Malware Analysis Report

2024-07-28 06:34

Sample ID 240517-h7ym5sff29
Target 4ef45d2a25f84c0534f2518debdcc008_JaffaCakes118
SHA256 785e3b5fa58941c0d42fd96b647afc8d1330d23dc0bfbc05a4e2416322299a6f
Tags
pdf javascript
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

785e3b5fa58941c0d42fd96b647afc8d1330d23dc0bfbc05a4e2416322299a6f

Threat Level: Shows suspicious behavior

The file 4ef45d2a25f84c0534f2518debdcc008_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

pdf javascript

PDF contains JavaScript

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-17 07:23

Signatures

PDF contains JavaScript

pdf javascript

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 07:23

Reported

2024-05-17 07:25

Platform

win7-20240220-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4ef45d2a25f84c0534f2518debdcc008_JaffaCakes118.pdf"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4ef45d2a25f84c0534f2518debdcc008_JaffaCakes118.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 1135b589d04460d9d6ea0cc874e241ac
SHA1 d92cef2d92863f1d6e853ab97ce32d1f6a7916e9
SHA256 3003b77b239efa5573b313b8326f6d8f3393d11780f13ca51cb1bec6858451ad
SHA512 c24c7b31c7bcbca505e09898f890b4025ed3d98b8e13e048348552472a75a31be7db6ec433b30c648a4ab9e708546c6b773f4ed1ae1ff769f614307e0937c6e4

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-17 07:23

Reported

2024-05-17 07:23

Platform

win10v2004-20240426-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A