Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_66501f3c871076cf802c85e13145c307.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
JaffaCakes118_66501f3c871076cf802c85e13145c307.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_66501f3c871076cf802c85e13145c307
-
Size
188KB
-
MD5
66501f3c871076cf802c85e13145c307
-
SHA1
8a323dcd679574588955ad31f43b0079a5ecbb12
-
SHA256
59fddf05d1e9af0fc003a2b590d1a1fb264f3517845563079b4a186c8a31d7fe
-
SHA512
ae1be079dcd14b36e71b48cd8b55dd6013a42917ffd40c26c4ca4a042a0bcbeac13997af8f0021f8fc0343585bb943a9749352a9cb901c0e93012ff765baa2ba
-
SSDEEP
3072:/penW5zuZEg/KusKTfrYqlaX+h9WmkmB54Vhk3:/penW5P6K8Yq7h9Wmkmz6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_66501f3c871076cf802c85e13145c307
Files
-
JaffaCakes118_66501f3c871076cf802c85e13145c307.exe windows:4 windows x86 arch:x86
499f8fccd8e060e207e5982e2c11b674
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
CloseHandle
GetCurrentProcess
GetLastError
CreateDirectoryA
GetFileAttributesA
lstrlenA
DeleteFileA
SetFileAttributesA
GetCurrentProcessId
GetSystemDirectoryA
GetCurrentThread
Sleep
GetProcAddress
GetModuleHandleA
ExitProcess
GetCurrentDirectoryA
GetTempPathA
MoveFileA
SetFileTime
GetFileTime
WriteFile
CreateFileA
SleepEx
LoadLibraryA
GetModuleFileNameA
WaitForSingleObject
CreateEventA
GetShortPathNameA
ExpandEnvironmentStringsA
OpenEventA
SetUnhandledExceptionFilter
GetCommandLineA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
msvcrt
_except_handler3
strcat
strchr
strcpy
memset
srand
strcmp
strncpy
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
_strlwr
_strrev
_ftol
rand
__CxxFrameHandler
??2@YAPAXI@Z
memcpy
strlen
_stricmp
ws2_32
closesocket
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ