Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_bf3d1da540c6a1ef116ea71b32fb9b13.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_bf3d1da540c6a1ef116ea71b32fb9b13.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_bf3d1da540c6a1ef116ea71b32fb9b13
-
Size
276KB
-
MD5
bf3d1da540c6a1ef116ea71b32fb9b13
-
SHA1
2e3788bd4b66efcaa9885bfc1b549a4ab059682e
-
SHA256
293887a9bb8213ea8a1cb57c91d9ddf815c5e94b53e9ac7dea9276dc562a3ef9
-
SHA512
0639fff6732efe44cfd6b0f4eab6146a2580a7ab48bd4048f04fe34bcd71825901fb4fc2bc0c9562e453414a92b953414a0968bd04045931d6d50b6f724f3b15
-
SSDEEP
6144:jajFNKSFgtgBhuNe240x0SpO5OT5ARcAZDNMUY:+NfFgyCP0SSOyc2s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_bf3d1da540c6a1ef116ea71b32fb9b13
Files
-
JaffaCakes118_bf3d1da540c6a1ef116ea71b32fb9b13.exe windows:4 windows x86 arch:x86
5973988117e3dcadede1c923a2efcdda
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetCurrentDirectoryW
DeleteFileW
FileTimeToLocalFileTime
GetAtomNameA
FindFirstChangeNotificationW
GlobalSize
GetPrivateProfileIntW
MultiByteToWideChar
GetModuleFileNameW
WideCharToMultiByte
FindNextChangeNotification
LoadLibraryW
LockResource
lstrcpyW
LoadLibraryA
GetVersion
LoadLibraryExW
GlobalUnlock
MulDiv
ResumeThread
InitializeCriticalSection
FreeLibrary
EnumResourceTypesA
GetModuleHandleW
FindResourceW
WritePrivateProfileStringW
GetFileAttributesW
lstrlenW
FindCloseChangeNotification
GetPrivateProfileStringW
GlobalAlloc
CloseHandle
GetTickCount
LoadResource
GlobalFree
GetVersionExA
FindClose
WaitForSingleObject
IsValidCodePage
DeleteCriticalSection
GlobalLock
lstrcpynW
lstrcmpW
GetProcAddress
GetCurrentThreadId
FileTimeToSystemTime
GetLastError
FindFirstFileW
InterlockedIncrement
Sleep
GetLocaleInfoW
SetFileAttributesW
SetThreadPriority
shell32
SHGetImageList
ShellExecuteW
SHGetPathFromIDListA
SHGetFileInfoA
SHGetFolderPathW
ShellExecuteExW
SHBrowseForFolderA
CommandLineToArgvW
SHFileOperationW
ShellExecuteExA
Shell_NotifyIconA
Sections
.text Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ