Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6f3ce2d66c0501f941992371c13cf670.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6f3ce2d66c0501f941992371c13cf670.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6f3ce2d66c0501f941992371c13cf670
-
Size
264KB
-
MD5
6f3ce2d66c0501f941992371c13cf670
-
SHA1
ec9ea28bef3fbe9c44651eda1a21a2ca58b31314
-
SHA256
2f6cf55ca9a15032529340023d2eaed4c9f39184dcaca3d3d8358c36127767f1
-
SHA512
3f35e95290ea330cb1f521076c14a4fea79edb83454ec4a52c0f62d2123b66b0b9444d2d80020150dd6ab99424534bab84159d98f9cc5a934c96af9d88ae1dff
-
SSDEEP
6144:ntXf2HVyYKmKb0dtklTVKyuNitw1RfO+nDs3hoZicmnSJhEKPV9:ntXfcKmKItlBEAWpycoJ9z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_6f3ce2d66c0501f941992371c13cf670
Files
-
JaffaCakes118_6f3ce2d66c0501f941992371c13cf670.exe windows:4 windows x86 arch:x86
14b70e782971f6b5f327c55f57baee8b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RemoveDirectoryW
CreateEventW
OpenEventW
FreeLibrary
lstrcpynW
WaitForMultipleObjects
CreateDirectoryW
LocalFree
SetErrorMode
GetModuleHandleW
WaitForSingleObject
MulDiv
ExpandEnvironmentStringsA
IsDebuggerPresent
GetCurrentThreadId
SetUnhandledExceptionFilter
lstrcmpA
GetProcAddress
user32
PostMessageW
GetSubMenu
SetForegroundWindow
LoadMenuW
AppendMenuW
GetCursorPos
CreatePopupMenu
GetMenuItemCount
RemoveMenu
SetWindowPos
EnableWindow
SetTimer
PostQuitMessage
RegisterWindowMessageW
LoadImageW
LoadIconW
SendMessageW
GetForegroundWindow
gdi32
CreatePatternBrush
DeleteObject
CreateSolidBrush
CreateCompatibleDC
CreateFontIndirectW
GetStockObject
CreatePalette
advapi32
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
CloseServiceHandle
SetEntriesInAclW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameW
shell32
Shell_NotifyIconW
ShellExecuteW
samlib
SamOpenAlias
SamCloseHandle
SamAddMultipleMembersToAlias
SamiLmChangePasswordUser
SamConnect
SamGetMembersInAlias
kbdest
KbdLayerDescriptor
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.KjT Size: 5KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Fl Size: 4KB - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lAsJs Size: 2KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yA Size: 2KB - Virtual size: 375KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pk Size: 2KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.IdOhIT Size: 97KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MUbUNf Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xcXN Size: 117KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ