DynamicMain
Behavioral task
behavioral1
Sample
225e5810f85188f80723ee9a1bf313d4_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
225e5810f85188f80723ee9a1bf313d4_JaffaCakes118
-
Size
153KB
-
MD5
225e5810f85188f80723ee9a1bf313d4
-
SHA1
33cfd265bd451535d8f6137f6d24f9443763a34b
-
SHA256
b2d1de10988c711852e0c407e6c0b6d688134fd01d67e82ef8b07a9a7bfd1c2d
-
SHA512
685cd6529050a607ff4f5af947e1cb6abd2b16b789884ca0ca92c30b853065ff01e7de13436d4c7053d9cd76074d2f298a58b96c2d38c27fd5d267e1af71b34f
-
SSDEEP
3072:s0HuuXy0uqRa+dtS7af6krGCHqPTBft2+onR2okbpG:BhX3fS7aSaHqPTBl2+MKI
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 225e5810f85188f80723ee9a1bf313d4_JaffaCakes118
Files
-
225e5810f85188f80723ee9a1bf313d4_JaffaCakes118.dll windows:4 windows x86 arch:x86
412c57219b0d060446764b84a5b19bb5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
RegOpenKeyExW
kernel32
CloseHandle
lstrcpyA
lstrlenA
WideCharToMultiByte
GetLastError
Sleep
InterlockedExchange
lstrcatA
GetSystemDirectoryA
FreeLibrary
ExpandEnvironmentStringsA
LocalFree
LocalReAlloc
LocalAlloc
GetTempFileNameA
InitializeCriticalSection
GetTickCount
LeaveCriticalSection
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
GetShortPathNameA
HeapAlloc
GetProcAddress
GetModuleHandleA
lstrcmpiA
LocalSize
VirtualQuery
GetCurrentProcessId
GetCurrentThreadId
lstrcmpA
VirtualProtect
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetModuleFileNameA
VirtualFree
VirtualAlloc
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetVersionExA
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
GlobalFree
GlobalAlloc
DeleteFileA
RemoveDirectoryA
ExitThread
IsBadReadPtr
IsBadStringPtrW
ExitProcess
GetExitCodeProcess
RaiseException
LoadLibraryA
ole32
CoInitialize
CoTaskMemFree
CoUninitialize
CoCreateInstance
user32
CloseWindowStation
wvsprintfA
GetCursorInfo
DestroyCursor
LoadCursorA
GetWindowRect
ShowWindow
GetWindow
GetClassNameA
MessageBoxA
wsprintfA
DestroyWindow
CreateWindowExA
oleaut32
SysFreeString
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_strlwr
_memicmp
_strupr
_wcsicmp
_beginthreadex
wcstombs
atoi
strncat
ceil
memmove
realloc
strchr
??2@YAPAXI@Z
??3@YAXPAX@Z
wcslen
__CxxFrameHandler
wcsrchr
free
malloc
_except_handler3
strstr
strrchr
strncpy
_CxxThrowException
_ftol
rand
srand
Exports
Exports
Sections
.text Size: 100KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ