run
Behavioral task
behavioral1
Sample
2d9b4d018f359e7b452fd93ddca17afd_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
2d9b4d018f359e7b452fd93ddca17afd_JaffaCakes118
-
Size
80KB
-
MD5
2d9b4d018f359e7b452fd93ddca17afd
-
SHA1
4169a92107af7594da770cf45eacdc5b1740fded
-
SHA256
4b96f69de89f59b7ed247f9b26f6f5afcbdcf87a4cb4c95938c20dc60b7858b5
-
SHA512
118f9bb09a2dd9086ad91c379ca8d22493ee2e5ef77964f56067436d4bb7c51e177f3d04011c2a2047d85839b61088202e73db6863cecf4e671a08c25a64bd99
-
SSDEEP
768:ydoF/PjJaIm//39QqUHBNadrXa2edb9HmZELLsdbIWRWeFWxZ:ZDm/P9xUH6drq2edb9G4iSxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d9b4d018f359e7b452fd93ddca17afd_JaffaCakes118
Files
-
2d9b4d018f359e7b452fd93ddca17afd_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
U=�0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
U=�1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
U=�2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE