Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
JaffaCakes118_968e5dd4f60fba7ce92cc7c533a2a18e.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_968e5dd4f60fba7ce92cc7c533a2a18e
-
Size
350KB
-
MD5
968e5dd4f60fba7ce92cc7c533a2a18e
-
SHA1
4defd9475b49cf7e901d4344a3e51e5a30159b14
-
SHA256
6af7c1bf176f1958aa7ae620c66e3164ee5dfe5eac0ac003c864e46890cafbf3
-
SHA512
0ae98142e24d6e0d5a723f8066d69647fc30d3022f886ca16595e76eb58e350eb0edff931e7c2661b433e13a36d61a543a8dd3fd41697670001d3e8d96d408df
-
SSDEEP
6144:XQrxXcMD7o3RiQrpaY1fIDF67rQntw4B9Q0epFSvd+N7LBnAE:GLklRqYt4XQpA8hf
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_968e5dd4f60fba7ce92cc7c533a2a18e unpack001/out.upx
Files
-
JaffaCakes118_968e5dd4f60fba7ce92cc7c533a2a18e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 345KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 296KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ