��������������
Behavioral task
behavioral1
Sample
ce8ebb86ee0fc1da25c7fbefef55168d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ce8ebb86ee0fc1da25c7fbefef55168d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ce8ebb86ee0fc1da25c7fbefef55168d_JaffaCakes118
-
Size
1.3MB
-
MD5
ce8ebb86ee0fc1da25c7fbefef55168d
-
SHA1
af60f42d454567a591c35767ba61e9fc83f7e04f
-
SHA256
47cd3e6a8e99ae04696cdea1d65f998edc72135ffc8e0973fd4935d8d25644c9
-
SHA512
384b7071802fe6ad60f5818ac97e2af6a727389c79d8a6151ffb218f2ba1d3950f6a86b527f413ec2b19b12c071a1480dde79003cff708b69bda1426ab927cab
-
SSDEEP
24576:GRxkDOcDf9d9a5GV/m9snzDUH7U1DX6qJyjq70w2F+lS:umW6XPY+lS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce8ebb86ee0fc1da25c7fbefef55168d_JaffaCakes118
Files
-
ce8ebb86ee0fc1da25c7fbefef55168d_JaffaCakes118.dll windows:4 windows x86 arch:x86
b1634275f292e548043809834e512a50
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersion
InterlockedDecrement
InterlockedIncrement
TerminateProcess
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetCurrentDirectoryA
CreateThread
CloseHandle
TerminateThread
GetExitCodeThread
CreateFileA
lstrcpyn
DeviceIoControl
GetTempPathA
RtlMoveMemory
GetCurrentProcess
ReadProcessMemory
lstrcpynA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
GetProcAddress
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
LCMapStringW
RaiseException
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
GetStringTypeA
GetStringTypeW
LocalSize
SetStdHandle
FlushFileBuffers
LCMapStringA
GetCommandLineA
GetModuleFileNameA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
DeleteFileA
GetLocalTime
CreateDirectoryA
SetFilePointer
WriteFile
WideCharToMultiByte
RtlZeroMemory
GetCurrentThreadId
MultiByteToWideChar
GetFileSize
ReadFile
GetTickCount
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
OpenProcess
MulDiv
GetModuleHandleA
user32
GetWindowLongA
DefWindowProcA
GetDlgItem
IsWindow
SetFocus
GetFocus
InvalidateRect
ValidateRect
UpdateWindow
GetWindowRect
ScreenToClient
MoveWindow
SetWindowPos
GetClassLongA
SetParent
IsWindowVisible
IsWindowEnabled
EnableWindow
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
MessageBoxA
SetPropA
GetPropA
RemovePropA
GetSysColor
LoadCursorA
PostMessageA
SetCursor
LoadIconA
SetWindowLongA
CallWindowProcA
GetForegroundWindow
MsgWaitForMultipleObjects
ShowWindow
GetCursorPos
SendMessageA
DefFrameProcA
ClientToScreen
GetParent
GetAsyncKeyState
DestroyAcceleratorTable
BeginPaint
GetClientRect
FillRect
EndPaint
PeekMessageA
wsprintfA
KillTimer
SetTimer
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuInfo
GetMenuState
GetMenuCheckMarkDimensions
GetMenuItemRect
GetMenuItemInfoA
GetMenuStringA
TrackPopupMenu
SetForegroundWindow
UnhookWindowsHookEx
InsertMenuA
EndDialog
DestroyWindow
DestroyIcon
UnregisterClassA
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
RegisterClassExA
GetMenuItemCount
AppendMenuA
DestroyMenu
CreatePopupMenu
CreateMenu
GetActiveWindow
GetWindowThreadProcessId
SendMessageTimeoutA
EnumChildWindows
TrackMouseEvent
GetWindowDC
SetWindowRgn
ReleaseDC
GetDC
GetClassNameA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
RegisterWindowMessageA
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
PostQuitMessage
gdi32
SetTextColor
SetBkMode
GetStockObject
SetBkColor
DeleteObject
CreateSolidBrush
CreatePatternBrush
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
DeleteDC
GetDIBits
CreateRectRgn
CombineRgn
BitBlt
CreateFontA
GetObjectA
advapi32
CryptAcquireContextA
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptCreateHash
ole32
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
VarR8FromCy
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
VarR8FromBool
atl
ord42
ord47
gdiplus
GdipDeleteGraphics
GdipGetImageDimension
GdipDisposeImage
GdipDrawImageRect
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipLoadImageFromStream
GdiplusStartup
wininet
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetCloseHandle
InternetSetCookieA
InternetGetConnectedState
InternetOpenUrlA
shell32
ShellExecuteA
Shell_NotifyIconA
ws2_32
socket
inet_addr
WSASetLastError
htons
bind
gethostbyname
connect
select
__WSAFDIsSet
closesocket
send
recv
listen
accept
sendto
recvfrom
ntohs
inet_ntoa
getsockname
getpeername
setsockopt
WSAGetLastError
WSAStartup
WSACleanup
htonl
oleacc
ObjectFromLresult
d2d
ord42
ord43
ord40
ord18
ord60
ord240
ord17
ord56
ord14
ord13
ord15
ord54
ord8
ord7
ord73
ord4
ord9
ord12
ord2
ord6
ord74
ord230
ord61
ord62
ord63
ord65
ord66
ord67
ord215
ord216
ord217
ord68
ord213
ord69
ord117
ord71
ord72
ord93
ord19
ord211
ord112
ord113
ord140
ord141
ord170
ord169
ord171
ord172
ord199
ord200
ord226
ord228
ord229
ord36
ord96
ord98
ord101
ord99
ord100
ord106
ord107
ord108
ord109
ord110
ord111
ord27
ord28
ord29
ord30
ord118
ord70
ord16
ord31
ord33
ord34
ord35
ord58
ord149
ord150
ord151
ord39
ord32
ord11
ord37
ord38
ord168
ord119
ord120
ord94
ord78
ord152
ord165
ord166
ord167
ord75
ord76
ord77
ord237
ord121
ord79
ord80
ord81
ord82
ord128
ord206
ord207
ord208
ord210
ord239
System_SetState_s
Font_Set_Z_e
Font_GetCharacterWidth
Font_GetTextHeight
Font_GetTextWidth
Font_SetKerningWidth
Font_SetKerningHeight
Font_SetColor
Font_Del
Font_Printf
Font_SetBlendMode_e
Font_Interface_Get
System_Initiate_e
Texture_Load_c_e
Resource_Load_e
Spr_Interface_Get
Spr_Render_e
Spr_RenderStretch_e
Spr_Del
Spr_SetTexture_e
Spr_SetTextureRect_e
Spr_SetHotSpot_e
Spr_SetColor_e
Spr_SetBlendMode_e
Spr_GetWidth_e
Spr_GetHeight_e
Spr_Set_Z_e
Spr_GetTexture_e
Spr_SetFlip
Spr_Get_ColorD
Spr_Set_ColorD
psapi
GetProcessMemoryInfo
dat
GetMyHandle
update
���뷴���ύ����
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ