Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_005460fb236b7ddfb5d8a37cf9be662e.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_005460fb236b7ddfb5d8a37cf9be662e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_005460fb236b7ddfb5d8a37cf9be662e
-
Size
251KB
-
MD5
005460fb236b7ddfb5d8a37cf9be662e
-
SHA1
21cc922ea2c3c0e4d37dd2d1ab9915bea1d150fa
-
SHA256
4a00383ea0aa1a870b6c5e5af0f0c368dc90f96fdb7d4eec033bb191104f0568
-
SHA512
d1b55c2dcaecc91526cf50f1fe6aee8c4d6e540ed849b534dfa9e2bd8a0025ab5f0e1d17055d2e513cfa3c2f1c3220cfee8daffccbf3e1bc49bae0aae7351827
-
SSDEEP
6144:XHH0JyyMuVNL2703NpymOVfW9NQ1Tp9fsp8jd:Xn0VMUPymOVB5p9We
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_005460fb236b7ddfb5d8a37cf9be662e
Files
-
JaffaCakes118_005460fb236b7ddfb5d8a37cf9be662e.exe windows:4 windows x86 arch:x86
f8c872eb2ef02c446e8bc24848622408
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
lstrcpynA
lstrlenA
GetLastError
GetFullPathNameA
GetFileAttributesA
lstrcpynW
lstrlenW
GetFileAttributesW
FreeLibrary
MultiByteToWideChar
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
Sleep
LocalFree
GetTickCount
GetModuleFileNameW
GetVersionExW
LocalAlloc
LoadLibraryW
BeginUpdateResourceW
GetProcAddress
LoadLibraryA
user32
EnableWindow
SetForegroundWindow
SendMessageW
GetSubMenu
GetSysColor
RegisterClassExW
MonitorFromRect
LoadCursorW
GetMessageW
DialogBoxParamA
LoadBitmapA
LoadImageA
GetCapture
CharLowerA
SendDlgItemMessageA
GetTopWindow
GetKeyState
FindWindowA
CharPrevW
RegisterClassW
CreateDialogParamA
EmptyClipboard
GetCursorPos
ActivateKeyboardLayout
EndDialog
RegisterClassExA
advapi32
RegCreateKeyExW
RegEnumKeyW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteKeyA
shell32
SHGetDesktopFolder
samlib
SamCloseHandle
SamFreeMemory
gdi32
CreatePatternBrush
CreateICW
CreateBitmapIndirect
CreateScalableFontResourceW
GetEnhMetaFileW
CreateRectRgn
UpdateICMRegKeyW
CreateColorSpaceW
CreateFontA
AddFontResourceW
Sections
.text Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.WqCoRT Size: 2KB - Virtual size: 315KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.XkLz Size: 78KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.akZB Size: 512B - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.IIAM Size: 512B - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QwBU Size: 2KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 359KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xTNTR Size: 139KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ