Overview

overview

10

Static

static

10

53373bad4e...27.pdf

windows7-x64

10

53373bad4e...27.pdf

windows10-2004-x64

3

584.exe

windows7-x64

10

584.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9bc5d6c3ffd6586036ed34e35a7f32e9c4b71d4d05d9b0d645ea792cb0257dea

  • Size

    229KB

  • MD5

    07ebe02c18d2be30e888c2cbce9160fd

  • SHA1

    fb45e6171bf3fdd12232d8b95afbebc5e9f5077e

  • SHA256

    9bc5d6c3ffd6586036ed34e35a7f32e9c4b71d4d05d9b0d645ea792cb0257dea

  • SHA512

    8a892f6b6a10f1b5847bf520e1b1ac4ee2250e14f8f075662f07005a286052a61d51a663026628d03e8be503a1369adb329bf93d92dd8b7ccdcf7fbb3813eba8

  • SSDEEP

    6144:Cn0E4onzlcaDOBwd+6O72R/bgaXCnxgMXtyf:C0AZca146O72gWig+O

Score
10/10
pdfjavascriptmetasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.10.70:4444

Signatures

  • Metasploit family
    metasploit
  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

    pdfjavascript
  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

    pdf
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_9bc5d6c3ffd6586036ed34e35a7f32e9c4b71d4d05d9b0d645ea792cb0257dea
    .zip

    Password: infected

  • 53373bad4e9ebce6d133cf2f08bce78a523bb2faf40840d7d3a7c0fe24dec027
    .pdf
  • 584.pdf
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections