Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_12312330b1d0311ffe5bac566c585c9e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_12312330b1d0311ffe5bac566c585c9e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_12312330b1d0311ffe5bac566c585c9e
-
Size
273KB
-
MD5
12312330b1d0311ffe5bac566c585c9e
-
SHA1
0b1509a0849047b195ac805254132ac0c50baee7
-
SHA256
801d1003bb76927bc39c5839adb0ffd3933dc33a20f0ee1d5da72af55c4396a2
-
SHA512
f2dca63bceeded3bfefd511e501f7572c56d1b864d1d945cd1233bf166d47ad150bbe82df12ab74bce7b60f8065c410b6d1f69e1720d8342d00cb0f2af97c87d
-
SSDEEP
6144:1Ei1F3F60zKwnVsL3OTTjuPIx7BAm/cTyzGzyxqy+rK2zd6w403:1E2lzKwnVsL3ODcIx7B5/+uqy+nz8z0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_12312330b1d0311ffe5bac566c585c9e
Files
-
JaffaCakes118_12312330b1d0311ffe5bac566c585c9e.exe windows:4 windows x86 arch:x86
e016c4ba53966f421a6269b2fd85695b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
GlobalGetAtomNameW
lstrlenA
FindNextFileA
GetModuleHandleA
ReadFile
GetCurrentThreadId
WideCharToMultiByte
EnumResourceTypesA
SetFilePointer
GlobalHandle
CreateMailslotA
WriteFile
FindFirstFileA
EnumResourceLanguagesW
IsDBCSLeadByte
QueryPerformanceCounter
FindClose
oleacc
AccessibleChildren
CreateStdAccessibleProxyA
newdev
UpdateDriverForPlugAndPlayDevicesA
Sections
.text Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ