WINMAIN
Static task
static1
Behavioral task
behavioral1
Sample
rcoasterty/rcttrn.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
rcoasterty/rcttrn.exe
Resource
win10v2004-20240802-en
General
-
Target
ee7aed3855b48294218dfa3bfb65afb0_JaffaCakes118
-
Size
5KB
-
MD5
ee7aed3855b48294218dfa3bfb65afb0
-
SHA1
6dfbd58791916c97852bb928113ddd3635422624
-
SHA256
d55ac503440265c9f5a8bb1411a2c0308393354ba25202add640830f166de4e5
-
SHA512
98fecfee77a9318deec439df1f6c7438737a42fb9e3d50c7c249174b2206c7ba490c27bc24826c40ed16949b482a1272333ac33d0014fda08f4437d49966b296
-
SSDEEP
96:ncX5ORLI5YcG2ibTtjDDAY6vdfQ1ZUt20ub9G9D29vPohAByjdR0I13A5CtIcT0C:nM5OFI5YcGhbTZDAY61fQTUt2J42BnIT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/rcoasterty/rcttrn.EXE
Files
-
ee7aed3855b48294218dfa3bfb65afb0_JaffaCakes118.rar
-
rcoasterty/CheatNoW Info.txt
-
rcoasterty/origin.nfo
-
rcoasterty/rcttrn.EXE.exe windows:1 windows x86 arch:x86
7abc8056535fffab92494e205bf5e8bf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
CloseHandle
ReadProcessMemory
WriteProcessMemory
OpenProcess
ExitProcess
GetModuleHandleA
gdi32
CreateFontA
user32
GetAsyncKeyState
TranslateMessage
EndPaint
UpdateWindow
FindWindowA
DispatchMessageA
GetMessageA
PostQuitMessage
DefWindowProcA
MessageBoxA
LoadCursorA
CreateWindowExA
RegisterClassA
SendMessageA
SetTimer
GetWindowThreadProcessId
GetSystemMetrics
BeginPaint
Exports
Exports
Sections
CODE Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ