Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 18:54
Behavioral task
behavioral1
Sample
25e0a73e1dea5a901f2a26e4d726daf0_JaffaCakes118.pdf
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
25e0a73e1dea5a901f2a26e4d726daf0_JaffaCakes118.pdf
Resource
win10v2004-20240508-en
7 signatures
150 seconds
General
-
Target
25e0a73e1dea5a901f2a26e4d726daf0_JaffaCakes118.pdf
-
Size
36KB
-
MD5
25e0a73e1dea5a901f2a26e4d726daf0
-
SHA1
cdfd968e04bc3508047d9fefcc9e1bcedd847922
-
SHA256
ea15e727cef3b6d1bf047b0a555b2ac114a49807adb7439dab8602702dafd676
-
SHA512
b12394a9503c2083bfd720b311f4c7e32c7fce55d46b5796d7f8ddc38dfa34a5d74aa204b40aece8cc0cd84ba1eabeeda21ee07ec121e662e2a9adbfb7bfb7c9
-
SSDEEP
768:rb/uYX7dF/qpAA0qzkSeXYhTOFvxr9iSgUhQmQkQTHsVGYOaF:P/qp5+YyDjRbE2V
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2328 2456 WerFault.exe 27 -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2456 AcroRd32.exe 2456 AcroRd32.exe 2456 AcroRd32.exe 2456 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2328 2456 AcroRd32.exe 28 PID 2456 wrote to memory of 2328 2456 AcroRd32.exe 28 PID 2456 wrote to memory of 2328 2456 AcroRd32.exe 28 PID 2456 wrote to memory of 2328 2456 AcroRd32.exe 28
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\25e0a73e1dea5a901f2a26e4d726daf0_JaffaCakes118.pdf"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 8122⤵
- Program crash
PID:2328
-