Overview
overview
5Static
static
5rmrb1971-0...01.pdf
windows7-x64
3rmrb1971-0...01.pdf
windows10-2004-x64
3rmrb1971-0...02.pdf
windows7-x64
3rmrb1971-0...02.pdf
windows10-2004-x64
3rmrb1971-0...03.pdf
windows7-x64
3rmrb1971-0...03.pdf
windows10-2004-x64
3rmrb1971-0...04.pdf
windows7-x64
3rmrb1971-0...04.pdf
windows10-2004-x64
3rmrb1971-0...05.pdf
windows7-x64
3rmrb1971-0...05.pdf
windows10-2004-x64
3rmrb1971-0...06.pdf
windows7-x64
3rmrb1971-0...06.pdf
windows10-2004-x64
3rmrb1971-0...07.pdf
windows7-x64
3rmrb1971-0...07.pdf
windows10-2004-x64
3rmrb1971-0...08.pdf
windows7-x64
3rmrb1971-0...08.pdf
windows10-2004-x64
3rmrb1971-0...09.pdf
windows7-x64
3rmrb1971-0...09.pdf
windows10-2004-x64
3rmrb1971-0...10.pdf
windows7-x64
3rmrb1971-0...10.pdf
windows10-2004-x64
3rmrb1971-0...11.pdf
windows7-x64
3rmrb1971-0...11.pdf
windows10-2004-x64
3rmrb1971-0...12.pdf
windows7-x64
3rmrb1971-0...12.pdf
windows10-2004-x64
3rmrb1971-0...13.pdf
windows7-x64
3rmrb1971-0...13.pdf
windows10-2004-x64
3rmrb1971-0...14.pdf
windows7-x64
3rmrb1971-0...14.pdf
windows10-2004-x64
3rmrb1971-0...15.pdf
windows7-x64
3rmrb1971-0...15.pdf
windows10-2004-x64
3rmrb1971-0...16.pdf
windows7-x64
3rmrb1971-0...16.pdf
windows10-2004-x64
3Behavioral task
behavioral1
Sample
rmrb1971-08/19710801.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
rmrb1971-08/19710801.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
rmrb1971-08/19710802.pdf
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
rmrb1971-08/19710802.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
rmrb1971-08/19710803.pdf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
rmrb1971-08/19710803.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
rmrb1971-08/19710804.pdf
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
rmrb1971-08/19710804.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
rmrb1971-08/19710805.pdf
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
rmrb1971-08/19710805.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
rmrb1971-08/19710806.pdf
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
rmrb1971-08/19710806.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
rmrb1971-08/19710807.pdf
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
rmrb1971-08/19710807.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
rmrb1971-08/19710808.pdf
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
rmrb1971-08/19710808.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
rmrb1971-08/19710809.pdf
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
rmrb1971-08/19710809.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
rmrb1971-08/19710810.pdf
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
rmrb1971-08/19710810.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
rmrb1971-08/19710811.pdf
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
rmrb1971-08/19710811.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
rmrb1971-08/19710812.pdf
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
rmrb1971-08/19710812.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
rmrb1971-08/19710813.pdf
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
rmrb1971-08/19710813.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
rmrb1971-08/19710814.pdf
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
rmrb1971-08/19710814.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
rmrb1971-08/19710815.pdf
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
rmrb1971-08/19710815.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
rmrb1971-08/19710816.pdf
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
rmrb1971-08/19710816.pdf
Resource
win10v2004-20241007-en
General
-
Target
30270eadc929b35e86cb81322dc84f9e_JaffaCakes118
-
Size
19.9MB
-
MD5
30270eadc929b35e86cb81322dc84f9e
-
SHA1
c73585d5b9d21106877f97964c8f870b174eaf69
-
SHA256
4962f11d65b6dadf16b72d8c3dbfccfee1080b3e84dbd9f6710484d5d1cdbe15
-
SHA512
64c3fca475cf08f2d93b6542b08b3a330b38ca6ded3e72f4f8139ebcb196ff402c63e4bc303ffa06c7085a6d82ca8be759b6199aaad55ed6856b6464675f2935
-
SSDEEP
393216:KsqwdfXuXwqncZSq/RgG6Ox7kR6Y3fDyAqlGAfbexeW3y0pAZ85qZPeL6LTIC49:/fXywqncZp/aBSDCe5bzexKitUle8q
Malware Config
Signatures
-
Malformed data in PDF
A PDF can contain malformed data to evade detection
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/rmrb1971-08/apple.exe
Files
-
30270eadc929b35e86cb81322dc84f9e_JaffaCakes118.zip
-
rmrb1971-08/19710801.pdf.pdf
-
rmrb1971-08/19710802.pdf.pdf
-
rmrb1971-08/19710803.pdf.pdf
-
rmrb1971-08/19710804.pdf.pdf
-
rmrb1971-08/19710805.pdf.pdf
-
rmrb1971-08/19710806.pdf.pdf
-
rmrb1971-08/19710807.pdf.pdf
-
rmrb1971-08/19710808.pdf.pdf
-
rmrb1971-08/19710809.pdf.pdf
-
rmrb1971-08/19710810.pdf.pdf
-
rmrb1971-08/19710811.pdf.pdf
-
rmrb1971-08/19710812.pdf.pdf
-
rmrb1971-08/19710813.pdf.pdf
-
rmrb1971-08/19710814.pdf.pdf
-
rmrb1971-08/19710815.pdf.pdf
-
rmrb1971-08/19710816.pdf.pdf
-
rmrb1971-08/19710817.pdf.pdf
-
rmrb1971-08/19710818.pdf.pdf
-
rmrb1971-08/19710819.pdf.pdf
-
rmrb1971-08/19710820.pdf.pdf
-
rmrb1971-08/19710821.pdf.pdf
-
rmrb1971-08/19710822.pdf.pdf
-
rmrb1971-08/19710823.pdf.pdf
-
rmrb1971-08/19710824.pdf.pdf
-
rmrb1971-08/19710825.pdf.pdf
-
rmrb1971-08/19710826.pdf.pdf
-
rmrb1971-08/19710827.pdf.pdf
-
rmrb1971-08/19710828.pdf.pdf
-
rmrb1971-08/19710829.pdf.pdf
-
rmrb1971-08/19710830.pdf.pdf
-
rmrb1971-08/19710831.pdf.pdf
-
rmrb1971-08/apple.exe.exe .pdf windows:4 windows x86 arch:x86 polyglot
9cc772b9b0e65ed64d1446ffa3b9ee04
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
CopyFileA
ReadFile
CreateFileA
SetFilePointer
WinExec
CloseHandle
GetModuleFileNameA
GetLastError
SetFileAttributesA
GetFileAttributesA
GetVolumeInformationA
GetWindowsDirectoryA
LocalAlloc
lstrcpyA
lstrlenA
GetVersion
Sleep
DeleteFileA
WriteFile
lstrcatA
GetProcAddress
ExitProcess
VirtualAlloc
HeapReAlloc
SetEnvironmentVariableA
CompareStringW
LCMapStringW
LCMapStringA
TerminateProcess
SetEndOfFile
LoadLibraryA
CompareStringA
SetStdHandle
GetStringTypeW
GetModuleHandleA
FlushFileBuffers
GetCurrentProcess
GetFileType
GetOEMCP
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapFree
HeapAlloc
GetStartupInfoA
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
MultiByteToWideChar
SetHandleCount
GetStringTypeA
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetACP
user32
CharLowerA
MessageBoxA
wsprintfA
DdeUninitialize
EnumWindows
GetWindowTextA
DdeInitializeA
DdeFreeStringHandle
DdeDisconnect
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
advapi32
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
SetSecurityDescriptorDacl
RegSetValueExA
RegDeleteValueA
shell32
FindExecutableA
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 1023B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
rmrb1971-08/readme.txt
-
rmrb1971-08/ĶձPDF汾.TXT