General

  • Target

    0eefa6e0172fd3e5fe656ed1afda14f5_JaffaCakes118

  • Size

    1014KB

  • MD5

    0eefa6e0172fd3e5fe656ed1afda14f5

  • SHA1

    9a9403d71f15e674b3239c22a2c863924da9824f

  • SHA256

    a6265dd1e3e14bd7c3dd23468d76cf6c1d2cf3ce1e458c9da2cfca107a5e64c3

  • SHA512

    083c081ae921e1cb4139bd66945cb7df0c180d6588eff702bdd5c98b9b81a6177d314f652beeb05221b38bc4825bfbf01eb8c1e94db2c86af7f407653214b3a2

  • SSDEEP

    24576:dhv9mcBpsf3AA8f7SLVy5W4MWgYFeYQSVvhyk/Hbb:dmtvpLGWqgqISVZyQHbb

Score
4/10

Malware Config

Signatures

  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 0eefa6e0172fd3e5fe656ed1afda14f5_JaffaCakes118
    .rar
  • Easy unpacking/ODbgScript.dll
    .dll windows:5 windows x86 arch:x86

    9dc65eadff077816f7e7fca07fceda80


    Headers

    Imports

    Exports

    Sections

  • Easy unpacking/OllyDump.dll
    .dll windows:4 windows x86 arch:x86

    5a3ef0fd287f0ec4556b6cfd980bb4f8


    Headers

    Imports

    Exports

    Sections

  • Easy unpacking/PeCompact 2.xx - 3.xx OEP Finder.txt
  • Easy unpacking/Unpack pecompact 2.xx and serial bypass by XOR06.pdf
    .pdf
    • http://www.icopybot.com/plisteditor_setup.exe

    • http://www.icopybot.com/plisteditor_setup.exeen-US

    • http://www.thelegendofrandom.com/forum/index.php

    • http://www.thelegendofrandom.com/forum/index.phpen-US