Static task
static1
Behavioral task
behavioral1
Sample
ggscan.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ggscan.dll
Resource
win10v2004-20240709-en
General
-
Target
7844ee3eb665d9d0f355fcc27de34b83_JaffaCakes118
-
Size
781KB
-
MD5
7844ee3eb665d9d0f355fcc27de34b83
-
SHA1
6a8318600ae57bb18d056e90cfb67547badcaf08
-
SHA256
d7ce0db4c891d9f2ac8534745d8b41c2fd074c8b4652090a193582ca17073599
-
SHA512
7b7479b3b30cc8210b327a34c2e055e5404f503bdaacac620d3ef7b95035efc3d480da7f136109342ec6ba6c9469e2c6b57bf1d59175c2e06a8d00b654f5892b
-
SSDEEP
24576:Ms7oZ5FBz3syFy77w7roMVkmFcdQ0g4K/l:uZbY77WroMVk/Q0gl/l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ggscan.des
Files
-
7844ee3eb665d9d0f355fcc27de34b83_JaffaCakes118.zip
-
ggscan.des.dll windows:4 windows x86 arch:x86
19656e00c2a1139a4c3249b345286bc8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
ReadProcessMemory
GetProcAddress
GetModuleHandleA
CloseHandle
Module32Next
OpenProcess
Module32First
CreateToolhelp32Snapshot
HeapAlloc
GetProcessHeap
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
CreateFileA
InitializeCriticalSection
DeleteCriticalSection
GetLocalTime
VirtualProtect
VirtualProtectEx
WriteProcessMemory
VirtualQueryEx
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetCurrentProcessId
Sleep
lstrlenA
lstrcpyA
OpenFileMappingA
user32
wsprintfA
msvcrt
_snprintf
_adjust_fdiv
_mbsicmp
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
_mbsnbcmp
free
printf
vsprintf
__dllonexit
_onexit
_initterm
malloc
Sections
.text Size: 212KB - Virtual size: 209KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 733KB - Virtual size: 733KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE