Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7668c08e445f191ffbd4872131f26cf6.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7668c08e445f191ffbd4872131f26cf6.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_7668c08e445f191ffbd4872131f26cf6
-
Size
145KB
-
MD5
7668c08e445f191ffbd4872131f26cf6
-
SHA1
26a7de9946893af8367d941efa175d4958bf659b
-
SHA256
5bbadf8eaad818d03df84736fd6889cbae6615af9d587d6f6d90e2e1a2f65494
-
SHA512
f4c5e276fb08a138744080dbe3a1ec53aebaad88143f009adbc65545453d2d25e33f38b18f37d095710d0fc52dd7f40769c71de99271358433727f2528be5444
-
SSDEEP
3072:4Vkh9/UUKYSiQyoUddFX/nMTqdckOhihdRikOoRw+yDiY:mg9kiDVFPnMmdc1ihmkOoRLciY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_7668c08e445f191ffbd4872131f26cf6
Files
-
JaffaCakes118_7668c08e445f191ffbd4872131f26cf6.exe windows:4 windows x86 arch:x86
6abb754c13d6f50c6bf1f294cfbb163d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
GetModuleFileNameA
GetShortPathNameA
GetVersionExA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetSystemDirectoryA
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetProcAddress
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
VirtualFree
HeapCreate
LocalAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
LocalFree
FreeLibrary
GetEnvironmentStringsW
LoadLibraryA
GetExitCodeProcess
CreateProcessA
lstrcatA
lstrlenA
WinExec
CloseHandle
GetLastError
SetFilePointer
WriteFile
ReadFile
HeapDestroy
GetEnvironmentVariableA
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
FileTimeToLocalFileTime
CreateFileA
UnhandledExceptionFilter
SetFileAttributesA
GetFileAttributesA
ExitProcess
TerminateProcess
GetCurrentProcess
HeapCompact
HeapAlloc
HeapReAlloc
HeapFree
RemoveDirectoryA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
SetEnvironmentVariableA
user32
SendMessageA
GetWindow
GetSystemMetrics
CreateWindowExA
LoadIconA
LoadCursorA
RegisterClassA
CreateDialogParamA
GetDlgItem
DestroyWindow
PostQuitMessage
DefWindowProcA
DialogBoxParamA
EndDialog
SetDlgItemTextA
TranslateMessage
DispatchMessageA
GetMessageA
IsDialogMessageA
SetWindowLongA
SetWindowTextA
MessageBoxA
wsprintfA
PeekMessageA
gdi32
DeleteObject
RemoveFontResourceA
GetObjectA
CreateFontIndirectA
GetStockObject
advapi32
RegQueryValueExA
RegQueryValueA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
shell32
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
ole32
OleUninitialize
OleInitialize
comctl32
ord17
Sections
.text Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ordata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE