Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_01d9c4d07bf685823926a8f2badeb89d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_01d9c4d07bf685823926a8f2badeb89d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_01d9c4d07bf685823926a8f2badeb89d
-
Size
295KB
-
MD5
01d9c4d07bf685823926a8f2badeb89d
-
SHA1
01ca05fe82990d149594e823d4dc7a7d5360a354
-
SHA256
b1c9ac0ef29f44fc22ae1fc533ed12711b5f27be9d0ed41d312b3e25e5004e49
-
SHA512
0419b79a3c2e44a89f8bc4262a4fbce9200a6f10057fef3cea1f04fa5550f8eefa13fcb9c6f2637b106770b5d68fbcdab878f395427bc26608785fcc71abfe54
-
SSDEEP
6144:8oT74Va1kira1cPc43KoeqaBa4GJkmSVOq8ub:8M8Va+irV13Vqa4GemSj8ub
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_01d9c4d07bf685823926a8f2badeb89d
Files
-
JaffaCakes118_01d9c4d07bf685823926a8f2badeb89d.exe windows:5 windows x86 arch:x86
ec543255b80a20b1971f49e8c4d5b182
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryInfoKeyW
RegCloseKey
SetSecurityDescriptorDacl
RegSetValueExW
RegDeleteValueW
InitializeSecurityDescriptor
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
kernel32
SystemTimeToTzSpecificLocalTime
GetCommandLineA
GetConsoleMode
TlsFree
SetEndOfFile
IsDebuggerPresent
GetSystemDirectoryA
GetSystemTime
GetProcessHeap
ExpandEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
SetFilePointer
WriteFile
FileTimeToSystemTime
RaiseException
SetUnhandledExceptionFilter
VirtualAlloc
WriteConsoleW
IsValidCodePage
GetConsoleOutputCP
SetStdHandle
GetConsoleCP
UnhandledExceptionFilter
LCMapStringW
GetSystemTimeAsFileTime
DeleteCriticalSection
HeapFree
GetModuleHandleA
HeapAlloc
EnterCriticalSection
LCMapStringA
GetTempPathA
GetCurrentThreadId
LeaveCriticalSection
SetLastError
HeapSize
CloseHandle
FreeLibrary
GetStdHandle
SystemTimeToFileTime
HeapDestroy
VirtualFree
GetTimeFormatA
FlushFileBuffers
TlsAlloc
GetOEMCP
RtlUnwind
IsValidLocale
TlsSetValue
WriteConsoleA
HeapReAlloc
EnumSystemLocalesA
ReadFile
GetModuleHandleW
TlsGetValue
WideCharToMultiByte
SetHandleCount
FreeEnvironmentStringsA
CreateFileA
FreeEnvironmentStringsW
GetACP
GetFileType
rpcrt4
UuidCreate
ole32
StringFromGUID2
ws2_32
WSCGetProviderPath
WSAStartup
WSCWriteProviderOrder
WSCEnumProtocols
WSACleanup
WSCDeinstallProvider
WSCInstallProvider
iphlpapi
GetTcpTable
GetUdpTable
NTTimeToNTPTime
CreateIpForwardEntry
InternalGetIpNetTable
InternalGetIpAddrTable
GetIcmpStatistics
InternalSetTcpEntry
NTPTimeToNTFileTime
authz
AuthzCachedAccessCheck
AuthziFreeAuditParams
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 271KB - Virtual size: 381KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ