C:\rifadihusexa_podevucot\woyugediduje28\xew\puh.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_02f60de1d02c050974a99959911893d5403197d750c27bbfcbddefa78dc1911e.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_02f60de1d02c050974a99959911893d5403197d750c27bbfcbddefa78dc1911e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_02f60de1d02c050974a99959911893d5403197d750c27bbfcbddefa78dc1911e
-
Size
341KB
-
MD5
edb174c9c6f39a28010ba93010e5fe6c
-
SHA1
8524f85e693835b79b8b6826d920e8ac6a2fa022
-
SHA256
02f60de1d02c050974a99959911893d5403197d750c27bbfcbddefa78dc1911e
-
SHA512
c01e94ed539bb7f206597d23d0b0a35a9fb339077a4f8dcf6bc33e0fe3db1197d087a56cdee6ae7c4832ef67aa1f6974f852189f4e6058a40d9b5fa3483ba8c3
-
SSDEEP
6144:GrAfPQiuplIecQmWBLRnGoB2fp1nOAaUK50q:GrAgHUeTmGLRnGoB2fKd5f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_02f60de1d02c050974a99959911893d5403197d750c27bbfcbddefa78dc1911e
Files
-
JaffaCakes118_02f60de1d02c050974a99959911893d5403197d750c27bbfcbddefa78dc1911e.exe windows:5 windows x86 arch:x86
84b6df72a9e01c91bfab46c99e26b87e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindFirstChangeNotificationW
GetConsoleAliasesLengthW
TlsGetValue
InterlockedIncrement
GetProfileSectionA
SetConsoleScreenBufferSize
SetVolumeMountPointW
FreeEnvironmentStringsA
IsBadReadPtr
GetSystemTimeAsFileTime
GetPrivateProfileStringW
ReadConsoleW
CreateActCtxW
ActivateActCtx
GlobalAlloc
GetSystemDirectoryW
SetFileShortNameW
ReadConsoleInputA
GetSystemWow64DirectoryW
GetSystemWindowsDirectoryA
SetDllDirectoryA
SetConsoleMode
HeapValidate
GetModuleFileNameW
CompareStringW
GetACP
GetStartupInfoW
WritePrivateProfileStringW
GetNamedPipeHandleStateW
GetPrivateProfileIntW
VerifyVersionInfoW
FindFirstFileExA
GetHandleInformation
GetLastError
IsDBCSLeadByteEx
GetCurrentDirectoryW
SetLastError
BackupRead
GetProcAddress
SetFirmwareEnvironmentVariableW
WriteProfileSectionA
IsValidCodePage
GlobalGetAtomNameA
BuildCommDCBW
LoadLibraryA
OpenWaitableTimerW
SetEnvironmentVariableA
GetModuleFileNameA
SetConsoleCursorInfo
GetFileTime
SetProcessShutdownParameters
GetVersionExA
GetWindowsDirectoryW
DeleteFileW
TlsFree
LocalFileTimeToFileTime
CloseHandle
ReadFile
DeleteFileA
GetCommandLineW
HeapSetInformation
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
DecodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
IsProcessorFeaturePresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
InterlockedDecrement
GetModuleHandleW
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsSetValue
HeapCreate
WriteFile
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
RtlUnwind
MultiByteToWideChar
GetOEMCP
GetCPInfo
RaiseException
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
FlushFileBuffers
SetStdHandle
GetStringTypeW
LCMapStringW
CreateFileW
user32
GetCursorInfo
GetMenuInfo
GetMessageTime
winhttp
WinHttpCloseHandle
Sections
.text Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dis Size: 1024B - Virtual size: 741B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ