f
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
f1cb0097c9da134b6e0df7347b802347_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
f1cb0097c9da134b6e0df7347b802347_JaffaCakes118
-
Size
33KB
-
MD5
f1cb0097c9da134b6e0df7347b802347
-
SHA1
0963094532368f1236672d247facf7b5d8db5c3b
-
SHA256
00d7a3711f2a73a5a829d67c7beda7c05fe058ce396f9a617ec547967c442bf1
-
SHA512
1a455e8d498a8e50edbeb8768c1693a7cd04bc3027fd02be266bc8925553f4d4acfe01aeaf0f0dc5009a388876a0b3ab64fbd3c9bc7ff25aa254c52d59bdc4eb
-
SSDEEP
768:sV5FskQz6dDp1ODXKyX/sBJ3+seFGF3ExYE:9kA6pOD6yPAeFGFI
Malware Config
Extracted
phorphiex
http://185.215.113.93/
http://gotsomefile.top/
http://feedmefile.top/
http://gimmefile.top/
http://tsrv3.ru/
15DBeUGFSQLbpYvWLJwzHUXSRrHNU9uQuS8c2wvFLZ7Nxz3N
1E5ZxnNUbbGQarWjMA7tCwp3Btm38GvRkv
3AcMV5pSUcxMmmcMbfSkJXRKbCrF3ysUDJ
bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr
XkcKjKZqNUkChwJXMj5uDjDns6etXvakir
D7MYki8urW3xq8sZJ8Q2v2ZrHxjzp7ACvb
0x76e4CB2fcf7f931Fd750e93F443536Ee068d1cdE
LfYFvpk2hccXw12tN3BBMWh7EcUBMbKoTG
rUQFcff9R1eKAwTtR1wbuQxmcoB236mz44
TEUaG7jyXdyrDS3JeEg1w1hotmmEMjx4TB
t1gTRxsrEXwky32j22jgFRZAafBzmCV2M2V
AT5Vm3ZrUg98s9kBue2g9YjnwK4kFKhQw3
bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr
44L2q3sPJ3DMJZiuSpHvehHMLbMXx3SAoVbLm5DWDw1A7PhUvcCPAGg5qAN98DWAUG7CuD4WmydP4JkewTz2aeVd4qhS822
GBLUYL3QTKP3NXVWCYNZ7ZH4CWFT6PVCXEYCNUNSHM34WKG2UL5EDQMV
bnb154sx9pdh8er33ujxlpfk3zwvlfp9rd5rskvvgc
bc1q7tlhekvj4d3unj2lzzny5wecy5pr6vatdgcn8w
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.146 Safari/537.36
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule sample family_phorphiex -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1cb0097c9da134b6e0df7347b802347_JaffaCakes118
Files
-
f1cb0097c9da134b6e0df7347b802347_JaffaCakes118.exe windows:5 windows x86 arch:x86
fbe38eac33127c8216f939b478d0cb1c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
memcpy
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
wcscmp
wcslen
strchr
strcmp
_wfopen
fseek
ftell
fclose
srand
rand
mbstowcs
memset
_mbsstr
strlen
isalpha
isdigit
wininet
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileW
shlwapi
StrCmpNW
PathMatchSpecW
PathFileExistsW
PathFindFileNameW
PathFileExistsA
kernel32
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
lstrcmpW
MoveFileExW
FindNextFileW
FindClose
SetFileAttributesW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
GetTickCount
ExpandEnvironmentStringsW
WriteFile
CreateFileW
GetFileSize
GetVolumeInformationW
GetModuleFileNameW
CreateProcessW
GetLocaleInfoA
CreateThread
CopyFileA
GetLastError
CreateMutexA
ExitProcess
DeleteFileA
MoveFileA
MoveFileW
GetModuleHandleA
RemoveDirectoryW
DeleteFileW
GlobalUnlock
GlobalLock
GlobalAlloc
ExitThread
Sleep
SetEndOfFile
SetFilePointer
CloseHandle
UnmapViewOfFile
HeapFree
HeapAlloc
GetProcessHeap
MapViewOfFile
CreateFileMappingA
GetStartupInfoA
user32
SetFocus
CloseWindow
SetForegroundWindow
ShowWindow
FindWindowA
wsprintfA
wsprintfW
GetClipboardData
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
advapi32
CryptAcquireContextW
CryptEncrypt
CryptImportKey
CryptVerifySignatureA
CryptHashData
CryptCreateHash
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegSetValueExW
CryptDestroyKey
shell32
ShellExecuteW
ole32
CoInitializeEx
CoCreateInstance
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ