run
Behavioral task
behavioral1
Sample
d29b8dd29d4e2d33f944de9e6717c83e_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
d29b8dd29d4e2d33f944de9e6717c83e_JaffaCakes118
-
Size
80KB
-
MD5
d29b8dd29d4e2d33f944de9e6717c83e
-
SHA1
1767fa952b1081cb123fbfa83bcefd020b21df04
-
SHA256
358f2921acff2248f8496f7d6d7bbd653e27af2b79f9ecebc91a146f4185b6c8
-
SHA512
4732b847a032daa1d73e3cbb151d8007f9d9d22e1f7b0a0ab6f08c1d1e317e9f76e472616ea5306ceb173d1e5779a945c8c9bf91190eb067bd48c4628cbddb5b
-
SSDEEP
768:WcxX8etsIm//39QqU8QNadrwa2wWyPU2a/ZbRBsAVqsbX6WxZ:VTm/P9xU8Bdr52wXPk/ZNBsAVqmXfxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d29b8dd29d4e2d33f944de9e6717c83e_JaffaCakes118
Files
-
d29b8dd29d4e2d33f944de9e6717c83e_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
� 0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
� 1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
� 2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE