InitTerMain
Behavioral task
behavioral1
Sample
0b6e3b89f328a55d3ae32ef79aa3510c_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
0b6e3b89f328a55d3ae32ef79aa3510c_JaffaCakes118
-
Size
152KB
-
MD5
0b6e3b89f328a55d3ae32ef79aa3510c
-
SHA1
a10adac34e79be6c8a5b4208722faa43f10a81b8
-
SHA256
06b9e2e1955b2943fab00fb8304e86ae44473b69e1689750dd5654b252d9a638
-
SHA512
26518894a0f37ef8912ef0025cb2cbf652a323c586ac4617763e5b08f753e06118a37eef1b296308baf01877c4eee5428b07c7adb41864337e512ebe1e040f8b
-
SSDEEP
3072:YzTZ0tvXTiqv4NYFbYwvwQ7+6j6x3TBft9IYgnRdsTCs:+tgDrAYFcwYY+1x3TBl9IYkwn
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b6e3b89f328a55d3ae32ef79aa3510c_JaffaCakes118
Files
-
0b6e3b89f328a55d3ae32ef79aa3510c_JaffaCakes118.dll windows:4 windows x86 arch:x86
eb7a5f7d242067d1893266b5e90f8135
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
ShowWindow
GetWindowRect
wvsprintfA
CreateWindowExA
GetWindow
CloseWindowStation
LoadCursorA
DestroyCursor
GetCursorInfo
GetClassNameA
DestroyWindow
MessageBoxA
wsprintfA
oleaut32
SysFreeString
ole32
CoInitialize
CoCreateInstance
CoTaskMemFree
CoUninitialize
advapi32
RegOpenKeyExW
kernel32
IsBadStringPtrW
IsBadReadPtr
ExitThread
RemoveDirectoryA
DeleteFileA
GlobalMemoryStatusEx
GetProcessTimes
RaiseException
GlobalAlloc
GlobalFree
GetCurrentProcess
IsBadWritePtr
FormatMessageA
SetUnhandledExceptionFilter
LocalSize
LocalReAlloc
InterlockedIncrement
GetSystemInfo
GetShortPathNameA
lstrlenA
lstrcpyA
CloseHandle
lstrcmpiA
Sleep
GetTempFileNameA
lstrcatA
GetLastError
VirtualQuery
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
GetCurrentThreadId
lstrcmpA
GetTickCount
VirtualProtect
GetSystemDirectoryA
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetModuleFileNameA
ExitProcess
GetExitCodeProcess
InterlockedExchange
FreeLibrary
WideCharToMultiByte
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetVersionExA
ExpandEnvironmentStringsA
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
LoadLibraryA
HeapAlloc
LocalFree
LocalAlloc
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
VirtualAlloc
InterlockedDecrement
msvcrt
srand
_onexit
_adjust_fdiv
_initterm
__dllonexit
_strupr
_memicmp
_wcsicmp
_strlwr
_beginthreadex
wcstombs
atoi
_CxxThrowException
wcslen
strncat
strchr
ceil
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
strrchr
malloc
strstr
realloc
free
memmove
rand
_ftol
strncpy
wcsrchr
_except_handler3
??1type_info@@UAE@XZ
Exports
Exports
Sections
.text Size: 100KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ