TestProject
Behavioral task
behavioral1
Sample
5b094985aa2f261bd8156d0a83fae5a9_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
5b094985aa2f261bd8156d0a83fae5a9_JaffaCakes118
-
Size
149KB
-
MD5
5b094985aa2f261bd8156d0a83fae5a9
-
SHA1
e7eb485e9179b1096a52b626777689b8fb17e852
-
SHA256
2560a3a9a14d34cb4714dcce11f72f95c785a03d878405ea81370dc8d4aec550
-
SHA512
5d91f0ea7d1d7a78d12c6a3ae07379cb2d1d019292eb499b102f5d7230547676b2ff0913561bbd4e36b491d411333fb37ce0c13164aea6a8a7cf98e45c05e60b
-
SSDEEP
3072:eM7q18GIHdszptVYST72snSIZ6CsavsTKWMNTBftj16VN/:eM7YtxUwID2WMNTBlj1W/
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b094985aa2f261bd8156d0a83fae5a9_JaffaCakes118
Files
-
5b094985aa2f261bd8156d0a83fae5a9_JaffaCakes118.dll windows:4 windows x86 arch:x86
bfb1f62f3b4399403b9f17bb12d30d6a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchange
lstrcatA
GetSystemDirectoryA
FreeLibrary
GetTickCount
lstrlenA
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
GetLastError
CreateFileMappingA
GetShortPathNameA
lstrcpyA
HeapAlloc
LocalFree
LocalAlloc
GetModuleFileNameA
SetUnhandledExceptionFilter
FormatMessageA
GetModuleHandleA
VirtualQuery
IsBadWritePtr
lstrcmpiA
GetProcAddress
LocalReAlloc
LocalSize
GetCurrentThreadId
GetTempFileNameA
MultiByteToWideChar
CloseHandle
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetVersionExA
ExpandEnvironmentStringsA
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
VirtualAlloc
GetCurrentProcessId
VirtualProtect
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
ExitProcess
GetExitCodeProcess
GetCurrentProcess
GlobalFree
GlobalAlloc
GetSystemInfo
GetProcessTimes
GlobalMemoryStatusEx
DeleteFileA
RemoveDirectoryA
ExitThread
IsBadReadPtr
IsBadStringPtrW
RaiseException
WideCharToMultiByte
Sleep
LoadLibraryA
user32
wvsprintfA
MessageBoxA
CloseWindowStation
DestroyWindow
CreateWindowExA
ShowWindow
GetCursorInfo
DestroyCursor
wsprintfA
LoadCursorA
advapi32
RegOpenKeyExW
msvcrt
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_strupr
_strlwr
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
wcsrchr
_except_handler3
strchr
strncat
strncpy
free
malloc
rand
srand
_ftol
strrchr
strstr
memmove
ceil
_CxxThrowException
_beginthreadex
wcslen
atoi
wcstombs
_wcsicmp
_memicmp
Exports
Exports
Sections
.text Size: 96KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ