Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f2fc087a47acfd5626ed803964bbac1e.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_f2fc087a47acfd5626ed803964bbac1e
-
Size
416KB
-
MD5
f2fc087a47acfd5626ed803964bbac1e
-
SHA1
28ad64741a5eb419b381f185794a73007da681cd
-
SHA256
2a21fc6416ca10a6c165742a5c230220da02574bfd912e269a0297eddecf70de
-
SHA512
4ebd6fa084a110621818e7ce713aab0518a9e362bdd928e16865a2d5a929cf1b5da1298d3eec8286bccac00b8ea2a57fe597afa32aa75445a61bf38e286ea593
-
SSDEEP
12288:3ip2ukggSkVR0tIMM1pbKKQ48Iqgt8rXVdAg:SpuDSO0tW1pbKKQ4pqgt8rwg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_f2fc087a47acfd5626ed803964bbac1e
Files
-
JaffaCakes118_f2fc087a47acfd5626ed803964bbac1e.dll windows:4 windows x86 arch:x86
9b716776428b2e56f91e12e51e5423bc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shell32
SHGetSettings
rpcrt4
UuidCreate
ole32
CoTaskMemFree
CoTaskMemAlloc
dbghelp
ImagehlpApiVersion
FindExecutableImage
ImageRvaToVa
ImageRvaToSection
GetTimestampForLoadedLibrary
FindExecutableImageEx
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
GetDC
GetKeyboardLayout
GetKeyboardLayoutList
GetMenuCheckMarkDimensions
GetMonitorInfoA
GetSysColor
GetSystemMetrics
ReleaseDC
SystemParametersInfoA
EnumDisplayMonitors
kernel32
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetProcessTimes
GetShortPathNameA
GetStringTypeExW
GetSystemDefaultLCID
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTempPathW
DeleteCriticalSection
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapLock
HeapReAlloc
HeapSize
HeapUnlock
FindNextFileW
InterlockedCompareExchange
InterlockedExchange
IsDBCSLeadByte
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryW
SetFileAttributesW
SetLastError
SetLocalTime
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WriteFile
CreateSemaphoreA
CreateMutexA
CreateFileW
CreateDirectoryW
CloseHandle
FindFirstFileW
FindClose
ExpandEnvironmentStringsW
EnterCriticalSection
InitializeCriticalSection
DeleteFileW
GetTickCount
advapi32
GetTraceEnableLevel
AddAccessDeniedAce
GetTokenInformation
GetSecurityDescriptorDacl
GetLengthSid
FreeSid
CopySid
ConvertStringSecurityDescriptorToSecurityDescriptorW
UnregisterTraceGuids
TraceEvent
SetSecurityDescriptorDacl
RegisterTraceGuidsA
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyW
RegCreateKeyExW
RegCloseKey
OpenThreadToken
OpenProcessToken
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
GetTraceLoggerHandle
ConvertSidToStringSidA
CheckTokenMembership
AllocateAndInitializeSid
AddAccessAllowedAce
shlwapi
StrCmpNA
StrChrA
PathFileExistsA
ChrCmpIA
gdi32
DeleteObject
DeleteDC
CreateSolidBrush
CreateDCA
GetDeviceCaps
dsound
ord9
Sections
.text Size: 336KB - Virtual size: 335KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ