63061642aed1982c2c0a0a4d850e30cd3b126c7bac21a0630625633a92997107 | Triage

Resubmissions

06-12-2021 09:37

211206-llql7adfhq 3

06-12-2021 09:34

211206-lj5nbsdfhn 3

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211104
submitted
06-12-2021 09:37

Sharing

Report Analysis Logs

General

Target

GSA_Africa_SponsorshipDeck.pdf
Size

2.2MB
MD5

40fd4d9d261bbc84edfdcccddb5157e4
SHA1

1c60c7587d4c7b682b27c3a306cf48a0e477c5e7
SHA256

63061642aed1982c2c0a0a4d850e30cd3b126c7bac21a0630625633a92997107
SHA512

400b84de62b81a5bb9f7e19993580e88af456ee4cde62e9763df87349f92a4cf8419cca2f7b51ffc8a3b10504771bbbe21007db38925ca1dfec8cb6e003cffc2

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

368 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

368 AcroRd32.exe
368 AcroRd32.exe
368 AcroRd32.exe
368 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GSA_Africa_SponsorshipDeck.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:368

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-55-0x0000000075851000-0x0000000075853000-memory.dmp

Filesize
8KB

Download