Behavioral task
behavioral1
Sample
a356f82dda82724d43d3701037268998_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a356f82dda82724d43d3701037268998_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
a356f82dda82724d43d3701037268998_JaffaCakes118
-
Size
43KB
-
MD5
a356f82dda82724d43d3701037268998
-
SHA1
71ff0b5dc5ce85bf8d731b0558d5accd58e364ce
-
SHA256
b2cf9768fdb54708dfef43ee1d33bedf1481fef0de87f82918ba83f6c13bd94e
-
SHA512
337090dfe93ef81bb03c7b6b74fcafb3d2dc195ee39808f841fed59139467095808468d1d708f4faad2d7cbe836240b460534ce16d53282e5e644940a126fc66
-
SSDEEP
768:IwaH5zJ2T8M2ZiHzjehvw+FHsQxv962kdmQRh:IwaZzM8gHuhps2V7kIK
Malware Config
Extracted
jupyter
OC-8
http://37.221.114.23
Signatures
-
Jupyter Backdoor/Client payload 1 IoCs
Processes:
resource yara_rule sample family_jupyter -
Jupyter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a356f82dda82724d43d3701037268998_JaffaCakes118
Files
-
a356f82dda82724d43d3701037268998_JaffaCakes118.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ