9f9830b327129be3a76a8bf2a52751b2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
9f9830b327129be3a76a8bf2a52751b2_JaffaCakes118
Size 1.5MB
Sample240611-1ct1kssela
SHA256 d638b9ea520414179ed76fedf991cc4b44518a9868c239b1b9aa7442859ece94
MD5 9f9830b327129be3a76a8bf2a52751b2
SHA1 c213dfb5ae35730a547d506e2681d891a4ca0206
SHA512 f71783a46b434aa39f80d229c1dac4f7b1c400eb09c70ba89403c4b7f34f63a51a7ba3c90f726b95e1079d66e7bb478afc873583fdc18eba8f3153277b78f5e2
SSDEEP 49152:ssu23OnU+xzXReYh7Gch6mE0RlRYXlNPI+3hzr:vRkAuEslRelNA+xn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/000-594.exe

File Explorer

9f9830b327129be3a76a8bf2a52751b2_JaffaCakes118

.zip 1.5MB
000-594.exe

.exe 1.4MB
000-594.pdf

.pdf 140KB

9f9830b327129be3a76a8bf2a52751b2_JaffaCakes118

SHA256 d638b9ea520414179ed76fedf991cc4b44518a9868c239b1b9aa7442859ece94
MD5 9f9830b327129be3a76a8bf2a52751b2
SHA1 c213dfb5ae35730a547d506e2681d891a4ca0206
SHA512 f71783a46b434aa39f80d229c1dac4f7b1c400eb09c70ba89403c4b7f34f63a51a7ba3c90f726b95e1079d66e7bb478afc873583fdc18eba8f3153277b78f5e2
SSDEEP 49152:ssu23OnU+xzXReYh7Gch6mE0RlRYXlNPI+3hzr:vRkAuEslRelNA+xn
MD5 SHA1 SHA512 SSDEEP

000-594.exe

SHA256 b9bac6422d23fab33c90442c35f769d0c95657ddfbd5eb7cf5d82f7fd7c2e3c0
MD5 d4dc46e8cb40f77c0aeafc37a1672d16
SHA1 5600c08e98c872d97757d6c175efa5ae4d3a0d43
SHA512 7ff499e0a961da6ad6ecbe58b263d94b27e79a75e9ebb27bad5b9cdd7c9ffdfd473048b7292cb65cb2cfa90298c89b4a4354d473b75f4142c3cbf8bebd7fca73
SSDEEP 24576:3PcJOnC9vox9XRH6YFcfnteJN+QhbW7wEaRxtRfqBzXl5o+XlcSrIGsxxAqxI9wG:/cJOnoox9XRaYbj+Qh60EaRPRwXlBHI2
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37476

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

584B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

9f9830b327129be3a76a8bf2a52751b2_JaffaCakes118

000-594.exe

generic

000-594.pdf

Extracted URLs