Behavioral task
behavioral1
Sample
JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_49d79e5755b7e017171b88114e96dff4
-
Size
251KB
-
MD5
49d79e5755b7e017171b88114e96dff4
-
SHA1
83c0ca7c3818703f37fde49b30ad74d48576d6cd
-
SHA256
d470f1478bb30da81214d07d734f518b41cb94175126235a71a18711d5eb65b1
-
SHA512
97cef2851ffa95272e9a4227cf7b19d6005e31d6de04be34bf306c70278167b4a9584738e34f7516183443c2a83895df6ff07a7a7ff1d1142afcb90cd3b2ea1c
-
SSDEEP
3072:vlrH2jK+6lRdC9JoXMsJEYQJvMnTST/Okcw3QEe5dx7KFFh:vUK+6lvCUXqY2UT6Kwg95Gl
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_49d79e5755b7e017171b88114e96dff4
Files
-
JaffaCakes118_49d79e5755b7e017171b88114e96dff4.exe windows:4 windows x86 arch:x86
c78d9bb43e84fe4e6c31a9af658f5a51
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileTime
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
LocalAlloc
LocalFree
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
LeaveCriticalSection
GlobalLock
GlobalReAlloc
GlobalAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
GetVersion
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcmpA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GetFileSize
FreeLibrary
GetProcessVersion
GlobalFlags
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapReAlloc
GetStartupInfoA
GetTimeZoneInformation
GetACP
HeapSize
TerminateProcess
VirtualFree
VirtualAlloc
IsBadWritePtr
GetEnvironmentVariableA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
GetFullPathNameA
lstrcpynA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentProcess
DuplicateHandle
HeapAlloc
HeapFree
GetCurrentThreadId
CreateThread
CreateDirectoryA
GetCommandLineA
CreateMutexA
ReleaseMutex
SetUnhandledExceptionFilter
GetVersionExA
GetWindowsDirectoryA
WinExec
GetModuleFileNameA
MultiByteToWideChar
GetFileAttributesA
SetFilePointer
ReadFile
lstrcatA
GetLastError
DeleteFileA
SetLastError
lstrcpyA
Sleep
FindResourceA
LoadResource
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SizeofResource
WriteFile
GetLocalTime
lstrlenA
GetModuleHandleA
ExitProcess
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
lstrcmpiA
GlobalGetAtomNameA
CloseHandle
shell32
SHGetFolderPathA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
comctl32
ord17
gdi32
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
comdlg32
GetFileTitleA
Sections
.text Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ