Behavioral task
behavioral1
Sample
29b8e9a08a9564f203f9acc4ea11276c_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
29b8e9a08a9564f203f9acc4ea11276c_JaffaCakes118
-
Size
468KB
-
MD5
29b8e9a08a9564f203f9acc4ea11276c
-
SHA1
d8f6af568e039b4b870cd02ac4e455383e9a6ce9
-
SHA256
bd07dd8999585fe4c7a4cdf85395301fb0527cc4e64c27086a4b3965da37f178
-
SHA512
f89a501e4ab7a2dc6a4ac5d4ddafc124d60ea1bab0216e1aa3dcd1ed720dc510755f97c6d8ad079ebf52a054646e173c4941f822add020f5754eaae63d20d263
-
SSDEEP
12288:h6lAOCtEafk8/0IWlfyd3GFrGWZFOZ+v:h6lAOCtEM/0blfC3GFrG0FOZ+v
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29b8e9a08a9564f203f9acc4ea11276c_JaffaCakes118
Files
-
29b8e9a08a9564f203f9acc4ea11276c_JaffaCakes118.exe windows:4 windows x86 arch:x86
0cde94561b66cffc700ff7055ec6f4bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_ftol
strrchr
strncmp
strncpy
_strnicmp
kernel32
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
LocalSize
RtlMoveMemory
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread
WaitForSingleObject
CloseHandle
GetEnvironmentVariableA
TerminateProcess
CreateToolhelp32Snapshot
Process32First
lstrlenA
Process32Next
OpenProcess
CreateWaitableTimerA
SetWaitableTimer
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
CreateFileA
GetCommandLineA
GetModuleFileNameA
lstrcpyn
user32
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
GetMessageA
PeekMessageA
shell32
SHGetSpecialFolderPathA
StrCmpNIA
ntdll
ZwUnmapViewOfSection
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 432KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE