Overview

overview

10

Static

static

10

JaffaCakes...f8.pdf

windows7-x64

10

JaffaCakes...f8.pdf

windows10-2004-x64

3

cs_sb.exe

windows7-x64

10

cs_sb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_da5c5e3b9cbccb6467f171e3cd5241fa5a42ce54d9b874c2b510cd9a8ddf4ff8

  • Size

    932KB

  • MD5

    3dae7a05120042b75fb4f20925a14489

  • SHA1

    527e8b08d3c49c0c4d6fce4e1f4a55755fcb5c7d

  • SHA256

    da5c5e3b9cbccb6467f171e3cd5241fa5a42ce54d9b874c2b510cd9a8ddf4ff8

  • SHA512

    328bc5bcc861bf42cce9737b9921877b9476a40dabbe75bff55d928ccc2d3c02e4fb78e0eebd78f9155058aff870ce608724aac9e6fbd8cd5f35b0ec6b20b9d8

  • SSDEEP

    24576:t/5xFNDwdEpg0Z6NWUzrjheEZjAowHKaEdx6KTH:5zFND8r0oNWUzrjhmEdxJH

Score
10/10
pdfjavascriptmetasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

35.186.238.101:443

Signatures

  • Metasploit family
    metasploit
  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

    pdfjavascript
  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

    pdf
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_da5c5e3b9cbccb6467f171e3cd5241fa5a42ce54d9b874c2b510cd9a8ddf4ff8
    .pdf
  • cs_sb.pdf
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections