Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_14baa67c1ee9fd89024f1064af1c4a42.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_14baa67c1ee9fd89024f1064af1c4a42.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_14baa67c1ee9fd89024f1064af1c4a42
-
Size
245KB
-
MD5
14baa67c1ee9fd89024f1064af1c4a42
-
SHA1
4536b395d5f91635887350cc9683eb655a8f3106
-
SHA256
c142fd197a3a870e401c92d012904d7f8479c5cc993aaa0d34e641c8a5de4bb1
-
SHA512
65a4dbfdbeb66288ad081ecc26e804e7fcdd1ceae1909bdb5b7246dfaefe318bade12040dd2e6a136818546d790043824c20e9af01f60a4dd8671aa4145aa612
-
SSDEEP
6144:QBCb2cOL7SLMOQi9gvjVNQQjIwfQqsDbxRA0U:QBChWIOvjV61LA0U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_14baa67c1ee9fd89024f1064af1c4a42
Files
-
JaffaCakes118_14baa67c1ee9fd89024f1064af1c4a42.exe windows:4 windows x86 arch:x86
d5a135f8c296d945b7d5ebc9ab561847
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
EnumProcesses
EnumProcessModules
GetModuleFileNameExA
comctl32
InitCommonControlsEx
oleaut32
SysAllocString
SysFreeString
shlwapi
PathFindFileNameW
user32
GetCursorPos
GetDesktopWindow
RedrawWindow
RemovePropW
SendMessageW
FindWindowW
GetAncestor
SetWindowLongW
GetWindowRect
ExitWindowsEx
GetParent
GetSysColor
MessageBoxW
CopyRect
SetPropW
ScreenToClient
GetWindowLongW
EnableWindow
IsWindow
FillRect
LoadCursorW
DrawTextW
PostMessageW
SetWindowPos
SystemParametersInfoW
SetCursor
ClientToScreen
PtInRect
SetForegroundWindow
IsWindowVisible
GetPropW
GetClientRect
gdi32
SetBkMode
BitBlt
CreateFontIndirectW
DeleteDC
LineTo
DeleteObject
GetTextExtentPoint32W
CreatePen
CreateCompatibleBitmap
CreateCompatibleDC
SetBkColor
GetStockObject
SelectObject
GetTextMetricsW
SetTextJustification
SetTextColor
MoveToEx
GetCurrentObject
GetObjectW
CreateSolidBrush
kernel32
ResetEvent
GetCurrentThreadId
EnterCriticalSection
CreateThread
GetProcessTimes
WriteFile
SetFilePointer
OpenMutexW
IsDebuggerPresent
LeaveCriticalSection
CreateProcessW
UnhandledExceptionFilter
CreateDirectoryW
FindFirstFileW
VirtualQuery
ReleaseMutex
CreateMutexW
GetModuleHandleW
CreateFileW
UnmapViewOfFile
GetSystemTimeAsFileTime
GetCommandLineW
MapViewOfFile
FreeLibrary
OpenProcess
DeleteFileW
SetLastError
FindClose
OpenEventW
WaitForSingleObject
DeleteCriticalSection
GetLocalTime
OpenFileMappingW
CloseHandle
FindNextFileW
SetUnhandledExceptionFilter
FormatMessageA
VirtualAlloc
shell32
ShellExecuteW
SHGetFolderPathW
advapi32
LookupPrivilegeValueW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
GetUserNameW
odbccp32
SQLGetPrivateProfileString
SelectTransDlg
SQLInstallTranslator
SQLRemoveDriverW
SQLGetPrivateProfileStringW
SQLWriteFileDSN
aclui
EditSecurity
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SOEtb Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.L Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QtQRi Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idgF Size: 512B - Virtual size: 318B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gd Size: 512B - Virtual size: 619B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rlWBHG Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 213KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ