f4c2ccc568af209315ccc9165bcced563a69a01ad1470fd8bc60f66d595f28e9 | Triage

Analysis

max time kernel
153s
max time network
122s
platform
windows7_x64
resource
win7-en-20211014
submitted
01-11-2021 19:18

Sharing

Report Analysis Logs

General

Target

open and click 0255194p 0*33464*2p 505*50p 626950*69p 8487p *468p 245257*018p 29124*5999p 8590p 8*00.pdf
Size

130KB
MD5

fa08160a46da19c54d3130a13a25654f
SHA1

9f5865a1335f088b09a7292bd8e704c5d8d6da14
SHA256

f4c2ccc568af209315ccc9165bcced563a69a01ad1470fd8bc60f66d595f28e9
SHA512

92f3ea87b31e12a371be78326df84c04bfcdb998057acfad2a7f14f87c437fcbb2ce183a702c77bd31edf358c32a96b739922277a6063cf63148bff7682b1ef7

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1668 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1668 AcroRd32.exe
1668 AcroRd32.exe
1668 AcroRd32.exe
1668 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\open and click 0255194p 0_33464_2p 505_50p 626950_69p 8487p _468p 245257_018p 29124_5999p 8590p 8_00.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1668

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-55-0x0000000075901000-0x0000000075903000-memory.dmp

Filesize
8KB

Download