Behavioral task
behavioral1
Sample
f7007ed04101f556ae2cb2523c593283_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f7007ed04101f556ae2cb2523c593283_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f7007ed04101f556ae2cb2523c593283_JaffaCakes118
-
Size
955KB
-
MD5
f7007ed04101f556ae2cb2523c593283
-
SHA1
ac0d3f209e3f2e1835c91da73009e9171f4d3b30
-
SHA256
bd341387409ffa332cf1a212b410688165f589a95ad2a906ab00efd247151bb2
-
SHA512
35ce604efd372786dbda60772a1f7429733fcbf215d8956be7823349a688d5f6dfa8b72287b6c16ad02b32cc80d6070f97e978034f22202195e7c49af29d9090
-
SSDEEP
12288:SzQr+1kZVQQxfnr+TK7r79/JDXWE18qRzfG4M5kCZ:uQKQVQQxfnr+TK7r79/JD71PRi4M5kCZ
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7007ed04101f556ae2cb2523c593283_JaffaCakes118
Files
-
f7007ed04101f556ae2cb2523c593283_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 796KB - Virtual size: 796KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 155KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE