Behavioral task
behavioral1
Sample
e9816922562088cb64815a9069713f99_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e9816922562088cb64815a9069713f99_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e9816922562088cb64815a9069713f99_JaffaCakes118
-
Size
40KB
-
MD5
e9816922562088cb64815a9069713f99
-
SHA1
91d73670dca57f72b591543a4341671fc72e4e5e
-
SHA256
366fee6848c375ae07344d5bb3a884330d6e658c3f19e3d2624f22846243c937
-
SHA512
49a2af1d0fe2daaa447479dc42d1f1dde0f8d68eb738e2268b5188e87cc7f1dadd817f6ffca2e7eb49ce7f3d452e2e88e8abdf0900c085c22e16241127c1567c
-
SSDEEP
768:RUONNwyReluYqUtF56MT41VeUtMD9kyU13A:hNNwyoUYqUtN2VeWMD/kw
Malware Config
Extracted
jupyter
J12
http://5.254.118.226
Signatures
-
Jupyter Backdoor/Client payload 1 IoCs
resource yara_rule sample family_jupyter -
Jupyter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9816922562088cb64815a9069713f99_JaffaCakes118
Files
-
e9816922562088cb64815a9069713f99_JaffaCakes118.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ