_�����ӳ���
Behavioral task
behavioral1
Sample
3105abd78531ab1f273554a5bc967df1_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3105abd78531ab1f273554a5bc967df1_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
3105abd78531ab1f273554a5bc967df1_JaffaCakes118
-
Size
456KB
-
MD5
3105abd78531ab1f273554a5bc967df1
-
SHA1
1d8ff708fd6e05744439f8e303100aae2786f263
-
SHA256
0b81fd023a28c59a1e916dff7ea3b3336fd98529493538ba8c327c0ad11f4720
-
SHA512
86389d6750420baf8ed88fabfaeb0a072cb838c265a23f61bf5073a20438370e41543353275ec103478600b05f1a64a2a8d5b92b9ac43d88693d8cce9b150bd4
-
SSDEEP
12288:dMgC+7JNmAzD4ETqVqhydRxdSttCm/h0DR9WPCp:dMgZ7JNmGDhTq4hydlwb/WlAa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3105abd78531ab1f273554a5bc967df1_JaffaCakes118
Files
-
3105abd78531ab1f273554a5bc967df1_JaffaCakes118.dll windows:4 windows x86 arch:x86
9a855027b891b89ac17b4bab8a3e0b1e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetCurrentThread
Beep
CreateProcessA
CreateWaitableTimerA
SetWaitableTimer
VirtualQueryEx
VirtualProtectEx
VirtualAllocEx
CreateFileMappingA
VirtualFreeEx
UnmapViewOfFile
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
LCMapStringA
DeleteFileA
GetCurrentDirectoryA
WriteFile
GetTickCount
Sleep
GetVersionExA
GetCommandLineA
CreateThread
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
RaiseException
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
ReadProcessMemory
GetCurrentProcess
Process32Next
Process32First
GetProcAddress
LoadLibraryA
FreeLibrary
TerminateProcess
OpenProcess
DeviceIoControl
OpenFileMappingA
lstrcpyn
CreateFileA
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
CloseHandle
RtlMoveMemory
MapViewOfFile
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetLastError
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualFree
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
InitializeCriticalSection
user32
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
ActivateKeyboardLayout
GetKeyboardLayout
SystemParametersInfoA
GetKeyboardLayoutList
UnloadKeyboardLayout
PostMessageA
GetForegroundWindow
wvsprintfA
MessageBoxTimeoutA
MessageBoxA
GetWindowThreadProcessId
GetClassNameA
GetGUIThreadInfo
IsWindowVisible
GetWindow
GetDesktopWindow
GetAsyncKeyState
CallWindowProcA
KillTimer
SetTimer
MsgWaitForMultipleObjects
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetWindowTextA
advapi32
RegSetValueExA
CryptCreateHash
CryptReleaseContext
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteValueA
RegEnumValueA
RegFlushKey
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: 152KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dfhdh0 Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dfhdh1 Size: 232KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ