Behavioral task
behavioral1
Sample
b4c213dbeaae1a6301a4d1d20c8a1742_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b4c213dbeaae1a6301a4d1d20c8a1742_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b4c213dbeaae1a6301a4d1d20c8a1742_JaffaCakes118
-
Size
264KB
-
MD5
b4c213dbeaae1a6301a4d1d20c8a1742
-
SHA1
a72286dc4e2172a8802d0156487608996439b699
-
SHA256
416b87996e81492cd36b49dd52d7cecc35882138599ca18c5e4ba6bf06dfa56f
-
SHA512
5a0710fe186e6902f8c98468588cd688a14c08a2945fdbf5b71ca440ccae59cd3746e41de7fe9c92db0ac83d156275c7de487e3b61df9f1456da63c2e6ea7c96
-
SSDEEP
3072:PSYyouAce4ii0jdocrrqnOFMvvs1Vlrua3ORF/1U+trWNOsKYI:6Yvf4ifZqnOOvvs1VlSa3ORNW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4c213dbeaae1a6301a4d1d20c8a1742_JaffaCakes118
Files
-
b4c213dbeaae1a6301a4d1d20c8a1742_JaffaCakes118.exe windows:4 windows x86 arch:x86
def0c55191a7d433da88d60cb3be9857
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
FindNextFileA
FindFirstFileA
FindClose
GetLocalTime
GetCommandLineA
LCMapStringA
LCMapStringW
CreateFileA
FlushFileBuffers
SetStdHandle
InterlockedIncrement
InterlockedDecrement
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
ReadFile
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
RaiseException
VirtualAlloc
RtlUnwind
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetLastError
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
ExitProcess
GetVersion
GetStartupInfoA
Sleep
TerminateThread
CreateThread
CloseHandle
GetTickCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MulDiv
GetCurrentThreadId
RtlZeroMemory
LocalSize
lstrcpynA
ReadProcessMemory
GetCurrentProcess
RtlMoveMemory
GetModuleHandleA
GetProcAddress
FreeLibrary
WriteFile
LoadLibraryA
SetEndOfFile
ws2_32
select
WSAGetLastError
connect
inet_ntoa
WSAStartup
WSACleanup
inet_addr
gethostbyname
send
__WSAFDIsSet
recv
closesocket
htons
socket
shutdown
ioctlsocket
user32
SendDlgItemMessageA
CreateMenu
CreatePopupMenu
DestroyMenu
AppendMenuA
GetMenuItemCount
InsertMenuA
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringA
GetMenuItemInfoA
GetMenuItemRect
GetMenuCheckMarkDimensions
GetMenuState
GetMenuInfo
GetMenuDefaultItem
SetDlgItemTextA
RemoveMenu
CheckMenuItem
SetMenuItemInfoA
SetMenuItemBitmaps
SetMenuDefaultItem
wsprintfA
PeekMessageA
GetDlgItemInt
DialogBoxParamA
CreateDialogParamA
ReleaseDC
GetDC
GetClassNameA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
RegisterWindowMessageA
DrawMenuBar
SetMenu
MenuItemFromPoint
SetDlgItemInt
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
RegisterClassExA
LoadCursorA
RemovePropA
GetPropA
SetPropA
MessageBoxA
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
EnableWindow
IsWindowEnabled
ShowWindow
IsWindowVisible
SetParent
PostMessageA
SetWindowPos
MoveWindow
ScreenToClient
GetWindowRect
UpdateWindow
ValidateRect
InvalidateRect
GetFocus
SetFocus
IsWindow
GetDlgItem
DefWindowProcA
GetWindowLongA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
UnhookWindowsHookEx
SetCursor
PostQuitMessage
UnregisterClassA
DestroyIcon
DestroyWindow
EndDialog
EndPaint
FillRect
GetClientRect
BeginPaint
DestroyAcceleratorTable
GetAsyncKeyState
GetParent
ClientToScreen
SendMessageA
DefFrameProcA
CallWindowProcA
GetSysColor
LoadIconA
SetWindowLongA
GetDlgItemTextA
gdi32
SetBkColor
DeleteObject
CreateSolidBrush
GetStockObject
GetDeviceCaps
CreateFontA
GetObjectA
CreatePatternBrush
SetTextColor
SetBkMode
comctl32
InitCommonControlsEx
shell32
Shell_NotifyIconA
icmp
IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle
Sections
.text Size: 220KB - Virtual size: 217KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE