run
Behavioral task
behavioral1
Sample
fe47401dd11f93db4188dc7dee058686_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
fe47401dd11f93db4188dc7dee058686_JaffaCakes118
-
Size
80KB
-
MD5
fe47401dd11f93db4188dc7dee058686
-
SHA1
afaab958dcb2f11bd2022bdd3f9dbb7865d14d94
-
SHA256
eff985627fe99eeb8d76231d8f073290e277eccb78148b3147b84f8d88947d3e
-
SHA512
ab7c9016c954f3d65de6237c1976214e786b69ed52e0aa1261e57550d00c517cb4edb4eedd980bb684b07401cc36f536de683140686c129daf65bc612c7a14cd
-
SSDEEP
768:qTEB9/qEn5Im/altQlU719adr6a2GtV2FlazrHzqBJ5WxZ:q+Im/WtuU7+drz2W2Fcz7HxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe47401dd11f93db4188dc7dee058686_JaffaCakes118
Files
-
fe47401dd11f93db4188dc7dee058686_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
�R�0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�R�1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�R�2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE