aspnet_regbrowsers.pdb
Behavioral task
behavioral1
Sample
7f0af9bcc865de93926d1c873e381b09_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7f0af9bcc865de93926d1c873e381b09_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
7f0af9bcc865de93926d1c873e381b09_JaffaCakes118
-
Size
14.5MB
-
MD5
7f0af9bcc865de93926d1c873e381b09
-
SHA1
29ecf71244e826956f3e694983eb48d8e5805d30
-
SHA256
a4a8dcbd991509f10cb57483b7c1e210928185490d2ef6e1dd810e329afbda0a
-
SHA512
9ea86a1c15f14bcd1f51e7eea5c2f0fbd8b8060ce66dc7cab95326238b3c54b290ddef73ef7eb4864702747cb399f5d476151d47b0ecab4bb054f318693b1918
-
SSDEEP
196608:W1qfi7bkdR7PVPa9+6Y7SOEibgRiGBfWzmVGBfWL1qfi7bkdR7PVmx:WQf643hPFgRjWSiWLQf643hm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f0af9bcc865de93926d1c873e381b09_JaffaCakes118
Files
-
7f0af9bcc865de93926d1c873e381b09_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ