Static task
static1
Behavioral task
behavioral1
Sample
PDFPassword/apdfprp.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PDFPassword/apdfprp.exe
Resource
win10v2004-20240709-en
General
-
Target
3ff76b3a69551f510755ca9f5be88bff_JaffaCakes118
-
Size
330KB
-
MD5
3ff76b3a69551f510755ca9f5be88bff
-
SHA1
a322fba54143d9f7c9a0f54d73000db794f1b31d
-
SHA256
296c3c4ce4e7d4bfc24b335145146d286ad0d20dbd4e5e0cfc74f65cc1671536
-
SHA512
51bdbbc382a92e5badb72d52bedaab5ebdfe4ef9d04d96780c5ae9cd678558015599369e2e7c2d1190005362b2cdc101bfb338af5c792e926ba2c27b8e3ecc73
-
SSDEEP
6144:GyDo2PtzHKNWSDYJKeR6RultdeB1F0A8Y4xmHAo4X2S2XmGtXGchPloRmT+Wl+:tADYJv9tO1FN4xmgnT2Bt/toA6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PDFPassword/apdfprp.exe
Files
-
3ff76b3a69551f510755ca9f5be88bff_JaffaCakes118.rar
-
PDFPassword/all_printable.chr
-
PDFPassword/apdfprp.cnt
-
PDFPassword/apdfprp.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 259KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 89KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ubonga Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mackt Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
PDFPassword/apdfprp.hlp
-
PDFPassword/apdfprp.log
-
PDFPassword/caps.chr
-
PDFPassword/digits.chr