AitAgent.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6771bf9eb822a0f324cd6bc073392260.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_6771bf9eb822a0f324cd6bc073392260
-
Size
701KB
-
MD5
6771bf9eb822a0f324cd6bc073392260
-
SHA1
cd2b3895225e7d9cb90d4bcf36fea34552317042
-
SHA256
e40cf5f563bf3d1cb496efada0fd24d02dafef11fd4c883409119f112b4844b0
-
SHA512
0e9be825ed3776b98f693af76c5e4cc9f9fc219b80f92ed69b372195a16937f9f9ac3c2d1dce2846d1059019e24cdaa31752aaecda7978306e6b25ba4bf13ae0
-
SSDEEP
12288:ONWDKVAQRyJ25TK63lkpBxGSoSiaHzKvqWlllmyKCvZoLFp80MeU:ONWEIJ25TKnBx1FTJWllkyHvZoBp8Xe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_6771bf9eb822a0f324cd6bc073392260
Files
-
JaffaCakes118_6771bf9eb822a0f324cd6bc073392260.exe windows:6 windows x86 arch:x86
97d183ecfe4443760a9f4c1a07f4a03e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
TraceMessage
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCreateKeyExW
CloseTrace
OpenTraceW
ControlTraceW
ProcessTrace
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
kernel32
HeapSetInformation
IsWow64Process
CompareFileTime
GetTickCount
FindFirstFileW
MultiByteToWideChar
GetNativeSystemInfo
K32EnumProcesses
FindNextFileW
FindClose
GetSystemTime
GetSystemTimeAsFileTime
DeleteFileW
MoveFileExW
LocalFree
LocalAlloc
GetFileSizeEx
ReadFile
SetFilePointerEx
GetCurrentProcess
ReleaseMutex
CreateMutexW
CreateFileW
CloseHandle
InterlockedIncrement
InterlockedDecrement
GetLastError
InterlockedExchange
Sleep
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
OutputDebugStringA
GetSystemInfo
WriteFile
HeapFree
GetProcessHeap
SetFilePointer
SetEndOfFile
SystemTimeToFileTime
WideCharToMultiByte
SetLastError
HeapAlloc
msvcrt
_vsnprintf
memcpy_s
swscanf_s
strnlen
iswalpha
??3@YAXPAX@Z
memset
wcsnlen
_controlfp
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_wcsnicmp
_wcsicmp
wcscat_s
wcscpy_s
_vsnwprintf
wcschr
memcpy
_wcslwr_s
??2@YAPAXI@Z
__wgetmainargs
_cexit
_exit
ntdll
NtQueryValueKey
NtSetValueKey
NtOpenKey
RtlComputeCrc32
RtlInitUnicodeString
RtlGUIDFromString
RtlNtStatusToDosError
EtwEventRegister
EtwEventWrite
EtwEventUnregister
NtClose
RtlFreeHeap
RtlAllocateHeap
RtlReAllocateHeap
RtlCompareMemory
WinSqmIsOptedIn
WinSqmGetInstrumentationProperty
NtSetSystemInformation
NtApphelpCacheControl
WinSqmEndSession
WinSqmAddToStreamEx
WinSqmStartSession
RtlRandomEx
EtwTraceMessage
aepic
PicFreeFileInfo
PicRetrieveFileInfo
profapi
ord104
sfc
SfcIsFileProtected
ole32
CoCreateInstance
OleRun
CoInitialize
CoUninitialize
oleaut32
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
Sections
.text Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 600KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE