdNBEeK43
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebafe06464c9041495c988c3dee0481a_JaffaCakes118
Files
-
ebafe06464c9041495c988c3dee0481a_JaffaCakes118.exe windows:4 windows x86 arch:x86
521589f4452e343b202bc6e52405aa77
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetBitmapBits
DeleteObject
BitBlt
GetDeviceCaps
CreateCompatibleBitmap
GetObjectA
CreateCompatibleDC
DeleteDC
SelectObject
CreateDCA
wininet
InternetTimeFromSystemTimeA
kernel32
GetCurrentThreadId
EnterCriticalSection
GetFileSize
MapViewOfFile
UnhandledExceptionFilter
DisableThreadLibraryCalls
FindResourceW
HeapSize
CreateFileW
SystemTimeToFileTime
LocalFree
SetLastError
HeapDestroy
LoadResource
FreeLibrary
WideCharToMultiByte
CloseHandle
HeapReAlloc
LocalAlloc
GetSystemTime
DeleteCriticalSection
LockResource
GetSystemTimeAsFileTime
GetProcessHeap
UnmapViewOfFile
GlobalFree
HeapFree
IsDebuggerPresent
lstrlenA
SetUnhandledExceptionFilter
GetTempPathW
HeapAlloc
LeaveCriticalSection
FindResourceExW
GetTempFileNameW
SizeofResource
OutputDebugStringW
lstrlenW
LoadLibraryExW
RaiseException
ReadFile
CreateFileMappingW
TlsAlloc
VirtualAllocEx
IsBadWritePtr
userenv
GetAllUsersProfileDirectoryA
RegisterGPNotification
DestroyEnvironmentBlock
GetNextFgPolicyRefreshInfo
RefreshPolicyEx
RsopResetPolicySettingStatus
els
DllGetClassObject
Sections
.text Size: 224KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zOXAv Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cHdMa Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.KOfWK Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nvpMVbC Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Vgxl Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kNtPJtC Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.XnlX Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qMYDFcC Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gdxPFcC Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ErxaFcC Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.IOPFELA Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ