c:\shell\town.Woman\interest\will.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
melange.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_38919d669d09bb862fb10409fda03ab19b19ebf19e23643aa10bad3dfcf5ef91
-
Size
429KB
-
MD5
35aad663c231845503998c962dbb3e82
-
SHA1
2ac81527e0afb725d492600b11c5693ff07a4d4e
-
SHA256
38919d669d09bb862fb10409fda03ab19b19ebf19e23643aa10bad3dfcf5ef91
-
SHA512
822a3b85531be658a90259d13e52b3e423346a6fe91f0069cdd1e5775599c0ea37f167c3cd3e40af473c90fa8c69a44a2357cfeec5f4398330ce844e0bd05890
-
SSDEEP
12288:kEPCm2G75FKvqTqAWgNqjKO/rg6xImIXx4TMHw:9P/5FYqWAWUqOOwdQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/melange.yuv
Files
-
JaffaCakes118_38919d669d09bb862fb10409fda03ab19b19ebf19e23643aa10bad3dfcf5ef91.zip
Password: infected
-
melange.yuv.dll windows:6 windows x86 arch:x86
6d09c7424a831297eebc930008ca1d88
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
CreateFileW
FindNextFileA
FindFirstFileA
GetCurrentDirectoryW
GetWindowsDirectoryW
GetTempPathW
GetEnvironmentVariableW
TlsAlloc
FindClose
Sleep
VirtualProtectEx
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCPInfo
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
InterlockedFlushSList
GetLastError
FreeLibrary
LoadLibraryExW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetStdHandle
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
SetStdHandle
HeapSize
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
WriteConsoleW
ole32
CoUninitialize
CoInitialize
CoRegisterClassObject
clusapi
ClusterNodeControl
ClusterRegSetKeySecurity
ClusterRegGetKeySecurity
ClusterRegQueryInfoKey
ClusterRegEnumValue
ClusterRegQueryValue
ClusterRegDeleteValue
ClusterRegSetValue
ClusterRegEnumKey
ClusterRegCloseKey
ClusterRegDeleteKey
ClusterRegOpenKey
ClusterRegCreateKey
GetClusterNetInterfaceKey
GetClusterNetworkKey
GetClusterInformation
CreateClusterNotifyPort
ClusterOpenEnum
GetClusterFromNode
EvictClusterNode
ClusterNodeOpenEnum
ClusterNodeGetEnumCount
ClusterNodeCloseEnum
ClusterNodeEnum
EvictClusterNodeEx
CreateClusterGroup
GetClusterFromGroup
GetClusterGroupState
DeleteClusterGroup
CreateClusterResource
GetClusterFromResource
DeleteClusterResource
FailClusterResource
ClusterResourceControl
ClusterResourceTypeControl
ClusterResourceOpenEnum
ClusterResourceGetEnumCount
ClusterResourceEnum
ClusterResourceCloseEnum
CreateClusterResourceType
DeleteClusterResourceType
ClusterResourceTypeOpenEnum
ClusterResourceTypeGetEnumCount
ClusterResourceTypeEnum
ClusterResourceTypeCloseEnum
GetClusterFromNetwork
ClusterNetworkOpenEnum
ClusterNetworkGetEnumCount
ClusterNetworkEnum
GetClusterNetworkId
GetClusterNetInterface
GetClusterFromNetInterface
GetClusterNetInterfaceState
GetClusterKey
GetClusterGroupKey
Exports
Exports
Fruitpitch
Govern
Sonspell
Sections
.text Size: 470KB - Virtual size: 469KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 192KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 633KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ