Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7a5af43c9a5277ac6d5a001e29e4353c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7a5af43c9a5277ac6d5a001e29e4353c.exe
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_7a5af43c9a5277ac6d5a001e29e4353c
-
Size
268KB
-
MD5
7a5af43c9a5277ac6d5a001e29e4353c
-
SHA1
8648ec72be4123e199743060dfadcde690b06f95
-
SHA256
3b9c65c33b518cbbc34c593cd4be718874b688338f4e3deac162450bf1100842
-
SHA512
18d9f2326f0b0a397fd1f428cd40bd7b26eb2c42bfdc886395d8f7e7c3c7514ec7ead1a94836a7bf32584811dcca5691e473ea13fdaaec9911891267082ee9d1
-
SSDEEP
6144:bRkn+alqMqDoV0L29KQWFte1RfUuSDe+ArH:bRg+allJ0LcKNyR3SM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_7a5af43c9a5277ac6d5a001e29e4353c
Files
-
JaffaCakes118_7a5af43c9a5277ac6d5a001e29e4353c.exe windows:4 windows x86 arch:x86
6557903e39eb0fff6caac64e75d141e1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCrackUrlA
InternetCanonicalizeUrlA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
iphlpapi
GetAdaptersInfo
kernel32
GetACP
GetThreadLocale
RaiseException
CompareFileTime
WaitForSingleObject
GetModuleHandleA
lstrlenW
lstrlenA
FreeLibrary
MoveFileA
GetWindowsDirectoryA
CreateEventA
CopyFileExA
GetSystemDirectoryA
CreateDirectoryA
GetThreadPriority
GetCurrentThreadId
GetLocalTime
GetCurrentDirectoryA
CreateMutexA
lstrcpynA
GetShortPathNameA
lstrcmpiA
LocalFree
CopyFileA
FileTimeToSystemTime
RemoveDirectoryA
SystemTimeToFileTime
IsValidCodePage
IsBadCodePtr
IsValidLocale
GetUserDefaultLCID
SetUnhandledExceptionFilter
TlsAlloc
GetOEMCP
GetSystemInfo
GetProcAddress
user32
CharPrevA
PostMessageA
MessageBoxA
CharUpperA
GetSystemMetrics
advapi32
IsTextUnicode
ImpersonateLoggedOnUser
RevertToSelf
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
DuplicateTokenEx
SetTokenInformation
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ole32
CoUninitialize
CoInitialize
CoInitializeEx
CoCreateInstance
oleaut32
SysFreeString
VariantClear
SysAllocStringByteLen
SysAllocString
shlwapi
PathFileExistsA
PathRemoveFileSpecA
cryptui
CryptUIDlgSelectCA
CryptUIDlgViewContext
CryptUIWizQueryCertRequestNoDS
CryptUIDlgViewCertificateW
CryptUIGetViewSignaturesPagesW
CryptUIDlgSelectCertificateW
msident
DllCanUnloadNow
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Y Size: 4KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MoKn Size: 2KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fFqpwT Size: 512B - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SD Size: 3KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.LdU Size: 116KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.FUMIG Size: 1024B - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.a Size: 2KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.f Size: 1024B - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ANRgVD Size: 97KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bi Size: 3KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ