run
Behavioral task
behavioral1
Sample
3ab2fa4069371c9d001032b6a5de6bb5_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
3ab2fa4069371c9d001032b6a5de6bb5_JaffaCakes118
-
Size
40KB
-
MD5
3ab2fa4069371c9d001032b6a5de6bb5
-
SHA1
5fdaf2f613eafc20f572b14bec6d08c3ed4b6318
-
SHA256
ba2c7b50496b496e70e97ca40001e7f5417bf7aa3b77078b26503c84c0c174d1
-
SHA512
c3ad49d9e0f91fe20261fbcefa15caddbf32fd0f7f0989bb4eb92c70a487dcf02d49a675797a891baf429e9d1e8689b0800c6596d6cb5b2d589ac1cda73175d7
-
SSDEEP
768:oXa2sI5ccdmGLkiGlIm//39Q8LzNOHLUL:R2s9QZHm/P9dNOrUL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ab2fa4069371c9d001032b6a5de6bb5_JaffaCakes118
Files
-
3ab2fa4069371c9d001032b6a5de6bb5_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
�;�70 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�;�71 Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�;�72 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE