Behavioral task
behavioral1
Sample
950fb759e9a44723301e7869ea236401_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
950fb759e9a44723301e7869ea236401_JaffaCakes118
-
Size
441KB
-
MD5
950fb759e9a44723301e7869ea236401
-
SHA1
c6e721e79c91e3b8e908aa5d5b309dce5a63addf
-
SHA256
c6ef9cdf893ba014951c14095246408100d71bf6005b5c9a7d9a41f6f21cf291
-
SHA512
e2e31574faea62a99a74431415b53305760223a640827e803c29dbd1904e8add64a94474aac87f4e923346b71d207c6e9d2de8f28ec232a15a9732f24f84d693
-
SSDEEP
6144:i6MLPQygIQEo4LJe69rCTlOSGDi2bhI2y:tW9gIRLJeMrOGDiuK
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 950fb759e9a44723301e7869ea236401_JaffaCakes118
Files
-
950fb759e9a44723301e7869ea236401_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.nsp0 Size: - Virtual size: 440KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 408KB - Virtual size: 407KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.anti Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.anti Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE