Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
JaffaCakes118_37f227b56b570aa8c66feec133d6dc38.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_37f227b56b570aa8c66feec133d6dc38
-
Size
10.2MB
-
MD5
37f227b56b570aa8c66feec133d6dc38
-
SHA1
285d95c9e0dbb2a10de93f93f1b482584186a807
-
SHA256
80552f19eafcec719239903b543d578b4bb8c19bbea405dd5148e5216d86e350
-
SHA512
81dd6301e4bedb3e95988621363ae60348ae8c36740c5371cfd6d15f385d3447a9ca26ea4a830f690d2f1a0eb74061951f4724648027b1cb6c50a072f638a292
-
SSDEEP
3072:mIXB6t1GloVFwz8BD0cjRTyVwdUEHAZnCq9EXTpwuUcMLHr:m2lQwz8BDpWwOkA1CqoTuhcMf
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_37f227b56b570aa8c66feec133d6dc38
Files
-
JaffaCakes118_37f227b56b570aa8c66feec133d6dc38.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.. Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE