Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da
-
Size
220KB
-
MD5
ba1947b8d4ec4a6cb8374931160827da
-
SHA1
dd1f286416aa3896d6318f5048147cb8cfe73dda
-
SHA256
6f6445a629c8fff724d2a1ad61a5487011308f2b3a72236072d45026f34bcc09
-
SHA512
8dd2badfe8e3dea12f15b9e2d8278c4227ff2a4be028e8cf6e141e602205ae014b5709fc14a2a03808396df263899f6a144815fa277bc7df5f646a45f5fa0702
-
SSDEEP
6144:lwkwJej1coHvEf1e2a16Po3u0q3dM5KxSW3Y:Fke5coHYQ2k6fX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da
Files
-
JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe windows:4 windows x86 arch:x86
f20c99b85bea51912247d0c4ef7f8818
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCreateKeyExA
RegOpenKeyExA
CryptHashData
RegEnumKeyExA
CryptDestroyHash
CryptEncrypt
CryptGetHashParam
RegEnumValueA
GetUserNameA
RegSetValueExA
CryptReleaseContext
CryptDestroyKey
RegDeleteValueA
CryptImportKey
CryptCreateHash
RegQueryValueExA
RegCloseKey
winmm
timeGetTime
timeSetEvent
kernel32
CreateFiber
IsBadReadPtr
VirtualFree
WaitForMultipleObjects
SetThreadContext
GetLastError
GetSystemTime
EnumResourceNamesW
SetThreadPriority
GetCurrentThread
GetCurrentThreadId
lstrcatA
GetThreadPriority
GetTickCount
GetACP
CreateSemaphoreA
wininet
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA
user32
wsprintfA
GetDesktopWindow
GetQueueStatus
ReleaseDC
PeekMessageA
CreateDialogParamA
MsgWaitForMultipleObjects
RealGetWindowClassW
DispatchMessageA
RegisterWindowMessageA
GetDC
DestroyWindow
PostThreadMessageA
ShowWindow
wvsprintfA
setupapi
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
Sections
.text Size: 187KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ