Behavioral task
behavioral1
Sample
5dad16c65336bd820db2d9abbae1b306_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5dad16c65336bd820db2d9abbae1b306_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5dad16c65336bd820db2d9abbae1b306_JaffaCakes118
-
Size
68KB
-
MD5
5dad16c65336bd820db2d9abbae1b306
-
SHA1
4c19dd7d02b0d6e9a7014f92c632610d8473937e
-
SHA256
44c0ecd7145907dcd5bc0f810317a26f55d53fdbed4be03e80bfa1acc766f291
-
SHA512
f0ec983a6975e7c3e1af15d0670b109a476b6a08c302b3a9931b59f0770503709af36de73da443cac38e4cc938ec06813e13d05ee19c5140246f4b808a675fc2
-
SSDEEP
768:MhhxzcD3yjpRZ9rTaZmZ4E2wnqP3vjb6qlNcJ7Fglk0+MF9yXIaPFitKpSLtkiBc:MtR3rT3n247Slj9AVkKpSLt0RYOtPZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5dad16c65336bd820db2d9abbae1b306_JaffaCakes118
Files
-
5dad16c65336bd820db2d9abbae1b306_JaffaCakes118.exe windows:4 windows x86 arch:x86
af56f090e7d6a46d5ee5dd6ce1678e5d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
CloseHandle
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
LCMapStringA
GetProcessHeap
GetCommandLineA
WinExec
GetTickCount
GetVersion
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
GetProcAddress
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
SetFilePointer
MultiByteToWideChar
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
user32
MessageBoxA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
urlmon
URLDownloadToFileA
shlwapi
StrToIntExA
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE