FreeTest
Behavioral task
behavioral1
Sample
44030546330dc42fc24e9fa280dc8181_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
44030546330dc42fc24e9fa280dc8181_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
44030546330dc42fc24e9fa280dc8181_JaffaCakes118
-
Size
148KB
-
MD5
44030546330dc42fc24e9fa280dc8181
-
SHA1
9a69c4c83cf99d3c730699f3084f07db477e1289
-
SHA256
584dec0ea9beef340485711a243dc7d22ea1425f7686110bf10df2ad160120aa
-
SHA512
64997879cdee51427a24ebe03cc910b007e4fea1db5bb66e85fb3979ce5eb8fdf36c4f72fe3f4192d2e900fe302e934184986d236465803b34f920f1d9e199f1
-
SSDEEP
3072:vG9vTj4kEWg/5y14z70Z2WRDiPdPTBft82IG+tsI4ns:vgv3KH/g117hiPdPTBl82IG+tsq
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44030546330dc42fc24e9fa280dc8181_JaffaCakes118
Files
-
44030546330dc42fc24e9fa280dc8181_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
.text Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ