/����U"C�$�N����ȟ|~I�h����;~_k�ܫDh�����W�i���5��r%*�#=v������-k(=�P{S��EY [Z�Ï�F1�|k *��g���a�����4��Z+N�|N|l�A�j�4/���~�wZM�� �s����Kw���g��"ɀ���R�1�f��y���;QS*zg�'tN��|��o�G!������f\Sz�l���.�J�F2,NV�v�S���#��� Dul��2�>~���w��A�I����'�p5<M�嵹��M�NF\Y?� �~�cU'��,��v1c�~�)��:��0L�*��F}�&mupz ���)�\7��㉦��xA��7�����am�}1�IG��Fw(?N z����s�tfJ"�R�M�� ��&�Fg�O�f#��h˗������F�B%1xMw��f��J��K�1?����d�)�j���4ώ쑐9*�M�K��W���~5�����i����T��?�� �a�b��T��n��װn�U�l�xD���@���L��a��dA9N������z ���5����;�֛ ��Cɻe[{(k�O$�1�px�:���,9lZ���~�ےY����Q\��ڐʊyS�3Jn������j:�{d�τ\�̙5�Sc�� \_ ʥvm�-���M6[hX���W�v���ڏ!s� ��CJŁ�+���.eܢ�׆���(�g�{/j�� 灯��=#Q^�l.�^���� �q 8�B �**�&��(B�"����L�Q�=I=���T*���y_�0��5�O���C�o��t�s]|R�>J��j������"�l�J"o��s��dz��q/%:��cN��\O�ƅf�6=����r���uc���GUq9�R<���B:v�g�<���������,���3�c8TG{4��}��8trY7�R�\�%4c �F�*(=PL���'�`������O��B8�LL��-;|ew���0��!Rf_��~ ]��-oJ��<BM��<��@܁MX �*��2�>Q堶l)ȟ15�����y<��A�P�ψϚ���?T�3��4������?���m��$��hZ�H��o�[����S�O&�'%����v(�V�/�Ge���,5�EjgTq�u$KYWjP��s��%+R���[|��Me�)�W������8���vS`�~֧���p��=�jyWߓ���#\��j�o���wV��y�}G�l�FS�'����"7�4���ե9?�EZ�]p�z�d�|¬���j���"�M�7���.v]�8�O$C�#���\^E�����BKa�Y��� ���&su����zC��ī����5iZr#��!� s�j�bU�A&�m���J��R�dA��KE%��,ȿ�u$1Kt>�HvS����a~J+d�nz.�l!7���DVյ���^ /�Z�A�����5���]����SzZ����{(�X(G߉������]c�����$֒-���&Q�]��&T�O6��ކ2Luo�/7`ĕ ��1���mr9��ޞ4?g��� "���D#Q�z�kd����f���ʥ�j�&|��Sa=��4�ys]��0 ��Q��K25���V� R�7�Fx�gw2��ۈlb��܁4������-4k�}gt������J'�\=�n:�S�}Z�O܍��髀�0g�]��K�xb��i�1������6�v�vrT|f������#xmMq�R���~��_���MɁ�E4.�I�D���ץK�X�t�R�lۥP��u6�������X��]��d� l���%(����4�����|�%!�'�o����a2ݽ ьJ�*:���)�i�$c�T/1�p��a�>,�.�s���H�s���i�nke��[�杻���՟Y�R Tt|�x���Vz��;>&���(s&i�8�lJ����!jC t#?O^�ߚg6���!��- �Zls���M1�b��m�)���\�:��oO���r��a��u�����4*?ޞkD���������|p��:S����'��&E��dYó�`�H�"C\��A9O��v�/߽��z[�u��C̬y�F3���:1��?cU��~�-�G�?U�����A����2��vv��kpV`�}��e �By�?q��%�f�[�\6�" �`K��4�z*�AN4���y�-�b;��&_l^U;�!7v]��60?e�R�Wt�����\UsOׯ���;55�0���/�aFz�����=B�����P_4}.>���HG�t��LW������{��2�T:��$tӮo��C�O#�=5��`��I[sv̟�?&VikhJ���o��Ug��Q��(g>5��Gn?��P�>v��K����u,84��NN�" ��V�em��mz��\/l��l�VC�����G������LF�5�O�˝��B5�����O�؎:&C5���iX���W~�����+>H-tM&@~c��?�0�����C�a8@ظ%�ng'���F=�KH@S�9�"��渊F�B�=�2��S%t���rk��8��9v���ɁXe&��#U���&5�o����2�zbR��=�b[��q�Kr��T1v*܍�K��6t�jk�3�������v�(����5����Q�^g]<���F+� �H��������{fZ��'��C��b�i��Z�=�?h���7:ۂ��Fu8�$.��� ?���Wt���X�lA������E���͕��rfn"��G��4�`\j��_��J�>v��(+B�f���do({ ��)f~��8@ �kI#��X;�� �H��8K�斣I��^�</5�����o��AL �~+�T����=dŧ�x���cev9q�\Ö��1� 9oɺ�C��z2�j�ʿ���!�� 9�yith�<Lr��CaD������9��z�ܒ]*e��If(��&��8�ƚ��-����aݺx���|��%�ĭ�N� �s��X��|�@���z ��x�-Kcbe�Fa�(-ν�$μd3gԔ�ʬ�%��5���A���/Q�H��4�̟:W1�Tb$� 6<�M�czp�س2n�|����&����Pu);gu�lU<cd�?��v�<]q����Y����;μ�u�����F�T̃X� q���h{�� ��pҨ ��ʴ��ۋ!��ϗ��H��G7��]6��6fe�H֟��$�--/�
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_3680374ad10154284b2416650dc1580d1dc17fa17571becd25f5480fc29a14d5.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_3680374ad10154284b2416650dc1580d1dc17fa17571becd25f5480fc29a14d5
-
Size
11.8MB
-
MD5
a5816f6bba79d7761d42ee61d8bd11f5
-
SHA1
90c05a7427b077fbe81c34fd6fc4f2e6bc608558
-
SHA256
3680374ad10154284b2416650dc1580d1dc17fa17571becd25f5480fc29a14d5
-
SHA512
51c794ce8569c367f475ffb85c15f5efa10c5ea7da86b1336fbeb1cab2fcf5468a26feed252a2fe5eaa5a376a9ae9bd5f87d9b28cc90580e6e98b3d242076eda
-
SSDEEP
196608:kF7gX0Meai3sCD1yjXEypazPx7WVacovyq6aejL+jGD71iEHiaJzZvdE+cZLIAfr:kF7oxeOOy9ajx0rq+jL+aD5iORdKZMkr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_3680374ad10154284b2416650dc1580d1dc17fa17571becd25f5480fc29a14d5
Files
-
JaffaCakes118_3680374ad10154284b2416650dc1580d1dc17fa17571becd25f5480fc29a14d5.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.4MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 619KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 13KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 15.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE