Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 08:09
Behavioral task
behavioral1
Sample
5fb11a3e5c3159f1f1f874369ca8d6cc_JaffaCakes118.pdf
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5fb11a3e5c3159f1f1f874369ca8d6cc_JaffaCakes118.pdf
Resource
win10v2004-20240709-en
6 signatures
150 seconds
General
-
Target
5fb11a3e5c3159f1f1f874369ca8d6cc_JaffaCakes118.pdf
-
Size
132KB
-
MD5
5fb11a3e5c3159f1f1f874369ca8d6cc
-
SHA1
4856b786810a8f529826ddc4dd3d19ed05ce4cb2
-
SHA256
2f7c40836d06837ca895e5f52c187fd40a55eb8e1c82b89eb9a90d9515aa4302
-
SHA512
8e3f1d8e2f17a16b08a1bf0154ad880d01f320fc1a36c817aeb47499f9b80c243b25442ace2ec9a41b18b237888adfc41c17c2ab004b200a09922dfaac71b07b
-
SSDEEP
768:He7JyiY9l83yPYb+Svnv7lf6EzPXfRbMvDgfVoIBXvhPKBDZfHmKcuPr38TQr4uL:L
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2052 2564 WerFault.exe 30 -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2564 AcroRd32.exe 2564 AcroRd32.exe 2564 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2052 2564 AcroRd32.exe 31 PID 2564 wrote to memory of 2052 2564 AcroRd32.exe 31 PID 2564 wrote to memory of 2052 2564 AcroRd32.exe 31 PID 2564 wrote to memory of 2052 2564 AcroRd32.exe 31
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5fb11a3e5c3159f1f1f874369ca8d6cc_JaffaCakes118.pdf"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 7522⤵
- Program crash
PID:2052
-