Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13/03/2025, 20:01
Behavioral task
behavioral1
Sample
JaffaCakes118_71f1bed7e4ec5905f96a06822d34968d.pdf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_71f1bed7e4ec5905f96a06822d34968d.pdf
Resource
win10v2004-20250313-en
General
-
Target
JaffaCakes118_71f1bed7e4ec5905f96a06822d34968d.pdf
-
Size
7KB
-
MD5
71f1bed7e4ec5905f96a06822d34968d
-
SHA1
670f5d1eced7683b8603503d7cb005932622bac0
-
SHA256
922cd02654c83c09ce1221e622a998dfa800ff8b6c0dd060598e56bfae0b37a9
-
SHA512
07632505a4e923f850ef2728721415f257e0b0f9dd99d396a0f14187ae92fa31c6a5674c43afffe9d44a56f6ef8503164f587268a52b4b954e6ff10c9c97265e
-
SSDEEP
192:6B7Lv/Ik5obtLHAh0sU8WFJZSSxBgYkOc8uscIiuaMFm13b1:61nIhbi0sU8WPTgDOc8uVWah9Z
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2136 AcroRd32.exe 2136 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_71f1bed7e4ec5905f96a06822d34968d.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2136