Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7ec4c04a8fcba03b45283a24c9c58faa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7ec4c04a8fcba03b45283a24c9c58faa.exe
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_7ec4c04a8fcba03b45283a24c9c58faa
-
Size
310KB
-
MD5
7ec4c04a8fcba03b45283a24c9c58faa
-
SHA1
58d762d52c15b5a6e46bb51310fa097f68335419
-
SHA256
49024be8079a227198f689a5c22b5d78081017aec38db86c3987a1145b2b43b6
-
SHA512
a4cd0dd28617ff8d943b68911a56c9d05928168fa223279ae6bfb90481dfc30de0e85283cfd63215202c87371ce5364ff2f75cd5fb99304df8aa889c1899eaf7
-
SSDEEP
6144:WhDGwTgVFhAUClRNYgzWC+UrxVw0o7tTMoUkKxFyNStNe672hK:Wh6w4umoWKGnTMoUkVctNsc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_7ec4c04a8fcba03b45283a24c9c58faa
Files
-
JaffaCakes118_7ec4c04a8fcba03b45283a24c9c58faa.exe windows:4 windows x86 arch:x86
17a3798c38d2df395bc52d8d379ecd88
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
oleaut32
VarUI4FromStr
GetErrorInfo
LoadRegTypeLi
SysStringByteLen
SysAllocString
VariantInit
LoadTypeLi
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantCopy
UnRegisterTypeLi
DispCallFunc
RegisterTypeLi
VariantClear
user32
OpenClipboard
EmptyClipboard
RegisterWindowMessageA
SetClipboardData
LoadImageA
TranslateAcceleratorA
LoadMenuA
TrackPopupMenu
IsZoomed
CallNextHookEx
EnableMenuItem
GetCursorPos
GetWindowThreadProcessId
SetMenuDefaultItem
PostMessageA
GetSubMenu
SetWindowRgn
DrawIconEx
LoadAcceleratorsA
CopyRect
SetFocus
GetParent
EnableWindow
GetWindowRect
SetForegroundWindow
ReleaseDC
RedrawWindow
InflateRect
GetSystemMetrics
SendMessageA
PostQuitMessage
RemoveMenu
SetWindowsHookExA
UpdateWindow
IsWindow
MapDialogRect
SetWindowPos
GetDC
GetClientRect
CloseClipboard
DrawTextA
DestroyIcon
CharNextA
GetForegroundWindow
AttachThreadInput
FindWindowA
GetDesktopWindow
UnhookWindowsHookEx
LoadIconA
IsRectEmpty
advapi32
CopySid
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetSidLengthRequired
RegDeleteValueA
RegNotifyChangeKeyValue
InitializeSid
MakeSelfRelativeSD
GetSecurityDescriptorControl
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
GetSecurityDescriptorGroup
OpenProcessToken
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
RegEnumKeyExA
RegQueryValueExA
GetSecurityDescriptorSacl
GetLengthSid
MakeAbsoluteSD
GetSidSubAuthority
EqualSid
IsValidSid
RegCreateKeyExA
GetTokenInformation
SetSecurityDescriptorDacl
RegDeleteKeyA
RegCloseKey
ole32
CLSIDFromProgID
CoTaskMemRealloc
CoRegisterClassObject
CoTaskMemAlloc
CoFreeUnusedLibraries
StringFromCLSID
CoUninitialize
CoInitializeSecurity
CoRevokeClassObject
CoCreateInstance
StringFromGUID2
OleRun
OleUninitialize
CoTaskMemFree
CoInitializeEx
CoInitialize
CLSIDFromString
gdi32
CreateRectRgnIndirect
CombineRgn
CreateRectRgn
GetTextExtentExPointA
GetObjectA
SetRectRgn
CreateFontIndirectA
shlwapi
PathFindExtensionA
kernel32
lstrcpyA
GetModuleHandleA
GetProcessHeap
HeapReAlloc
GetTimeFormatA
lstrcatA
lstrcmpiA
HeapAlloc
lstrlenA
FindClose
LocalFree
SetPriorityClass
FindNextFileA
OpenProcess
IsDBCSLeadByte
WaitForMultipleObjects
HeapSize
FindResourceExA
ResetEvent
lstrlenW
GetSystemTimeAsFileTime
LockResource
DeleteFileA
GetThreadLocale
lstrcmpA
DeleteCriticalSection
GetACP
FileTimeToSystemTime
CreateThread
GlobalAlloc
FindResourceA
FormatMessageA
RemoveDirectoryA
HeapDestroy
WaitForSingleObject
LoadLibraryExA
CloseHandle
SystemTimeToFileTime
WideCharToMultiByte
FreeLibrary
GetUserDefaultLangID
SizeofResource
LocalAlloc
lstrcpynA
LeaveCriticalSection
SetLastError
RaiseException
CreateMutexA
EnterCriticalSection
OpenEventA
ReleaseMutex
HeapFree
CreateEventA
GlobalUnlock
FindFirstFileA
SetProcessWorkingSetSize
GlobalLock
GetCurrentThreadId
GetDateFormatA
LoadResource
IsValidCodePage
VirtualAllocEx
shell32
ShellExecuteA
Shell_NotifyIconA
userenv
GetProfileType
UnloadUserProfile
GetDefaultUserProfileDirectoryW
GetProfilesDirectoryA
DestroyEnvironmentBlock
GetAppliedGPOListA
ddrawex
DllUnregisterServer
DllCanUnloadNow
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 263KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ