19d156d205df792a4a8c881b2201c561c9f74babc40cdb8ecd7f55d68f3c135b | Triage

Analysis

max time kernel
4294225s
max time network
139s
platform
windows7_x64
resource
win7-20220310-en
submitted
14-04-2022 13:58

Sharing

Report Analysis Logs

General

Target

ExeFilter-1.1.2-alpha3/ExeFilter_documentation_EN.pdf
Size

207KB
MD5

fe79c684e6ccb5bd6df2e5a7f5052430
SHA1

71c174ec1820bf27e445bba1549ad3393b598b3b
SHA256

e58b140277b88c3d0cacc761785a12803d5ff00f0bf389eebd7f189d2c983ff5
SHA512

47954e10c8348b0b0cd3cc4d172e7d0032b2a63f3aa37861987182dafc72abd8c87dd9c6a4a727d10e97aabd66de7f3ba6634cfab51b42821ff0c3c78dd142d2

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1276 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1276 AcroRd32.exe
1276 AcroRd32.exe
1276 AcroRd32.exe
1276 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ExeFilter-1.1.2-alpha3\ExeFilter_documentation_EN.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1276

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-54-0x0000000075691000-0x0000000075693000-memory.dmp

Filesize
8KB

Download