Overview

overview

10

Static

static

10

fb7c810a66...18.pdf

windows7-x64

3

fb7c810a66...18.pdf

windows10-2004-x64

3

acrobat_8_help.exe

windows7-x64

10

acrobat_8_help.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fb7c810a66be33108f30936fe2c95185_JaffaCakes118

  • Size

    13.8MB

  • MD5

    fb7c810a66be33108f30936fe2c95185

  • SHA1

    2710a0778277d0c233e8d40ffd0becbf25d1622f

  • SHA256

    11ba6a1fc5e95e931669b76b33544cf272b8c802e6a600128e7bfe65e150aba5

  • SHA512

    90be21cd83268a99fcd0337f15004bb1c71fef1caa10a317e6ffb3a32223295096b7a3fdc1f9368007584056fa0c8703848d75fde4f73c598de62ce7817927f3

  • SSDEEP

    196608:OxD+zJC7Q7IfEVk/uCcmulkpdXhn9bDOkhZvaGMr2eIzlUJXp:OV+zJC7QksuDcmulEJDOkhpjMr2eImFp

Score
10/10
pdflinkjavascriptmetasploit

Malware Config

Signatures

  • Metasploit family
    metasploit
  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

    pdfjavascript
  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

    pdf
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • fb7c810a66be33108f30936fe2c95185_JaffaCakes118
    .pdf

    • http://Epilogue.ps

    • http://Prologue.ps

    • http://lynda.com

    • http://myserver.mycompany.com:3703

    • http://www.adobe.com/communities.

    • http://www.adobe.com/designcenter.

    • http://www.adobe.com/go/accessibility

    • http://www.adobe.com/go/accessibility.

    • http://www.adobe.com/go/acr8_digital_editions

    • Show all
  • IComm_Standard.joboptions
  • acrobat_8_help.pdf
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections