Behavioral task
behavioral1
Sample
f833b9411d18dc2cc7184e7c316d29d9_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f833b9411d18dc2cc7184e7c316d29d9_JaffaCakes118.dll
Resource
win10v2004-20240910-en
General
-
Target
f833b9411d18dc2cc7184e7c316d29d9_JaffaCakes118
-
Size
208KB
-
MD5
f833b9411d18dc2cc7184e7c316d29d9
-
SHA1
484f392b419195a92e501c04b3d9cd359b900782
-
SHA256
ce652f50ab6c30d600d2c24048230ac2d99e7423c1f1950bede390f584b8aedf
-
SHA512
6e1c1379eaaae63cf4a4f358459e276a244da399149e60f90201e8edafa3dfc5c35bec2537be99ca621b86f247d5ec68e91d901512bc09e48af0930a744804e3
-
SSDEEP
3072:oNYViMAOcwQDll11Fl1VlAGxr4+GVOwkwokUzpGu9pRvtZYs3IxP:gp5y+G4wk+Uzp59H7I
Malware Config
Extracted
jupyter
MX-1
http://5.254.118.242
Signatures
-
Jupyter Backdoor/Client payload 1 IoCs
resource yara_rule sample family_jupyter -
Jupyter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f833b9411d18dc2cc7184e7c316d29d9_JaffaCakes118
Files
-
f833b9411d18dc2cc7184e7c316d29d9_JaffaCakes118.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 196KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ