Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
fax00011{DIGIT[4]}.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fax00011{DIGIT[4]}.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6fe1e3dcaf0a60f19cdccda5c9254cfa
-
Size
179KB
-
MD5
6fe1e3dcaf0a60f19cdccda5c9254cfa
-
SHA1
3fd959e8b31dab648f43b34c7cc20108fac62db3
-
SHA256
dc67d1c6ee37673c0ad59409d1bcd05b07921d7f5799ca5ed1b290416c9a8063
-
SHA512
4f5add9d25cb3e42cc47b3159ff450d1e63484f6d07d0362c04d947d9ad796b113d7067b29c1f3489e5ee1b74797166c992ac522aa98628cb72dced54eee3c39
-
SSDEEP
3072:TQMuyJAajewh0WEOXPU8/87Z6iz+54DleM4/Nxe44j+Ye:fJvjevyUgw6iW4Dor/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/fax00011{DIGIT[4]}.exe
Files
-
JaffaCakes118_6fe1e3dcaf0a60f19cdccda5c9254cfa.msg
-
fax000116892.zip.zip
-
fax00011{DIGIT[4]}.exe.exe windows:5 windows x86 arch:x86
9337c27dfd5dd1f8aaf8a822a3ff7f4d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetFileAttributesA
GetLocaleInfoA
GetCommandLineA
ReadConsoleW
GetProcessHeap
ReleaseMutex
VirtualProtect
CreatePipe
SetLastError
IsBadWritePtr
WriteFile
GetPriorityClass
CreateDirectoryA
HeapSize
RemoveDirectoryA
DeleteFileA
SetLocalTime
GetDriveTypeA
GetStdHandle
ResetEvent
GetModuleHandleA
user32
DestroyMenu
PostMessageA
GetCaretPos
PeekMessageA
LoadCursorA
DispatchMessageA
GetWindowTextW
wsprintfA
SetCursor
GetWindowLongW
DrawIcon
SetFocus
GetCapture
els
DllRegisterServer
DllGetClassObject
DllRegisterServer
DllGetClassObject
rasapi32
DwRasUninitialize
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imp Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ