Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/03/2025, 08:35
Behavioral task
behavioral1
Sample
JaffaCakes118_7edc3a61918c22029e7aed2cd8042580.pdf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7edc3a61918c22029e7aed2cd8042580.pdf
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_7edc3a61918c22029e7aed2cd8042580.pdf
-
Size
19KB
-
MD5
7edc3a61918c22029e7aed2cd8042580
-
SHA1
6bc94299e5905a6c94b9381df5bcca9019809bed
-
SHA256
71a38412d456c68f1d299b6d51a8b47d7703887d7a0a200067f77c07a14d5a83
-
SHA512
630a1b75aec8de7c3f20fcc49e3912c08808696b4b5fc36f19be50f02965e57990a34128ae4b4f2af4419b6b3e2b10d8783db378cb9a99ff86e62181024b89a3
-
SSDEEP
384:aW72sMUlD9u7etwy7fgZq/aZPnowpjpyG:a0MULuKtNLgZjZv/cG
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1996 AcroRd32.exe 1996 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7edc3a61918c22029e7aed2cd8042580.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1996