Behavioral task
behavioral1
Sample
af8a2673ad1fa95dee312637d448fa8a_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
af8a2673ad1fa95dee312637d448fa8a_JaffaCakes118
-
Size
244KB
-
MD5
af8a2673ad1fa95dee312637d448fa8a
-
SHA1
f8e14d6baa0a40c1ad9bb9e55d7ee0dcf05f3e7a
-
SHA256
c6b1dcc045d0167e5d02f6ec0a7e35582549f13f89b2eb4637f341caa1a3365a
-
SHA512
f389b1668d053bc1a2df5d3acc072c0a8df24ae51608a1a02d98236e2391c5c816e9c88d33aa8cd9b088bbf5304d07ed48a10ea1dd7c3e65278184e43fabde03
-
SSDEEP
3072:whicY1twwBWHWVKhqvEzO/V1VrNYQkCA+HFSWvF3TBftDnob2bzoI7h+aS1Gw:w2/WHA9DNYtEHhvF3TBlDnobezo0naGw
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af8a2673ad1fa95dee312637d448fa8a_JaffaCakes118
Files
-
af8a2673ad1fa95dee312637d448fa8a_JaffaCakes118.exe windows:4 windows x86 arch:x86
565e74f340d090ada1b0a42359adfa40
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LockResource
LoadResource
FindResourceA
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
Sleep
WriteFile
SizeofResource
lstrlenA
ExitProcess
WinExec
GetModuleHandleA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryA
GetFileSize
GetWindowsDirectoryA
OpenProcess
GetCurrentProcessId
GetSystemDefaultLCID
GetVersionExA
GetCurrentDirectoryA
MoveFileExA
CreateThread
GetLastError
CreateEventA
GetTempPathA
CopyFileA
GetCurrentThreadId
GetFileAttributesA
HeapReAlloc
HeapAlloc
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
HeapDestroy
HeapCreate
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
FlushFileBuffers
LCMapStringA
LCMapStringW
SetStdHandle
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
CreateDirectoryA
Sections
.text Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 192KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ