run
Behavioral task
behavioral1
Sample
c80b95b5a2d5373a3f6df8f45b528458_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
c80b95b5a2d5373a3f6df8f45b528458_JaffaCakes118
-
Size
80KB
-
MD5
c80b95b5a2d5373a3f6df8f45b528458
-
SHA1
585c9faf32c7686968b13de308ee2fec24b0e555
-
SHA256
0f700a37adcf5cba2b0d864d46d2a879bea5d26e3e0450d48433183576114267
-
SHA512
ec94085f6ebd951267a14d7a20c89264610a77730c16f9b5d0e914ed0ec2bae2886215a0b52948a78c9ba5c925d93a5c8392d52717b5bf1e5d76eaa6ce288c15
-
SSDEEP
768:BcxX8etsIm//39QqU8QNadr+a2wWyPU2a/ZbRBsAVqsbX6WxZ:OTm/P9xU8Bdr32wXPk/ZNBsAVqmXfxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c80b95b5a2d5373a3f6df8f45b528458_JaffaCakes118
Files
-
c80b95b5a2d5373a3f6df8f45b528458_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
@!W0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
@!W1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
@!W2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE