Static task
static1
Behavioral task
behavioral1
Sample
RBIDFTCRADVICE_21012814480386259994,pdf.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_968217dc7ec661ccf8ed591f1e45815502ef082b4c16eb6da0daa4f24698a0e3
-
Size
695KB
-
MD5
26e868a0ae0a0af38d9e9baf73d05dbe
-
SHA1
f9121720fd1492e073377cf92665ba30e48f7d79
-
SHA256
968217dc7ec661ccf8ed591f1e45815502ef082b4c16eb6da0daa4f24698a0e3
-
SHA512
a1c5d359ecd3647f596f80d885e2c5935bba2873204b0df99d3beb4360385ce14461863fa257cfb9bdaf6c7e58150fdd6251c1a530bbe5f37e1eb833ee3e3921
-
SSDEEP
12288:H4LHMe56fGzO8VyuGpk+HHSwEMzix6VAJYosAqVc9ldCOoklH77:YLgGzZyTpkSHnz+3JYNOpf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/RBIDFTCRADVICE_21012814480386259994,pdf.exe
Files
-
JaffaCakes118_968217dc7ec661ccf8ed591f1e45815502ef082b4c16eb6da0daa4f24698a0e3.zip
Password: infected
-
e3736281b703529987575ad16c8e8fedea77eda432a5cd65519ff7e3a274fe1c.iso
-
out.iso.iso
-
RBIDFTCRADVICE_21012814480386259994,pdf.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 697KB - Virtual size: 696KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 363KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ