Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/03/2025, 12:02
Behavioral task
behavioral1
Sample
JaffaCakes118_6aed723909e7dfe255c753643353ec59.pdf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6aed723909e7dfe255c753643353ec59.pdf
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_6aed723909e7dfe255c753643353ec59.pdf
-
Size
13KB
-
MD5
6aed723909e7dfe255c753643353ec59
-
SHA1
5a3d95e3e5bb1bf712a23d0b5c59267f0a883ae5
-
SHA256
a7c63df04e9d5c911c36834f5651650908820eb1cf273f89c32b3e344a133ffb
-
SHA512
bffe155d0211c736ac0d3a49a506047ff52832dd495e9aa0918376e6fd5348009e4f50fbb5e5f442d571ae32aa5766be27f5d435dadf215f690a7567805a2e3d
-
SSDEEP
384:6Q8uJt2g+vgKQsXQHvG3odtZVl3cl4a4xjcq5LH6QAYcVSURlT:6oJt2gMaPG4dtR9PjfLH6QAYURN
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2596 AcroRd32.exe 2596 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6aed723909e7dfe255c753643353ec59.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2596