Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_266ce7528e58667cd4d4478b0010ac7b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_266ce7528e58667cd4d4478b0010ac7b.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_266ce7528e58667cd4d4478b0010ac7b
-
Size
193KB
-
MD5
266ce7528e58667cd4d4478b0010ac7b
-
SHA1
3d639a7a2474341466b9e45745c7b79d3084a829
-
SHA256
3711e3c5bf3dd529479429acad995e64da22d48883296ca1b725c70f7019017f
-
SHA512
e79134f00b6bc726129960aeb616c60b2189427e4bcef5effa0454692d66695f08a6f29cca5e2a2d850cdcb6a486ee58547e9e1c7cc02500470957b4b7b662f3
-
SSDEEP
6144:TuzCWU1+yCYOvk25uHhh4Pf01+UDd46lWc:L1+ymvDQBhws1+2d4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_266ce7528e58667cd4d4478b0010ac7b
Files
-
JaffaCakes118_266ce7528e58667cd4d4478b0010ac7b.exe windows:4 windows x86 arch:x86
2d3123a23fab77c14f2a462aa6d6f676
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetStringTypeW
GetACP
WriteConsoleW
LCMapStringW
WaitForSingleObject
SetProcessAffinityMask
FlushFileBuffers
QueryPerformanceCounter
LoadLibraryA
WaitForMultipleObjects
GetCurrentThreadId
WriteFile
InterlockedIncrement
SetEvent
CreateFileW
ReadFile
Sleep
GetOEMCP
GlobalLock
WriteConsoleA
GetModuleFileNameW
GetStringTypeA
GetCurrentProcessId
CreateProcessW
GetSystemTimeAsFileTime
EnumResourceTypesA
IsValidCodePage
DeleteCriticalSection
CreateEventW
GlobalAlloc
SetNamedPipeHandleState
GetEnvironmentStrings
LCMapStringA
InterlockedDecrement
GetLocalTime
CreateFileA
SetStdHandle
OutputDebugStringW
GetConsoleOutputCP
FreeEnvironmentStringsA
GetCPInfo
GetEnvironmentStringsW
MoveFileW
SetEndOfFile
GetLocaleInfoA
TerminateThread
GlobalUnlock
imm32
ImmAssociateContext
ole32
CoMarshalHresult
CoSetProxyBlanket
CoInitializeSecurity
CoQueryProxyBlanket
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromGUID2
Sections
.text Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ