Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 17:53
Behavioral task
behavioral1
Sample
f403163ae9c9c1f5cfa57d1aa1fe3ffc_JaffaCakes118.pdf
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
f403163ae9c9c1f5cfa57d1aa1fe3ffc_JaffaCakes118.pdf
Resource
win10v2004-20240412-en
General
-
Target
f403163ae9c9c1f5cfa57d1aa1fe3ffc_JaffaCakes118.pdf
-
Size
90KB
-
MD5
f403163ae9c9c1f5cfa57d1aa1fe3ffc
-
SHA1
34317be01a9f5ec724b29d3fdf4953fddcf36a6d
-
SHA256
489c575ad2d183616ec454d6ccd032e74938a955d4d4d28757ab18cee8ae7d6b
-
SHA512
29e8482777bf6da5c80d649c5a82b91e2a146b93dfc4d2cf11706d94a70f4dc0106ea0abe11859852929e0eac0112faba3f8303d644dbf0a8d431c25a6db8a54
-
SSDEEP
1536:wxqlVGyhcDNJCubB3wUdDPghF51BEoHl0gPn5JvoStW6RsYurxBVjWSFOgiqAWQm:S6sjCQ3wYDYhF5VF0gPDwStPsYurRJIe
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 804 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 804 AcroRd32.exe 804 AcroRd32.exe 804 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f403163ae9c9c1f5cfa57d1aa1fe3ffc_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:804
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5bad9a2a0bea898602ab931e158efe59a
SHA113e7f0795f2c986e32106a7a3c991c7e588fe8e2
SHA25653d875f11efe4954c3e751ef9bb4ee347389520ed3475a8bbcd23358b61cea11
SHA5122d05c6a1fe13a909833b166a2673a974a3def157c21100771329cb3097b25753ce403d4bbd2075c03db60ca90c2e4dac971f7c444fd98c6f37c9dd32ad1e696a