Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700
-
Size
191KB
-
MD5
4beb2dc6e6ddb5f9c44f65d2ecf15700
-
SHA1
85ca05199f36c0f5918c9de4bf0ff268b6bad95f
-
SHA256
d76db7f6580126a1217c47c5136b113711425e1c5380017c1732d12822c3ac76
-
SHA512
7f9c9d2634f2b891e86e1b1f0ffa8a07f295428248a9a269a91e2c2d16e57056dced9087bd3c37fb3c2be4a4ea4e5447fcc48595315037bc7634e0cb6a68d104
-
SSDEEP
3072:Hnk0q9YAjEFz7cUa8v2KvwSKJJQzL6Ql5OgjPbfvdIC7w8LjEuPqmJpX/YGRg:XeY4EFcU3wVJJsjHBbfvXMUdN/PO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700
Files
-
JaffaCakes118_4beb2dc6e6ddb5f9c44f65d2ecf15700.exe windows:5 windows x86 arch:x86
41afbc741048f8bc47fee93038986864
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
FreeSid
kernel32
LocalFree
GetModuleHandleA
GetProcAddress
VirtualProtect
gdi32
GetDeviceCaps
user32
ExitWindowsEx
MessageBoxA
comctl32
ord17
version
GetFileVersionInfoA
Sections
.text Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ