CpyCommon
Behavioral task
behavioral1
Sample
8aab98451b8ade7b8a983f1c3d3d93ed_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
8aab98451b8ade7b8a983f1c3d3d93ed_JaffaCakes118
-
Size
153KB
-
MD5
8aab98451b8ade7b8a983f1c3d3d93ed
-
SHA1
ef86d3191ce043a51b4e68f8934cdfca05a49640
-
SHA256
1124c064918dcac5d7921a95b633f791b9db6010c13e035d66e49fca54807763
-
SHA512
f5c4fc6fe6134b5b13329366b3ab2d5bf66784b876e3173f67c9ca37ea224ffa47ac080b3717c65a44f305878a5d320dba7f79a967e44db05b160068e7f436ab
-
SSDEEP
3072:e3gvQIZzXYrj07QMctceym11J7pU/TBft0svwnsmwEc:e3uJXicQltJ3J7pU/TBl0UL
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8aab98451b8ade7b8a983f1c3d3d93ed_JaffaCakes118
Files
-
8aab98451b8ade7b8a983f1c3d3d93ed_JaffaCakes118.dll windows:4 windows x86 arch:x86
7a06a13cc122456365f74b1911c7d436
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
GetWindow
ShowWindow
GetWindowRect
CreateWindowExA
DestroyWindow
wvsprintfA
CloseWindowStation
MessageBoxA
LoadCursorA
DestroyCursor
GetCursorInfo
GetClassNameA
wsprintfA
kernel32
RaiseException
GlobalSize
GetShortPathNameA
CreateFileMappingA
MapViewOfFile
InterlockedIncrement
InterlockedDecrement
IsBadStringPtrW
IsBadReadPtr
ExitThread
ExpandEnvironmentStringsA
GetLastError
lstrcpyA
lstrlenA
CloseHandle
lstrcatA
LocalFree
LocalReAlloc
LocalAlloc
VirtualQuery
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
GetCurrentThreadId
lstrcmpA
lstrcmpiA
Sleep
GetTickCount
VirtualProtect
GetSystemDirectoryA
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetModuleFileNameA
WideCharToMultiByte
GetVersionExA
InterlockedExchange
FreeLibrary
LocalSize
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
VirtualAlloc
SetUnhandledExceptionFilter
GetLocalTime
FormatMessageA
IsBadWritePtr
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
ExitProcess
GetExitCodeProcess
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryA
HeapFree
HeapAlloc
GetProcessHeap
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
GetTempFileNameA
DeleteFileA
RemoveDirectoryA
advapi32
RegOpenKeyExW
msvcrt
wcslen
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_memicmp
_wcsicmp
_strlwr
_strupr
_CxxThrowException
__CxxFrameHandler
??3@YAXPAX@Z
free
malloc
_except_handler3
strstr
strrchr
realloc
srand
rand
_ftol
??2@YAPAXI@Z
wcstombs
_beginthreadex
strchr
strncat
wcsrchr
memmove
ceil
strncpy
atoi
Exports
Exports
Sections
.text Size: 100KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ