run
Behavioral task
behavioral1
Sample
0e5072db11c9edcc3c5acebb9ddac514_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
0e5072db11c9edcc3c5acebb9ddac514_JaffaCakes118
-
Size
80KB
-
MD5
0e5072db11c9edcc3c5acebb9ddac514
-
SHA1
800f004bad48939dcabf8de0995836b92e3b7274
-
SHA256
6e75e1a3670ed2947b8f98f4acf16bb1a829663598b163bde1e4441983f81d7b
-
SHA512
bd7c90e5b3e85e80fadaeb5006a6be0cb4fd1ac8c01bb3f90f4c6e659d9912f931ed82d9a457cffa164ce5fdb0403d093978cdd69ac4e72fc9c5e204fcd3e69e
-
SSDEEP
768:jcxX8etsIm//39QqU8QNadrFa2wWyPU2a/ZbRBsAVqsbX6WxZ:sTm/P9xU8Bdr42wXPk/ZNBsAVqmXfxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e5072db11c9edcc3c5acebb9ddac514_JaffaCakes118
Files
-
0e5072db11c9edcc3c5acebb9ddac514_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
�:/u0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�:/u1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�:/u2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE