Antivirus
Behavioral task
behavioral1
Sample
3bcddff1e5291cfdf475e686bdb816e1_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3bcddff1e5291cfdf475e686bdb816e1_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3bcddff1e5291cfdf475e686bdb816e1_JaffaCakes118
-
Size
148KB
-
MD5
3bcddff1e5291cfdf475e686bdb816e1
-
SHA1
88f1b4170f15aff1b1ccc48b2729ed12b2f3b4a9
-
SHA256
092b48d447be85fb30bd82e9c937d403c51dde2d01c974630791cc64b638e38a
-
SHA512
eaef85ca00efe571f9c93b14ccd47b4f02a50d0881a68cf9d014289686820ac1e47532917ae9ab52c1d3cdc59ab66dd305e91b1568de591939c806b12049cacd
-
SSDEEP
3072:Myf+rm7a44gP/Tz3mcwNvSZ4xPy+HTBftefoHtPQH:Dma7PB/vQ62xPy+HTBlefoHtPm
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bcddff1e5291cfdf475e686bdb816e1_JaffaCakes118
Files
-
3bcddff1e5291cfdf475e686bdb816e1_JaffaCakes118.dll windows:4 windows x86 arch:x86
47d7bca174901630c5b635df593b97c6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
lstrcmpiA
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
VirtualAlloc
GetTickCount
GetLastError
InterlockedExchange
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
FreeLibrary
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetVersionExA
ExpandEnvironmentStringsA
lstrcatA
Thread32Next
VirtualQuery
OpenThread
Thread32First
GetCurrentProcessId
GetCurrentThreadId
GetSystemDirectoryA
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetModuleFileNameA
GetCurrentProcess
LocalFree
lstrlenA
LocalAlloc
GetTempFileNameA
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
LocalSize
GlobalFree
GlobalAlloc
InterlockedDecrement
InterlockedIncrement
ExitProcess
GetExitCodeProcess
GetProcessTimes
GlobalMemoryStatusEx
GetSystemInfo
DeleteFileA
RemoveDirectoryA
ExitThread
DisableThreadLibraryCalls
FreeLibraryAndExitThread
IsBadReadPtr
IsBadStringPtrW
RaiseException
ResumeThread
SuspendThread
Sleep
LocalReAlloc
LoadLibraryA
CloseHandle
user32
BlockInput
wsprintfA
ShowWindow
FindWindowA
MessageBoxA
wvsprintfA
LoadCursorA
DestroyWindow
CreateWindowExA
CloseWindowStation
GetCursorInfo
DestroyCursor
gdi32
StretchDIBits
SetStretchBltMode
advapi32
RegOpenKeyExW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
oleaut32
SysFreeString
ws2_32
inet_addr
__WSAFDIsSet
ioctlsocket
accept
bind
listen
getsockname
send
shutdown
closesocket
select
recv
gethostname
gethostbyname
socket
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
msvcrt
_strlwr
toupper
_except_handler3
_CxxThrowException
strncpy
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
_adjust_fdiv
_initterm
_onexit
rand
srand
__dllonexit
??1type_info@@UAE@XZ
_wcsicmp
_memicmp
_strupr
_itoa
tolower
wcslen
_beginthreadex
wcstombs
atoi
strncat
strchr
strrchr
malloc
free
Exports
Exports
Sections
.text Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ