Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_040c30082286a606b7296fc94e4d95a8.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_040c30082286a606b7296fc94e4d95a8.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_040c30082286a606b7296fc94e4d95a8
-
Size
252KB
-
MD5
040c30082286a606b7296fc94e4d95a8
-
SHA1
2c3baea326c2d950ac61a8d226b7a10aa712c622
-
SHA256
c34653339a41307d32ccbd8712b8a4c85007b68c5eab8d34d553592ad13487ad
-
SHA512
deaf3895977a3528d27bf3f2773de6286790e8ae976bddbf7940dd54054370b1458461b95d507e0e915a3868c327fa68319c506efd55d0a419f64c6e513696bc
-
SSDEEP
6144:LVzVSleqEKiX2Lh7n0CqPgGATLZBBkhUt43essBAUz5WD:LV5SleqkkGCGA/deII
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_040c30082286a606b7296fc94e4d95a8
Files
-
JaffaCakes118_040c30082286a606b7296fc94e4d95a8.exe windows:4 windows x86 arch:x86
b6f7162d4a612d540322f202cb133dd2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shfolder
SHGetFolderPathA
kernel32
IsBadCodePtr
IsValidCodePage
IsValidLocale
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
WaitForSingleObject
IsBadReadPtr
IsBadWritePtr
GetACP
GetCurrentThreadId
CreateEventA
GetExitCodeThread
IsBadStringPtrA
GetComputerNameA
WaitForMultipleObjects
lstrcpyA
LocalFree
GetSystemInfo
FreeLibrary
RaiseException
FatalAppExitA
TlsAlloc
GetModuleHandleA
SetUnhandledExceptionFilter
GetOEMCP
GetProcAddress
user32
wsprintfA
advapi32
RegCloseKey
RegOpenKeyA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
GetUserNameA
ImpersonateLoggedOnUser
RevertToSelf
OpenThreadToken
OpenProcessToken
ole32
CoCreateGuid
quartz
AMGetErrorTextW
DllUnregisterServer
AMGetErrorTextA
AmpFactorToDB
DBToAmpFactor
DllGetClassObject
DllCanUnloadNow
authz
AuthziFreeAuditEventType
AuthzInitializeContextFromSid
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QM Size: 1024B - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DagW Size: 76KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Ceut Size: 512B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lsCEUA Size: 1024B - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CYWZs Size: 1KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AlD Size: 141KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.PVjabH Size: 4KB - Virtual size: 454KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ