run
Behavioral task
behavioral1
Sample
dca66fd55ac1a896903a9240f0e84807_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
dca66fd55ac1a896903a9240f0e84807_JaffaCakes118
-
Size
80KB
-
MD5
dca66fd55ac1a896903a9240f0e84807
-
SHA1
dff053755ffee034134b074046afd7cdc0022b66
-
SHA256
d4b124016e7341f98199d8ca999b46042bed26f5659fcdd245b850918c057f9c
-
SHA512
0b4ff95fcd18c084d68b142a55f43e58ab6740f7a6416f3b8a77b49eb4d5076957afa4a7d25af12141a8c6008de6b371421a1108ef8ec3bb766fa96ce8894036
-
SSDEEP
768:ddoF/PjJaIm//39QqUHBNadrda2edb9HmZELLsdbIWRWeFWxZ:aDm/P9xUH6drQ2edb9G4iSxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dca66fd55ac1a896903a9240f0e84807_JaffaCakes118
Files
-
dca66fd55ac1a896903a9240f0e84807_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
�hcr0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�hcr1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�hcr2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE