General

  • Target

    97f38f7ba46ee5ad464b36d76f0beb28_JaffaCakes118

  • Size

    7.1MB

  • MD5

    97f38f7ba46ee5ad464b36d76f0beb28

  • SHA1

    402f59ec734e8d2512bc21f3ee7ad3e9e5805865

  • SHA256

    125b3cbd9ff8cae3c915ca81df4bf02bb07dafc2c68640ddb88df9e1ee0097e7

  • SHA512

    9c038ca6c12538f74b4befbe8abe80491940e59a2eae46d633c472c854ac6de6fea52d85c1831ade4f1ba2bb6b1f305c998462d156c497aaf78d659b8d509017

  • SSDEEP

    196608:Cs+kppMVOO018wzfssfW38otZaxFpO0rzZ764E:CVuXKiUY+yTO0/ZO4E

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • 97f38f7ba46ee5ad464b36d76f0beb28_JaffaCakes118
    .zip
  • pdfstamp_cmd/example/1.bat
  • pdfstamp_cmd/example/10.bat
  • pdfstamp_cmd/example/11.bat
  • pdfstamp_cmd/example/12.bat
  • pdfstamp_cmd/example/13.bat
  • pdfstamp_cmd/example/14.bat
  • pdfstamp_cmd/example/15.bat
  • pdfstamp_cmd/example/16.bat
  • pdfstamp_cmd/example/17.bat
  • pdfstamp_cmd/example/18.bat
  • pdfstamp_cmd/example/19-pdfs.bat
  • pdfstamp_cmd/example/2.bat
  • pdfstamp_cmd/example/3.bat
  • pdfstamp_cmd/example/4.bat
  • pdfstamp_cmd/example/5.bat
  • pdfstamp_cmd/example/6.bat
  • pdfstamp_cmd/example/7.bat
  • pdfstamp_cmd/example/8.bat
  • pdfstamp_cmd/example/9.bat
  • pdfstamp_cmd/example/ChineseCharacters.bat
  • pdfstamp_cmd/example/EuropeanCharacters.bat
  • pdfstamp_cmd/example/FRE3OF9X.TTF
  • pdfstamp_cmd/example/FREE3OF9.TTF
  • pdfstamp_cmd/example/Invoice_Template.png
    .png
  • pdfstamp_cmd/example/JapanCharacters.bat
  • pdfstamp_cmd/example/KoreaCharacters.bat
  • pdfstamp_cmd/example/Signature_LOGO.png
    .png
  • pdfstamp_cmd/example/align-multiple-text-lines.bat
  • pdfstamp_cmd/example/annot.ini
  • pdfstamp_cmd/example/annotstamp.bat
  • pdfstamp_cmd/example/barcode.png
    .png
    • http://www.verypdf.com/app/barcode/

  • pdfstamp_cmd/example/bates-numbers.bat
  • pdfstamp_cmd/example/bold-text.bat
  • pdfstamp_cmd/example/cimage.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • pdfstamp_cmd/example/cximagecrt.dll
    .dll windows:4 windows x86 arch:x86

    a0a17d7739a8f18ddb2ae390e04996df


    Headers

    Imports

    Exports

    Sections

  • pdfstamp_cmd/example/dynamic_text.pdf
    .pdf
  • pdfstamp_cmd/example/embed-font-test.bat
  • pdfstamp_cmd/example/encryption.bat
  • pdfstamp_cmd/example/encryption2.bat
  • pdfstamp_cmd/example/example.pdf
    .pdf
  • pdfstamp_cmd/example/examples.bat
  • pdfstamp_cmd/example/logo.jpg
    .jpg
  • pdfstamp_cmd/example/newlayer.bat
  • pdfstamp_cmd/example/opatity.bat
  • pdfstamp_cmd/example/openlink.txt
  • pdfstamp_cmd/example/pdflayerdll.dll
    .dll windows:4 windows x86 arch:x86

    8f2de9e41d42055275253935562da300


    Headers

    Imports

    Exports

    Sections

  • pdfstamp_cmd/example/pdfsdk.dll
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • pdfstamp_cmd/example/pdfstamp.exe
    .exe windows:4 windows x86 arch:x86

    205c7e6e242b47d170e8471e51fce4b5


    Headers

    Imports

    Exports

    Sections

  • pdfstamp_cmd/example/pdftest.pdf
    .pdf
  • pdfstamp_cmd/example/pdftoolsdk.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • pdfstamp_cmd/example/reg.bat
  • pdfstamp_cmd/example/repairpdf.bat
  • pdfstamp_cmd/example/stamp-barcode.bat
  • pdfstamp_cmd/example/stamp-line.bat
  • pdfstamp_cmd/example/stamp-rect.bat
  • pdfstamp_cmd/example/stamp-text-background.bat
  • pdfstamp_cmd/example/stamp-text-from-last-page.bat
  • pdfstamp_cmd/example/stamp-text-pagerange.bat
  • pdfstamp_cmd/example/stamper1.jpg
    .jpg
  • pdfstamp_cmd/example/stamper2.jpg
    .jpg
  • pdfstamp_cmd/example/test-dynamic-watermark.bat
  • pdfstamp_cmd/example/test-hollow-out-txt.bat
  • pdfstamp_cmd/example/test-invoice-134411_stamp.pdf
    .pdf
  • pdfstamp_cmd/example/test-newlayer.bat
  • pdfstamp_cmd/example/test-overlay-image-invoice.bat
  • pdfstamp_cmd/example/test-rotate-unicode.bat
  • pdfstamp_cmd/example/test-stamp-filename.bat
  • pdfstamp_cmd/example/test-unicode-thai-language.bat
  • pdfstamp_cmd/example/test-unicode.bat
  • pdfstamp_cmd/example/test-unicode2.bat
  • pdfstamp_cmd/example/test-unicode3.bat
  • pdfstamp_cmd/example/test_1.pdf
    .pdf
  • pdfstamp_cmd/example/test_page.pdf
    .pdf
  • pdfstamp_cmd/example/test_stamp_barcode.pdf
    .pdf
  • pdfstamp_cmd/example/testseal.png
    .png
  • pdfstamp_cmd/example/transparent-image.bat
  • pdfstamp_cmd/example/transparent-opacity-image.bat
  • pdfstamp_cmd/example/undo.bat
  • pdfstamp_cmd/pdfstamp_manual_cmd.pdf
    .pdf
  • pdfstamp_cmd/readme.txt