run
Behavioral task
behavioral1
Sample
38a31f1f78304012df8ee12a4d2911ad_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
38a31f1f78304012df8ee12a4d2911ad_JaffaCakes118
-
Size
80KB
-
MD5
38a31f1f78304012df8ee12a4d2911ad
-
SHA1
92a6a6a7d47a3a394ea53c1291b31487c83cf4e4
-
SHA256
643550399981b1caa7b224afbf218764a074d33df8e1bd3bc07c227bb254cf7c
-
SHA512
ea4f75a7ae1435ec29c37871a769a203e9ac1e6a2503162d7bcde620384b536871bc5c58ef5b50933d39162160584f3bea4e85e6878edba479bee6b169aa388b
-
SSDEEP
768:ydoF/PjJaIm//39QqUHBNadr+a2edb9HmZELLsdbIWRWeFWxZ:ZDm/P9xUH6dr32edb9G4iSxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38a31f1f78304012df8ee12a4d2911ad_JaffaCakes118
Files
-
38a31f1f78304012df8ee12a4d2911ad_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
[1�0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
[1�1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
[1�2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE