FreeTest
Behavioral task
behavioral1
Sample
421d8cd9ba0b2010535af3f686cd865f_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
421d8cd9ba0b2010535af3f686cd865f_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
421d8cd9ba0b2010535af3f686cd865f_JaffaCakes118
-
Size
148KB
-
MD5
421d8cd9ba0b2010535af3f686cd865f
-
SHA1
eb97ca5735675a769597814fd618c80c2c37b9b9
-
SHA256
0e5b7b92b085e1c92be2e513b367206b3756ddda0dee0474c2912e92bac1f895
-
SHA512
e20fe60ac4dd400f5f5e230eca1f23615c70160ef5d0ccc215172c316aada620e9bee56c007fc65f012d9fbb0b13902bf4901544c9f267c3e2763c6de3376c5c
-
SSDEEP
3072:OG9vTj4kEWg/5y14z9PZ2WRDiPLPTBft82IW+tDl:Ogv3KH/g167hiPLPTBl82IW+tD
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 421d8cd9ba0b2010535af3f686cd865f_JaffaCakes118
Files
-
421d8cd9ba0b2010535af3f686cd865f_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
ssss Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
uuuu Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pppp Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
eeee Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
rrrr Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ