Behavioral task
behavioral1
Sample
2ef5fce3d917379b0db53a0bf390bf9e_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
2ef5fce3d917379b0db53a0bf390bf9e_JaffaCakes118
-
Size
4.5MB
-
MD5
2ef5fce3d917379b0db53a0bf390bf9e
-
SHA1
824035539b7b9c7488efb62be6ffcb1a18e94895
-
SHA256
77c524ede147fffe5b35e90e0be9dd489998c8e7d4a7abb252737de905e906f4
-
SHA512
9dc2df146c45a7039a20b6c09217971c4c8926f1c58f9458377d75172837fe7f5ae3a463106673663624c632fb1cbde4af6de1b4e4f7e41e30d2e96366b88107
-
SSDEEP
98304:t/uatZmDhlWHBKYQo0y5J55WRwmJ7eccE7ZNIFLuYwhuNH52YZhjEHk:qqB15ZcR9q1cHOLuBul8YZd
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ef5fce3d917379b0db53a0bf390bf9e_JaffaCakes118
Files
-
2ef5fce3d917379b0db53a0bf390bf9e_JaffaCakes118.exe windows:4 windows x86 arch:x86
b14ad6dfcc6e808919a618d1e14dc1b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReleaseSemaphore
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DeleteMenu
gdi32
GetWindowExtEx
winmm
midiStreamOut
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleIsCurrentClipboard
oleaut32
SafeArrayGetUBound
comctl32
ord17
oledlg
ord8
ws2_32
inet_ntoa
comdlg32
GetFileTitleA
Sections
.text Size: 488KB - Virtual size: 488KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 573KB - Virtual size: 573KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE