Behavioral task
behavioral1
Sample
0d242296532709637b4f21675fb13579_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
0d242296532709637b4f21675fb13579_JaffaCakes118
-
Size
105KB
-
MD5
0d242296532709637b4f21675fb13579
-
SHA1
63e28096b00a94e7bffafb5e1e5db7e84c68b53c
-
SHA256
ba7a16cbdc7cc841b1a8062986520e5303d8e168d81c56275f727d6dff5e5d98
-
SHA512
677b5e5d002d328db64c146cac6d4bf079e04c55cedb798773d1661cc9a075e8de5f7f233c801f3a60bb4d41f01f5b25ac65595d935f820f301a4d797bbf82b8
-
SSDEEP
1536:+SPBXGh65+LtcDftrOAlQaedcRo/aRfTHZTfQY0orSwuYHiLclvq:+SPJa6ULtOtrOUe/irWi+wuYHiLclvq
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d242296532709637b4f21675fb13579_JaffaCakes118
Files
-
0d242296532709637b4f21675fb13579_JaffaCakes118.exe windows:4 windows x86 arch:x86
40bbb16b3dca827f1476c8f2ed912eba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
WaitForSingleObject
WideCharToMultiByte
ResetEvent
GetProcAddress
LoadLibraryW
SetEvent
InterlockedExchange
CancelIo
Sleep
DeleteFileW
GetLastError
CreateDirectoryW
GetFileAttributesW
lstrcpyW
lstrlenW
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetLogicalDriveStringsW
FindClose
LocalFree
FindNextFileW
LocalReAlloc
FindFirstFileW
LocalAlloc
RemoveDirectoryW
GetFileSize
CreateFileW
CreateEventW
SetFilePointer
WriteFile
MoveFileW
MoveFileExW
lstrcatW
GetLongPathNameA
GetTempPathA
GetLongPathNameW
GetTempPathW
GetModuleFileNameW
TerminateThread
GetCurrentThreadId
GetComputerNameW
GlobalMemoryStatus
GetVersionExW
ReleaseMutex
CreateMutexW
SetErrorMode
GetTickCount
OpenEventW
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
ReadFile
InitializeCriticalSection
SetEndOfFile
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
CreateFileA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
InterlockedIncrement
InterlockedDecrement
GetStartupInfoA
RtlUnwind
RaiseException
HeapFree
HeapAlloc
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
ExitProcess
GetModuleHandleA
TlsAlloc
SetLastError
SetUnhandledExceptionFilter
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
user32
OpenDesktopW
GetThreadDesktop
OpenInputDesktop
CloseDesktop
wsprintfW
GetUserObjectInformationW
SetThreadDesktop
CharNextW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyW
shell32
SHGetSpecialFolderPathW
SHGetFileInfoW
ShellExecuteW
ws2_32
WSAIoctl
setsockopt
connect
htons
gethostbyname
socket
select
recv
closesocket
send
getsockname
WSAStartup
WSACleanup
mpr
WNetGetUserW
Sections
.text Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.scode Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE