Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
JaffaCakes118_3207307f414c1fd67779f7dafa3df123.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_3207307f414c1fd67779f7dafa3df123
-
Size
127KB
-
MD5
3207307f414c1fd67779f7dafa3df123
-
SHA1
9cccfacdc13c63c80e35afc5f16d89f961d70924
-
SHA256
4fa211e5dc283525e8d7a5ce4270757e1b97c5082907e3fde6bfa5a953ce61f1
-
SHA512
941e9accca0201566e84c771e0f5e5ccf1a82dd696c159f19521b9ffa38b658203413e3b122358a8583d4fbef56afb32aadf11428eb4aa6b3d6b6539f80438de
-
SSDEEP
3072:aHzA8MjvlR6+N0lBuqC4CO2W11aicazjdjLyXfQ3GRyzj5vi:aHcQq0DFAOFvafazjd6Xo3b5q
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_3207307f414c1fd67779f7dafa3df123
Files
-
JaffaCakes118_3207307f414c1fd67779f7dafa3df123.exe windows:4 windows x86 arch:x86
f42c806896b6b736c04a736f08defc48
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ