Static task
static1
Behavioral task
behavioral1
Sample
pcl-to-pdf-cmd/pcltopdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
pcl-to-pdf-cmd/pcltopdf.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
pcl-to-pdf-cmd/proc.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
pcl-to-pdf-cmd/proc.exe
Resource
win10v2004-20240802-en
General
-
Target
14759798b039b5ab6c8b2730e78d9398_JaffaCakes118
-
Size
8.5MB
-
MD5
14759798b039b5ab6c8b2730e78d9398
-
SHA1
ef72c85d175b742963bf99b1a8ef9cdd783bf514
-
SHA256
b46a60a9d1990979f83464f546acb6c680e1616ea4fb71c8fedeead8eea4efb0
-
SHA512
d139ca26da7998943d837d9df6e0dbccb68759ebc5a59d7cd661b8cfca0d76c2837cc36cea9c089cfc23879f70a47e9c83fef1d07a8efef69f1bbce6da622fa2
-
SSDEEP
196608:dP5B/R++hGQFoWyG7qbfm7gQS3k0vUhSL1ElvP8oDT4a40RSnkUZ7YN:dr/R+tsQZCgQSzE+ilv0GwnbZM
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/pcl-to-pdf-cmd/pcltopdf.exe unpack001/pcl-to-pdf-cmd/proc.dll
Files
-
14759798b039b5ab6c8b2730e78d9398_JaffaCakes118.zip
-
pcl-to-pdf-cmd/Command line.txt
-
pcl-to-pdf-cmd/pcltopdf.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 960KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 66KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 71KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 298KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
pcl-to-pdf-cmd/proc.dll.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 1.1MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 246KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 299KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE