mi_exe_stub.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0
-
Size
1.1MB
-
MD5
698a97d49a0fce555e50c67cf7efe1b0
-
SHA1
c3246065692f424f9010f8a0a29fa6413c235686
-
SHA256
e1c3b2ed80892f506bc138aa92544f54b99f0cee4e7fa4c03c58fb74ba747ffd
-
SHA512
313252100e191b5c319eec40d864cf28c8fd970f231b6a22c3417cf4daf94c119faf05b4c8da9e0cb95205d63074cf2c41eaa40018b0dbc7ad631a5d1787b020
-
SSDEEP
24576:/VyEIohMRSfw0RTQZjHKPjiqSMz9xLZ/JO5unIEz5bbhwgl1lifISM8f:/VpMiwWTQZjHKPji/MxxcuIebhh1lmu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0
Files
-
JaffaCakes118_698a97d49a0fce555e50c67cf7efe1b0.exe windows:5 windows x86 arch:x86
459c3aa71b327403228988f8c94ecf4e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapFree
Sleep
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapAlloc
HeapReAlloc
IsProcessorFeaturePresent
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetTempFileNameW
lstrlenA
FindResourceExW
FindResourceW
LoadResource
SetFilePointerEx
CreateDirectoryW
CopyFileW
SizeofResource
FormatMessageW
GetVersionExW
CreateFileW
lstrlenW
GetTempPathW
RaiseException
LockResource
RemoveDirectoryW
lstrcmpiW
CloseHandle
DeleteFileW
LocalFree
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
MapViewOfFile
UnmapViewOfFile
VirtualQuery
CreateFileMappingW
SetFilePointer
ReadFile
GetProcessHeap
GetConsoleCP
GetConsoleMode
shlwapi
PathAppendW
PathQuoteSpacesW
ole32
CoUninitialize
CoInitializeEx
shell32
SHGetFolderPathW
ord680
user32
wvsprintfW
CharLowerBuffW
MessageBoxW
CharNextA
Sections
.text Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 768KB - Virtual size: 767KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 240KB - Virtual size: 400KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ