Behavioral task
behavioral1
Sample
ff8f31ee33b3894ca71ccc2f73972598_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff8f31ee33b3894ca71ccc2f73972598_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
ff8f31ee33b3894ca71ccc2f73972598_JaffaCakes118
-
Size
114KB
-
MD5
ff8f31ee33b3894ca71ccc2f73972598
-
SHA1
5ae337b5b921df03c8185b45bcf3866681ea83bc
-
SHA256
4b6856746b5c2677559efa4b8a7f1766b4b29379d744dc57c48972ea2f1acbde
-
SHA512
9984c3642c607676429a0a5e05ba238732e4382d32de2b3a6ddff15ec6ef689fdd170db34feee81b96e5a3cad98a4ff23d77eb3a248288b8b0dcda8c7e766d6b
-
SSDEEP
3072:/X1to9fOBqoTUoMtacdqd6Tw3+A6DUp5Ju1kru1kK:v1t6fOY1aksuw3+A6IAX5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff8f31ee33b3894ca71ccc2f73972598_JaffaCakes118
Files
-
ff8f31ee33b3894ca71ccc2f73972598_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
���� Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
�e�� Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�d�� Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�_�� Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�b�� Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ