Behavioral task
behavioral1
Sample
dd3a11dea73e58f9083e2f5248d5c49b_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dd3a11dea73e58f9083e2f5248d5c49b_JaffaCakes118
-
Size
252KB
-
MD5
dd3a11dea73e58f9083e2f5248d5c49b
-
SHA1
8bdbf441fa93a78f99f4aebfe2d47add8f0dd661
-
SHA256
3a33dbdfb5f42767b4055cf63ed8f99a7b82a7084ba6c1c459a9765acb2418c4
-
SHA512
10385299e4199817568e2ae42021d2e61bf897e5e2dae430fec386dd54e005c9c98e9d1ffbb58986899b4137d8ec4824ebf747d741d4f22730da1daba38338d2
-
SSDEEP
3072:3yttoAYxts03lgwBWHWVKhqvEzO/V1VrNYQkCA+HFSWvF3TBftOnob26:iQ3hWHA9DNYtEHhvF3TBlOnobR
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd3a11dea73e58f9083e2f5248d5c49b_JaffaCakes118
Files
-
dd3a11dea73e58f9083e2f5248d5c49b_JaffaCakes118.exe windows:4 windows x86 arch:x86
edada803b25662af6e5310b95af49338
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
lstrcatA
lstrcpyA
GetModuleFileNameA
DeleteFileA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
ReadFile
GetFileSize
MoveFileA
WritePrivateProfileStringA
lstrlenA
SetFilePointer
Sleep
CloseHandle
WriteFile
CreateFileA
LoadResource
SizeofResource
FindResourceA
GetLocalTime
WinExec
GetCurrentThreadId
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
GetLastError
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
FlushFileBuffers
user32
wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
ole32
CoCreateGuid
CoInitialize
CoUninitialize
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ