Behavioral task
behavioral1
Sample
fdd9d2f7b6fe2f76a4b676d1a4bb3729_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fdd9d2f7b6fe2f76a4b676d1a4bb3729_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fdd9d2f7b6fe2f76a4b676d1a4bb3729_JaffaCakes118
-
Size
1.1MB
-
MD5
fdd9d2f7b6fe2f76a4b676d1a4bb3729
-
SHA1
1f8a57e6e88774195c0e0f2973e49683e0dd45e2
-
SHA256
47f8d217e1cb7721b9e57f290ddd7c93f448ef4b60d3b2957829823c984847a9
-
SHA512
fcd27ead29837d86cf1f58cb150f54d4eecf85bf7f6f9fab61262db63309a39b2fc96ddeece056f73b5d070623532b8e01d3cd497dda5b47250f44e9129daab7
-
SSDEEP
24576:UBNYbDi9XFNMae8gQF4cxf7qO9Tw4164by09AidwQ:GaCWaResJ6i
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fdd9d2f7b6fe2f76a4b676d1a4bb3729_JaffaCakes118
Files
-
fdd9d2f7b6fe2f76a4b676d1a4bb3729_JaffaCakes118.exe windows:4 windows x86 arch:x86
0cffac1f08672340726cb462e0336118
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualFreeEx
LCMapStringA
SetEndOfFile
GetFileSize
ReadFile
SetFilePointer
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
GetModuleFileNameA
Sleep
UnmapViewOfFile
GetStartupInfoA
CreateDirectoryA
GetEnvironmentVariableA
CreateFileA
WriteFile
IsBadReadPtr
HeapReAlloc
ExitProcess
GetProcessHeap
GetTickCount
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetLastError
HeapFree
HeapDestroy
HeapAlloc
CreateIoCompletionPort
HeapCreate
MapViewOfFile
CreateFileMappingA
VirtualAllocEx
VirtualQueryEx
CreateProcessA
TerminateProcess
GetCurrentProcess
RtlMoveMemory
lstrcpyn
LocalSize
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
SetProcessWorkingSetSize
TerminateThread
GetExitCodeThread
LeaveCriticalSection
EnterCriticalSection
SetProcessAffinityMask
CreateThread
InitializeCriticalSection
OpenProcess
GetSystemDirectoryA
Process32Next
CloseHandle
ResumeThread
SuspendThread
WaitForSingleObject
CreateRemoteThread
GetProcAddress
WriteProcessMemory
ReadProcessMemory
GetLocalTime
Process32First
CreateToolhelp32Snapshot
CreateEventA
GetCommandLineA
OpenEventA
UnhandledExceptionFilter
QueryPerformanceFrequency
QueryPerformanceCounter
DeviceIoControl
GetSystemDefaultLangID
GetLocaleInfoA
GlobalSize
SizeofResource
LockResource
LoadResource
FindResourceA
LoadLibraryExA
DeleteFileA
FindNextFileA
RemoveDirectoryA
SetFileAttributesA
GetDriveTypeA
InterlockedExchange
Module32Next
Module32First
GlobalMemoryStatus
CopyFileA
EnumResourceNamesA
GetProfileStringA
WriteProfileStringA
WinExec
GetLocaleInfoW
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
GetCurrentDirectoryA
MulDiv
VerLanguageNameA
FileTimeToSystemTime
GetTimeZoneInformation
SetLastError
InterlockedIncrement
InterlockedDecrement
LocalFree
lstrcpynA
lstrcpyA
FreeLibrary
LocalAlloc
LoadLibraryA
DeleteCriticalSection
FileTimeToLocalFileTime
DuplicateHandle
FlushFileBuffers
LockFile
UnlockFile
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
lstrcmpiA
GetFileAttributesA
GetFileTime
lstrlenA
GetTempPathA
GetWindowsDirectoryA
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
lstrcatA
GetVersion
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GlobalFlags
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
GetSystemTime
GetACP
HeapSize
SetStdHandle
GetFileType
LCMapStringW
SetHandleCount
GetStdHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
VirtualFree
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
GetCurrentThreadId
lstrcmpA
user32
RegisterWindowMessageA
EnableWindow
IsWindowEnabled
GetForegroundWindow
IsWindow
GetActiveWindow
SetActiveWindow
SetForegroundWindow
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
PtInRect
GetSysColorBrush
PostQuitMessage
DestroyMenu
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
MapWindowPoints
GetFocus
SetFocus
AdjustWindowRectEx
GetClientRect
GetTopWindow
GetCapture
SetTimer
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetMessagePos
GetWindow
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetLastActivePopup
GetWindowLongA
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
CopyRect
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetSystemMetrics
CharUpperA
SetWindowTextA
GetMessageTime
IsDialogMessageA
IsWindowVisible
EnumWindows
IsRectEmpty
ShowWindow
UpdateWindow
ChangeDisplaySettingsA
EnumDisplaySettingsA
SetCursorPos
mouse_event
keybd_event
GetDesktopWindow
ReleaseCapture
SendMessageA
LoadImageA
VkKeyScanExA
GetKeyboardLayout
SendDlgItemMessageA
EndDialog
CreateDialogIndirectParamA
GetKeyboardState
SendMessageTimeoutA
GetInputState
PeekMessageA
DispatchMessageA
TranslateMessage
KillTimer
FindWindowExA
FindWindowA
GetWindowTextA
GetClassInfoExA
RegisterClassExA
LoadIconA
LoadCursorA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetMessageA
wsprintfA
MessageBoxA
GetGUIThreadInfo
GetWindowThreadProcessId
GetWindowRect
CallWindowProcA
ReleaseDC
WindowFromPoint
GetCursorPos
GetAncestor
LoadStringA
PostMessageA
GetParent
InvalidateRect
EndPaint
WinHelpA
SetCapture
MoveWindow
FillRect
GetSysColor
GetDC
DefWindowProcA
TrackMouseEvent
BeginPaint
advapi32
RegCloseKey
InitializeSecurityDescriptor
RegQueryValueExA
RegOpenKeyA
RegEnumKeyA
RegQueryInfoKeyA
RegSetKeySecurity
RegOpenKeyExA
CopySid
GetLengthSid
GetTokenInformation
GetSidSubAuthority
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetSidSubAuthorityCount
GetSidIdentifierAuthority
AddAce
InitializeAcl
FreeSid
AllocateAndInitializeSid
RegGetKeySecurity
RegSetValueExA
RegCreateKeyExA
GetUserNameA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
SetSecurityDescriptorDacl
ole32
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
CoCreateGuid
gdi32
CreateSolidBrush
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
GetObjectA
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateBitmap
DeleteObject
SetBkColor
SetTextColor
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SaveDC
EnumFontFamiliesExA
AddFontResourceA
RemoveFontResourceA
GetPixel
CreateCompatibleBitmap
CreateDCA
GetDIBits
RealizePalette
SelectPalette
GetClipBox
RestoreDC
wsock32
select
gethostname
WSACleanup
gethostbyaddr
sendto
recv
send
WSAStartup
gethostbyname
WSASetLastError
socket
setsockopt
ntohs
ioctlsocket
connect
htons
inet_addr
ord1142
ord1141
ord1140
closesocket
listen
bind
wininet
InternetReadFile
InternetCrackUrlA
FtpFindFirstFileA
InternetFindNextFileA
FtpGetFileA
FtpPutFileA
FtpGetCurrentDirectoryA
HttpSendRequestA
InternetSetCookieA
InternetQueryOptionA
FindCloseUrlCache
DeleteUrlCacheEntryA
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
HttpQueryInfoA
InternetGetConnectedState
DeleteUrlCacheEntry
InternetOpenUrlA
FtpDeleteFileA
FtpRenameFileA
FtpCreateDirectoryA
InternetCanonicalizeUrlA
InternetSetOptionA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
FtpSetCurrentDirectoryA
FtpRemoveDirectoryA
ws2_32
WSASocketA
WSARecv
WSASend
oleaut32
VariantChangeType
VariantInit
SafeArrayGetElement
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
psapi
GetModuleFileNameExA
oleacc
ObjectFromLresult
iphlpapi
GetAdaptersInfo
SendARP
shell32
ShellExecuteA
SHGetSpecialFolderPathA
SHEmptyRecycleBinA
SHChangeNotify
comdlg32
PrintDlgA
GetFileTitleA
winspool.drv
GetPrinterA
SetPrinterA
ClosePrinter
EnumPrintersA
DocumentPropertiesA
OpenPrinterA
comctl32
ord17
rasapi32
RasEnumConnectionsA
RasHangUpA
RasDialA
RasEnumEntriesA
RasGetEntryDialParamsA
RasGetConnectStatusA
shlwapi
SHDeleteValueA
PathFileExistsA
PathAppendA
SHDeleteKeyA
mpr
WNetAddConnection2A
WNetOpenEnumA
WNetEnumResourceA
WNetCancelConnection2A
WNetCloseEnum
winmm
waveOutGetNumDevs
waveOutGetDevCapsA
mciSendStringA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Sections
.text Size: 688KB - Virtual size: 685KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 392KB - Virtual size: 483KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE