ef9dd32878efc192c8868e44ed18be22b9176d52e133c09365618fc039e962f0 | Triage

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-en-20211208
submitted
28-02-2022 10:10

Sharing

Report Analysis Logs

General

Target

CONVOCATION.pdf
Size

249KB
MD5

75bf44aab6ff59b53f714c06fd0b690d
SHA1

94d2a4623008aebdaeba8336670521cbbb075150
SHA256

ef9dd32878efc192c8868e44ed18be22b9176d52e133c09365618fc039e962f0
SHA512

56ec1c727051fa3f8e604046842a767a600ac59654214e9c15313f74445bc6b02306eff1e6bc930c678fe51461f239fad3b019cd19b86b604ac42f9d14156c97

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

624 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

624 AcroRd32.exe
624 AcroRd32.exe
624 AcroRd32.exe
624 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CONVOCATION.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:624

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-54-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download