run
Behavioral task
behavioral1
Sample
8c1e89a7937f0a05b1af4330a65271d6_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
8c1e89a7937f0a05b1af4330a65271d6_JaffaCakes118
-
Size
80KB
-
MD5
8c1e89a7937f0a05b1af4330a65271d6
-
SHA1
2d40d48f77b3465549385088305c8d60cab1f2cc
-
SHA256
97310efb62277144351523565f78ec70dedaf6a2461e2bdfeb2aa6d937f27c5b
-
SHA512
b0cd54963b8ac630fa1ae0c5c40f6e095e0f0e09901955540057a58dd3dd8598e3c3350fd02348c8f1a9a4b022bd55f77d9590905ff0183e9050a3dfce7a17ad
-
SSDEEP
768:MydoF/PjJaIm//39QqUHBNadr5a2edb9HmZELLsdbIWRWeFWxZ:uDm/P9xUH6drs2edb9G4iSxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c1e89a7937f0a05b1af4330a65271d6_JaffaCakes118
Files
-
8c1e89a7937f0a05b1af4330a65271d6_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
�O�E0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�O�E1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�O�E2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE