Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
JaffaCakes118_35488d47c90abce38e4b6af5851ea660.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_35488d47c90abce38e4b6af5851ea660.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_35488d47c90abce38e4b6af5851ea660
-
Size
96KB
-
MD5
35488d47c90abce38e4b6af5851ea660
-
SHA1
728e80da6301ff406565286680191033ab4fbead
-
SHA256
332ee3eff68305532c352859772e36b6693a483bb2e1a46f0aee46b816e1eb49
-
SHA512
9707dfc1fbf016a8b64eab8c0e1c29a89346ae3fbe9ee6c4200b810640d34d12fa046656a24212d0c98b72221ada885f87af12d28abd2ee4de98d470a1851499
-
SSDEEP
1536:C2aWii8VlzGOU/PYbQF99d1HB5O43kx+AEn2vl7cHQkGcm+GOLOBpbQ54wytbJ/3:GPzRlC9pW43k02vlmTt6BpbQ54wYb0A
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_35488d47c90abce38e4b6af5851ea660
Files
-
JaffaCakes118_35488d47c90abce38e4b6af5851ea660.exe windows:4 windows x86 arch:x86
301670d84b202b593f16b4728a7795c1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
StartServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegQueryValueExA
CreateServiceA
user32
wsprintfA
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strstr
strchr
malloc
realloc
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
_controlfp
kernel32
GetStartupInfoA
GetCommandLineA
CreateMutexA
GetLastError
ReleaseMutex
Sleep
ExpandEnvironmentStringsA
GetFileAttributesA
CreateDirectoryA
lstrcatA
SetLastError
lstrcpyA
GetTempPathA
GetTickCount
FindResourceA
LoadResource
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SizeofResource
GetModuleHandleA
GetLocalTime
lstrlenA
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
WriteFile
DeleteFileA
SetFileAttributesA
MoveFileA
FreeResource
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ