Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_036fa71c7d5e3f874dd767a7f65e953e.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_036fa71c7d5e3f874dd767a7f65e953e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_036fa71c7d5e3f874dd767a7f65e953e
-
Size
343KB
-
MD5
036fa71c7d5e3f874dd767a7f65e953e
-
SHA1
1ec5902758158cb11dce880e35981d071c91821d
-
SHA256
a47d324f1855febc7ba001ffaa1de4fe3f9904563c0db8439a70f8cfc60acd7c
-
SHA512
73380de802581a96812bd01111428e265aba3ae509b59ce2a15a3b13644b0d9b8945b4da60e0ec0c017e3e96fb37fbbdcdbe549fab7881d8cf78a0f05fa3687d
-
SSDEEP
6144:UUka508RJ6lyD5Nj/ZTm8iTAy1PRNFNh9U05WV/uAk03AwddIaeuq:URavJgG5NjpWLJN9UQWFDpte
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_036fa71c7d5e3f874dd767a7f65e953e
Files
-
JaffaCakes118_036fa71c7d5e3f874dd767a7f65e953e.exe windows:5 windows x86 arch:x86
4b9e5276cc5a495f7de5bc85d5a31244
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegDeleteKeyA
RegFlushKey
StartServiceA
RegQueryInfoKeyA
RegSetValueExA
ControlService
OpenSCManagerA
RegCloseKey
RegOpenKeyExA
OpenServiceA
RegCreateKeyExA
ImpersonateSelf
RegDeleteValueA
RegEnumKeyExA
RegQueryValueExA
DeleteService
RegEnumValueA
CloseServiceHandle
QueryServiceStatus
RevertToSelf
ole32
CoInitialize
CoCreateInstance
CoUninitialize
setupapi
SetupInstallServicesFromInfSectionA
SetupInstallFromInfSectionA
SetupOpenInfFileA
user32
CharUpperW
CharUpperA
CharToOemA
LoadStringA
CharLowerW
FindWindowA
RegisterWindowMessageA
PostMessageA
FindWindowExA
GetSystemMetrics
MessageBoxA
UnregisterClassA
CharLowerA
wsprintfA
kernel32
RtlUnwind
lstrlenA
UnhandledExceptionFilter
IsBadCodePtr
SetHandleCount
FreeEnvironmentStringsW
FormatMessageA
GetModuleHandleA
SetPriorityClass
LockResource
GetTempPathA
GetStdHandle
TlsGetValue
lstrcmpiA
GetUserDefaultLCID
DeleteFileA
VirtualAlloc
RaiseException
OpenEventA
LCMapStringW
RemoveDirectoryA
EnterCriticalSection
GetCommandLineA
LoadLibraryExA
WaitForSingleObject
CloseHandle
SizeofResource
WideCharToMultiByte
MoveFileExA
FatalAppExitA
SetEndOfFile
SetConsoleCtrlHandler
HeapFree
FindFirstFileA
GetPrivateProfileStringA
GetDateFormatA
GetCurrentDirectoryA
ReadFile
SetThreadPriority
SetFilePointer
TlsFree
TlsAlloc
GetSystemDirectoryA
LCMapStringA
IsValidLocale
OpenProcess
ReleaseMutex
GetThreadLocale
IsValidCodePage
SetLastError
VirtualFree
CreateFileA
LoadLibraryExW
LocalFree
CreateMutexA
SetStdHandle
lstrcmpiW
HeapSize
CreateProcessA
ResumeThread
GetProcessHeap
HeapAlloc
GetStringTypeExA
LeaveCriticalSection
TlsSetValue
FreeEnvironmentStringsA
EnumSystemLocalesA
GetLocalTime
CompareStringA
SetUnhandledExceptionFilter
VirtualQuery
FindResourceExA
GetTimeZoneInformation
LoadResource
HeapReAlloc
GetWindowsDirectoryA
SetEnvironmentVariableA
CompareStringW
FindClose
FreeLibrary
GetACP
lstrlenW
GetSystemTimeAsFileTime
FlushFileBuffers
GetTimeFormatA
DeleteCriticalSection
FreeResource
WriteFile
GetStringTypeExW
GetSystemInfo
GetOEMCP
GetFileType
HeapDestroy
VirtualProtect
FindNextFileA
SetFileAttributesA
GetCurrentThreadId
SetErrorMode
VirtualAllocEx
shell32
SHGetDesktopFolder
SHGetFolderPathA
SHGetSpecialFolderLocation
SHGetMalloc
psapi
EnumProcesses
GetModuleBaseNameA
EnumProcessModules
atmlib
ATMFinish
ATMGetNtmFields
ATMGetGlyphListA
ATMGetOutline
ATMMakePFMW
ATMGetPostScriptName
ATMEnumMMFontsW
ATMFontStatus
ufat
Format
Chkdsk
ChkdskEx
FormatEx
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 314KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ