Behavioral task
behavioral1
Sample
75bbd788f85b5b6a12ddf727b88660f6_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
75bbd788f85b5b6a12ddf727b88660f6_JaffaCakes118
-
Size
119KB
-
MD5
75bbd788f85b5b6a12ddf727b88660f6
-
SHA1
cedc8af1e3e12c11b4816ccbb71cd38efc03b442
-
SHA256
70a4df4f5cd3457f9a3adb4f4bf68c2630f3c8a9c8cc956500f91cd79cf5eb8b
-
SHA512
46abfce2c5be836a72427c16e3e5d50a453b51b1aff8f8d435127ca407cc4ab753c0e5783c382569fe88a51fb67526f3be385c660028a65632f2be53fe129abf
-
SSDEEP
1536:VxLB/mTgWM6SibNn8YIaTI24cKau2f9d0sZi+NkXA+mHCpJh7s:ldW9Si+YIJ24Wug9d0t+aXA+mHCpJhQ
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75bbd788f85b5b6a12ddf727b88660f6_JaffaCakes118
Files
-
75bbd788f85b5b6a12ddf727b88660f6_JaffaCakes118.exe windows:4 windows x86 arch:x86
7142c01c430db2b477ea02e8d8d1f541
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_initterm
_except_handler3
_controlfp
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
_mbsstr
__set_app_type
__CxxFrameHandler
kernel32
GetModuleHandleW
lstrlenA
lstrcatA
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetStartupInfoW
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 208B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 944B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 528B - Virtual size: 516B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 672B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ