Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d016e63391e47d45f244e7205ebc712b.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_d016e63391e47d45f244e7205ebc712b
-
Size
287KB
-
MD5
d016e63391e47d45f244e7205ebc712b
-
SHA1
05de4503b14933267a9498a52920290ab88a9898
-
SHA256
23ae88ebe838fb372e2ab3c6be466606c510936d8b8910ef941bc7cf919623da
-
SHA512
f88bbf558213a3adda2e0e1a7721384a2c65bfd7a3c227a0990fa44954b0f25e7c842db6dbcdd887009e6fc6396456d7aa0b4513c41e3f630edf62205c75644b
-
SSDEEP
6144:Jlq904HDzA6skiQUVwerZIKFGSNUXT0cI/kX1PABS4brjXMMc:jizA6sxl9rZfGT0cOkX1os4bn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_d016e63391e47d45f244e7205ebc712b
Files
-
JaffaCakes118_d016e63391e47d45f244e7205ebc712b.exe windows:4 windows x86 arch:x86
e8aac497fc154b2d6cf23301f875e4c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
GetFileAttributesA
LCMapStringW
SetUnhandledExceptionFilter
GetAtomNameA
WideCharToMultiByte
GetThreadLocale
VirtualProtect
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
IsBadCodePtr
SetFilePointer
FreeLibrary
UnhandledExceptionFilter
EnumResourceNamesA
GetEnvironmentStrings
FindFirstFileA
FreeEnvironmentStringsA
GetFullPathNameA
WriteFile
ReadFile
GetStringTypeA
GetCPInfo
GetOEMCP
GetDiskFreeSpaceA
IsBadReadPtr
CreateFileA
FlushFileBuffers
MulDiv
shlwapi
DllGetVersion
PathIsFileSpecA
SHCreateStreamOnFileEx
PathAppendA
PathIsContentTypeA
PathCreateFromUrlW
rpcrt4
RpcStringFreeA
Sections
.text Size: 152KB - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ