Static task
static1
Behavioral task
behavioral1
Sample
ggscan.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ggscan.dll
Resource
win10v2004-20240802-en
General
-
Target
0a4fcd46bca09f58fbd337cf4bfe452e_JaffaCakes118
-
Size
781KB
-
MD5
0a4fcd46bca09f58fbd337cf4bfe452e
-
SHA1
ce1b9d3903502ebe934514ecb923a95cbf293303
-
SHA256
7a873dde1349438d1c2f8863bf5d7a88eca007233b2c333a179992e62696f547
-
SHA512
11778c711826d32b4ca4a9e10ac2f5f726ee2452c2bca1d7482a5c94267f6db5f6ce500fc6d67017652c7a1645b3e882f52b96d9516f3aa90be585b69f2dfea9
-
SSDEEP
24576:cs7oZ5FBz3syFy77w7roMVkmFcdQ0g4K/l:+ZbY77WroMVk/Q0gl/l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ggscan.des
Files
-
0a4fcd46bca09f58fbd337cf4bfe452e_JaffaCakes118.zip
-
ggscan.des.dll windows:4 windows x86 arch:x86
19656e00c2a1139a4c3249b345286bc8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
ReadProcessMemory
GetProcAddress
GetModuleHandleA
CloseHandle
Module32Next
OpenProcess
Module32First
CreateToolhelp32Snapshot
HeapAlloc
GetProcessHeap
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
CreateFileA
InitializeCriticalSection
DeleteCriticalSection
GetLocalTime
VirtualProtect
VirtualProtectEx
WriteProcessMemory
VirtualQueryEx
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetCurrentProcessId
Sleep
lstrlenA
lstrcpyA
OpenFileMappingA
user32
wsprintfA
msvcrt
_snprintf
_adjust_fdiv
_mbsicmp
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
_mbsnbcmp
free
printf
vsprintf
__dllonexit
_onexit
_initterm
malloc
Sections
.text Size: 212KB - Virtual size: 209KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 733KB - Virtual size: 733KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE