Behavioral task
behavioral1
Sample
4b015de0ef65691cbbb9aa44ff8a94ec_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4b015de0ef65691cbbb9aa44ff8a94ec_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4b015de0ef65691cbbb9aa44ff8a94ec_JaffaCakes118
-
Size
112KB
-
MD5
4b015de0ef65691cbbb9aa44ff8a94ec
-
SHA1
0fa4d07bdc38825563f8babbfde209f7467cab52
-
SHA256
de569505c8974784c3e7d9e25252c063cfcf770313e5a298d1bdda3098a878b3
-
SHA512
6397675aeda612df1b16350f8655b2b87e3f066bd3aee3fa2484d65b79c9b7acb0802dcb7d4914ab6aefd5964a9c204f293d13e17da6f5c87dbc69fee9a64036
-
SSDEEP
3072:Jho9kw/lelEOv79ukcOBuMMbGEOUJnzHSHh:Jhukw/clEOz9ukxMK6Jnw
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b015de0ef65691cbbb9aa44ff8a94ec_JaffaCakes118
Files
-
4b015de0ef65691cbbb9aa44ff8a94ec_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
�{�40 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�{�41 Size: 7KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE