General

  • Target

    5db917d4c7cb23376fb93844764418ee_JaffaCakes118

  • Size

    3.1MB

  • MD5

    5db917d4c7cb23376fb93844764418ee

  • SHA1

    03b02de83993bbaf37608ece9eb0ee5e2308ad3e

  • SHA256

    ff3f944715b6db0920547bda8d052cecb7c3432490e70374f25b0b7ed508259f

  • SHA512

    8f04b57d3adb5e64dc0bfaae403498d9bf7337051259285bec32260730fe86daf59d01598e0fe6f8b11825f6066c9a419ab806d49670c06183e015ef091c17ed

  • SSDEEP

    98304:rS+5rOKR6aR0fYbiQkHf3v6r0MuhBACOlPGUsYKSpuG1sR:rS+tOKRBGYNYSrMBACcPkSpuG6R

Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • 5db917d4c7cb23376fb93844764418ee_JaffaCakes118
    .rar
  • Take Command/BATCH.BCP
  • Take Command/Bchild.dll
    .dll windows:4 windows x86 arch:x86

    8a661d4a226f6827fd580c6703df63f6


    Headers

    Imports

    Exports

    Sections

  • Take Command/Guide.pdf
    .pdf
    • http://jpsoft.com

    • http://jpsoft.com/

    • http://jpsoft.com/.

    • http://jpsoft.com/supplans.htm.

  • Take Command/Language.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • Take Command/ShrAlias.exe
    .exe windows:4 windows x86 arch:x86

    8991f343afc53efd6085d2e1a64080a6


    Headers

    Imports

    Sections

  • Take Command/TCMD32.INI
  • Take Command/TakeCmd.dll
    .dll windows:4 windows x86 arch:x86

    3e15ad9a23aeaffd554b1026edb64c82


    Headers

    Imports

    Exports

    Sections

  • Take Command/examples.btm
    .vbs
  • Take Command/ipworks6.dll
    .dll windows:4 windows x86 arch:x86

    4e2e9ea9982dce432dbcdfd9db5699a2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Take Command/ipwssl6.dll
    .dll windows:4 windows x86 arch:x86

    0a0530382770914b6cfab3f52f273ecc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Take Command/jphelp.chm
    .chm
  • Take Command/onig.dll
    .dll windows:4 windows x86 arch:x86

    31ddbd6927e0867c7be1b7d9a854808a


    Headers

    Imports

    Exports

    Sections

  • Take Command/readme.txt
  • Take Command/tcmd.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Take Command/tcstub.exe
    .exe windows:4 windows x86 arch:x86

    e8725384369d7196aad39b0039c45d45


    Headers

    Imports

    Sections

  • Take Command/unreg.exe
    .exe windows:4 windows x86 arch:x86

    527134952303588979d03b87030d4edf


    Headers

    Imports

    Sections

  • Take Command/下载说明.htm
    .html .js polyglot
  • Take Command/安装说明.txt
  • Take Command/非常世纪资源网.url
    .url