Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0a2398b20ff25331f2bf04d7cc279856.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0a2398b20ff25331f2bf04d7cc279856.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0a2398b20ff25331f2bf04d7cc279856
-
Size
286KB
-
MD5
0a2398b20ff25331f2bf04d7cc279856
-
SHA1
490d0ae34dddba5d148345a5dbc769f37eb39ff4
-
SHA256
26c30f7c560fd6fc942a4c4f1506bcadc0724dcc75f42a0635af7faac62f4f12
-
SHA512
2f0274f403b16fc702ece37e00888677000df3bdae7ca2e8ae4f6ae995ccd2db991bc2dc91b2870072aa70d6c62a04d1b2f5abb62f8d12c3cf8c31629b0bc3fa
-
SSDEEP
6144:7ur1uTIK6/6FtZUmGZlmDBeci+lmQciCv:yr1WIK6sZUm8mDEZEmQyv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_0a2398b20ff25331f2bf04d7cc279856
Files
-
JaffaCakes118_0a2398b20ff25331f2bf04d7cc279856.exe windows:4 windows x86 arch:x86
e28665b08a51384d3015bb4b499f043b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wintrust
WinVerifyTrust
crypt32
CryptMsgClose
CertFreeCertificateChain
CryptHashPublicKeyInfo
CryptUnprotectData
CryptMsgGetParam
CertGetCertificateChain
CertCloseStore
CryptDecodeObject
CertFreeCertificateContext
CryptQueryObject
CertVerifyCertificateChainPolicy
CryptMsgGetAndVerifySigner
shlwapi
PathCanonicalizeW
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
ws2_32
gethostbyname
socket
closesocket
WSAStartup
inet_ntoa
inet_addr
ntohs
bind
htons
getsockname
WSACleanup
advapi32
RegEnumKeyExW
CloseServiceHandle
RegOpenKeyW
RegSetValueExW
OpenServiceW
QueryServiceConfigW
RegQueryValueExW
LsaClose
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
ControlService
QueryServiceStatus
LsaFreeMemory
LsaQueryInformationPolicy
OpenSCManagerW
LsaOpenPolicy
msi
ord32
ord113
ord171
ord92
ord8
ord45
ord190
ord205
ord70
ord169
ord137
ord111
ord159
ord88
ord121
ord125
ord211
ord160
ord118
ord141
ord204
ord116
ord120
ord115
ord17
kernel32
GetSystemWindowsDirectoryW
GetPrivateProfileStringW
GetFileInformationByHandle
HeapAlloc
SetFilePointer
FileTimeToSystemTime
OpenProcess
IsValidCodePage
FindResourceW
CreateProcessW
lstrcmpW
CreateNamedPipeW
CancelIo
CreateThread
CompareFileTime
GetSystemTime
LocalFree
GetWindowsDirectoryW
EnterCriticalSection
lstrlenW
OutputDebugStringW
SetStdHandle
IsDebuggerPresent
VirtualAlloc
GetUserDefaultLCID
DuplicateHandle
LocalAlloc
SetEnvironmentVariableA
CreateFileMappingW
LoadLibraryExW
GetOverlappedResult
LoadResource
HeapDestroy
WideCharToMultiByte
Process32NextW
FindFirstFileExW
ResetEvent
GetFileType
FlushInstructionCache
GetComputerNameW
GetConsoleCP
LeaveCriticalSection
RaiseException
DisconnectNamedPipe
IsValidLocale
FlushFileBuffers
InterlockedPopEntrySList
LCMapStringW
WritePrivateProfileSectionW
InterlockedPushEntrySList
UnmapViewOfFile
GetTempFileNameW
SystemTimeToFileTime
GetTempPathW
GetFileAttributesExW
lstrcmpA
SetHandleCount
DeleteFileW
TlsSetValue
GetProcessHeap
FindFirstFileW
GetConsoleMode
RemoveDirectoryW
WaitNamedPipeW
GetSystemTimeAsFileTime
GetStdHandle
ReadFile
SetEndOfFile
lstrcmpiW
HeapReAlloc
GetSystemDirectoryW
ReleaseMutex
CreateFileW
GetCurrentThreadId
MapViewOfFile
GetCurrentDirectoryW
HeapSize
GetModuleHandleW
FindResourceExW
ConnectNamedPipe
CreateEventW
ResumeThread
HeapFree
GetOEMCP
Module32FirstW
SetUnhandledExceptionFilter
ExpandEnvironmentStringsW
CloseHandle
ExitThread
GetTimeZoneInformation
OpenMutexW
IsWow64Process
CreateToolhelp32Snapshot
EnumUILanguagesW
DeleteCriticalSection
TlsGetValue
InitializeCriticalSectionAndSpinCount
EnumSystemLocalesA
GetACP
Process32FirstW
WaitForMultipleObjects
SizeofResource
CreateMutexW
UnhandledExceptionFilter
GetLocalTime
GetCommandLineA
TlsFree
FreeLibrary
GetFileTime
GetShortPathNameW
FormatMessageW
SetLastError
GetFileSizeEx
GetFileSize
lstrlenA
TlsAlloc
CopyFileW
WriteFile
PeekNamedPipe
WriteConsoleW
FindClose
FreeEnvironmentStringsW
CompareStringW
VirtualFree
FindNextFileW
IsProcessorFeaturePresent
LockResource
GetFullPathNameW
CreateDirectoryW
RtlUnwind
GetSystemInfo
MulDiv
WaitForSingleObject
GetDriveTypeW
GetCommandLineW
GetCurrentProcess
VirtualAllocEx
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
ole32
CLSIDFromProgID
StringFromGUID2
CoTaskMemFree
CLSIDFromString
StringFromCLSID
CoCreateInstance
CoInitializeEx
OleRun
CoTaskMemRealloc
CoInitialize
CoTaskMemAlloc
CoUninitialize
setupapi
SetupIterateCabinetW
shell32
SHGetPathFromIDListW
SHGetMalloc
CommandLineToArgvW
SHBrowseForFolderW
SHGetSpecialFolderPathW
SHGetFolderPathW
oleaut32
VariantInit
VarUI4FromStr
VarBstrCmp
VariantCopy
SysFreeString
DispGetParam
GetErrorInfo
SetErrorInfo
SysStringByteLen
LoadTypeLi
VariantClear
LoadRegTypeLi
SysAllocStringLen
SysStringLen
CreateErrorInfo
SysAllocString
SysAllocStringByteLen
cabinet
ord23
ord21
ord22
ord20
gdi32
DeleteObject
GetDeviceCaps
CreateFontIndirectW
user32
GetDC
GetParent
SetDlgItemTextW
SetWindowPos
DefWindowProcW
GetWindowLongW
SetWindowLongW
ReleaseCapture
GetClientRect
DestroyWindow
MonitorFromWindow
GetDlgItemTextW
MessageBoxW
CharNextW
SetCursor
PeekMessageW
LoadCursorW
CallWindowProcW
GetSystemMetrics
RegisterClassExW
GetWindowRect
MsgWaitForMultipleObjects
SetWindowTextW
CreateWindowExW
GetClassInfoExW
ReleaseDC
CharPrevW
SystemParametersInfoW
GetDlgItem
SetCapture
UnregisterClassA
BeginPaint
EndPaint
DispatchMessageW
GetActiveWindow
SendMessageW
DialogBoxParamW
GetWindow
MapWindowPoints
TranslateMessage
EndDialog
GetMonitorInfoW
IsWindow
comctl32
CreateStatusWindow
ImageList_Remove
ImageList_DragShowNolock
InitCommonControlsEx
FlatSB_SetScrollRange
ImageList_Draw
ImageList_Create
ImageList_LoadImage
ImageList_GetIcon
InitCommonControls
CreateToolbarEx
CreatePropertySheetPage
kbdblr
KbdLayerDescriptor
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: 35KB - Virtual size: 769KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 178KB - Virtual size: 622KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ