Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
01/05/2024, 05:43
Behavioral task
behavioral1
Sample
0b2ebcf60a790cc84d20ac80a6d22f18_JaffaCakes118.pdf
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b2ebcf60a790cc84d20ac80a6d22f18_JaffaCakes118.pdf
Resource
win10v2004-20240419-en
5 signatures
150 seconds
General
- Target 0b2ebcf60a790cc84d20ac80a6d22f18_JaffaCakes118.pdf
- Size 10KB
- Sample240501-get9kshd3x
- SHA256 6b41d65b789cf4f8fba9e66f8c4b08933775153a06b1cc2d15b6ffc3c1ce816d
- MD5 0b2ebcf60a790cc84d20ac80a6d22f18
- SHA1 5d0851531fa4010d4c96c0e7f230cc9a148442ad
- SHA512 13e2791c44dab7d0781e49cb40a7278692253ff80d651e798049d6b6811df1bdd42c3d5cbae049c4d4637d98bee454af37b72c24b8730d198c4ec989593184fa
- SSDEEP 192:oPpTJWZcrrW00tmrBc6pGijtpDZjGtEAiUcZdLyjIbMYcDuj/CG:oBTJ5rhc6pG6tcGUULyj5tij6G
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2308 AcroRd32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2308 AcroRd32.exe 2308 AcroRd32.exe 2308 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0b2ebcf60a790cc84d20ac80a6d22f18_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2308
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
- Size 3KB
- SHA256 75d4bf158aaf5d1c91355ef968d83d8b3cf6a49ef71bfa9a0a90ae5f32b223b7
- MD5 1cc940d873f90cb6b9c5fb272c7fe917
- SHA1 5381ce9e1c239e4a45de416c5f6a9fc3f0cff971
- SHA512 54d99d2f8b83875cb851b06651ff99a3b15df77b0a3bf6ac79879d93d4d48e22ca2c5db6afbcaaa7c65529e1b7e0dacba62cda289acc67ba0501046e1f5a446d
- MD5 SHA1 SHA512