CpyCommon
Behavioral task
behavioral1
Sample
aafe67a3f338da64441b7fec9c707487_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
aafe67a3f338da64441b7fec9c707487_JaffaCakes118
-
Size
153KB
-
MD5
aafe67a3f338da64441b7fec9c707487
-
SHA1
a0c234309ea7dd2fe6df0b9139182dd6a0cbe6bf
-
SHA256
85c3eab97478c4530928fe03b18e956b75c435521674a6aee9040b7c884a9c45
-
SHA512
7fb6dd700bb467eb5367ff9ed3c39d151ee94e89662cb214a37531f5b765b23865ee7e684d3536034a61d2ff4866c96272d74d6d58941f218b6923491c86e5b2
-
SSDEEP
3072:Xe6a0XhVQYCe3DEeprpSQ+xXp9COZrTBft5QaiqvlhuPA:gKh+YC0RporXp9CIrTBlKXDA
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aafe67a3f338da64441b7fec9c707487_JaffaCakes118
Files
-
aafe67a3f338da64441b7fec9c707487_JaffaCakes118.dll windows:4 windows x86 arch:x86
bf776978431b323a7e5057a3f0892270
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LeaveCriticalSection
VirtualAlloc
GetTickCount
CloseHandle
ExitProcess
lstrcatA
lstrlenA
lstrcpyA
GetSystemDirectoryA
Sleep
GetExitCodeProcess
LocalFree
LocalSize
LocalAlloc
LocalReAlloc
GetLastError
GetCurrentProcess
InterlockedExchange
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
lstrcmpiA
GetTempFileNameA
GetLocalTime
HeapFree
GetProcessHeap
VirtualFree
CreateFileMappingA
GetShortPathNameA
HeapAlloc
MultiByteToWideChar
FreeLibrary
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetVersionExA
ExpandEnvironmentStringsA
GetSystemInfo
GetProcessTimes
GlobalMemoryStatusEx
DeleteFileA
RemoveDirectoryA
ExitThread
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
FormatMessageA
VirtualQuery
IsBadWritePtr
GetCurrentProcessId
VirtualProtect
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
MapViewOfFile
InitializeCriticalSection
RaiseException
LoadLibraryA
advapi32
RegOpenKeyExW
user32
GetWindowRect
ShowWindow
GetWindow
GetClassNameA
DestroyWindow
CreateWindowExA
GetCursorInfo
DestroyCursor
LoadCursorA
wvsprintfA
CloseWindowStation
wsprintfA
MessageBoxA
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_memicmp
_strlwr
_wcsicmp
_strupr
_beginthreadex
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
??2@YAPAXI@Z
_except_handler3
strrchr
malloc
free
strncpy
atoi
strchr
rand
srand
wcstombs
_CxxThrowException
strncat
wcsrchr
wcslen
realloc
Exports
Exports
Sections
.text Size: 100KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ