Behavioral task
behavioral1
Sample
8d6cbd8839f489c7346b7fd9ea763754_JaffaCakes118.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8d6cbd8839f489c7346b7fd9ea763754_JaffaCakes118.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
CanadaPost_Invoice_Notice_9381747173.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
CanadaPost_Invoice_Notice_9381747173.exe
Resource
win10v2004-20240802-en
General
-
Target
8d6cbd8839f489c7346b7fd9ea763754_JaffaCakes118
-
Size
144KB
-
MD5
8d6cbd8839f489c7346b7fd9ea763754
-
SHA1
379f263b0e5ee5021a507f4c325c1a3bd39397d9
-
SHA256
0a2b4fec63e592b7ed45f09511b571c05117978f767700ed96e83969b8ce12ca
-
SHA512
9fd384ff0c112f3c4665cf40b4b7c259cba36eb5d9df8edc3c1ad3ac7c7a63eb945a03c4ffa01048a56fcdb4958ea1b39bcbd50fee54d8856ab2ff27f92bdb99
-
SSDEEP
3072:ikeO6Wv1pMz90odCSd/Ve0fCsc9ZObJQQwUPwXDyp:ikeJWvzMz96SBcLqJzwUFp
Malware Config
Signatures
-
PDF contains JavaScript
Detects presence of JavaScript in PDF files.
-
PDF contains one or more embedded files
Detects presence of embedded files in PDF files.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CanadaPost_Invoice_Notice_9381747173.pdf
Files
-
8d6cbd8839f489c7346b7fd9ea763754_JaffaCakes118.pdf
-
CanadaPost_Invoice_Notice_9381747173.pdf.exe windows:4 windows x86 arch:x86
03f4a8be09260e7d40f64c88b3ba59cf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
CallWindowProcW
kernel32
GetProcAddress
RtlMoveMemory
msvbvm60
ord696
ord698
MethCallEngine
ord598
ord631
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
ord644
ord100
ord616
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ