Behavioral task
behavioral1
Sample
15aa29f9c9d734861f080553ab094776_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
15aa29f9c9d734861f080553ab094776_JaffaCakes118
-
Size
189KB
-
MD5
15aa29f9c9d734861f080553ab094776
-
SHA1
999a346c91941ab07b9ee785270fbe3cf555426b
-
SHA256
3bf8a294b5d2becd9084f9efc950d3fe6f53380b5d824bc89b7b98991d836876
-
SHA512
a837febe28f4eeb0ed7dd82b4fd97ae56d6f9bab59c69f421ceef2a506cd9389535318ed364b5e8be1b328c7182b79412f9951aa5f9b0baf98ab461a160824f6
-
SSDEEP
3072:Z7XcYy5nWs5QHfBPSfxyOmPD8IW4+Pqbs0YPx5zcTBfthHr5QnFPnZHeXdd:BsYy5nW8QHfBGyPWbyFYPbzcTBlhHrOW
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15aa29f9c9d734861f080553ab094776_JaffaCakes118
Files
-
15aa29f9c9d734861f080553ab094776_JaffaCakes118.exe windows:0 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
CODE Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 163KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata2 Size: 102B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
NewSec Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE