GoogleUpdate_unsigned.pdb
Behavioral task
behavioral1
Sample
5a12da816ea6c2c4c7978a53ed4aa145_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5a12da816ea6c2c4c7978a53ed4aa145_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a12da816ea6c2c4c7978a53ed4aa145_JaffaCakes118
-
Size
10.1MB
-
MD5
5a12da816ea6c2c4c7978a53ed4aa145
-
SHA1
9cacbaa49ef7b8243f255e3bcd80e58892f71ac8
-
SHA256
198aad7da13654ac22e10a075be191ac5617b91789004c857b0c0cffa9343fe9
-
SHA512
fa127f4763502489e860612769b4909dca0e1812fc5e38518760e57d41fc9ca9f27e1c51402c9e7b94f894a41ec575c1d4792d1a18a43fd920dda371d6ada6dd
-
SSDEEP
196608:WqnhKvovydeG/Oas7FVr8oPVERBjbnhf8PIBS:WqnHvydenVrjERBjbn2wBS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a12da816ea6c2c4c7978a53ed4aa145_JaffaCakes118
Files
-
5a12da816ea6c2c4c7978a53ed4aa145_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Sections
.text Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ