Analysis
-
max time kernel
266s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-05-2022 13:49
Behavioral task
behavioral1
Sample
Correct Your Spanish Blunders How to Avoid 99 of the Common Mistakes Made by Learners of Spanish (Jean Yates) (z-lib.org).pdf
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Correct Your Spanish Blunders How to Avoid 99 of the Common Mistakes Made by Learners of Spanish (Jean Yates) (z-lib.org).pdf
Resource
win10v2004-20220414-en
General
-
Target
Correct Your Spanish Blunders How to Avoid 99 of the Common Mistakes Made by Learners of Spanish (Jean Yates) (z-lib.org).pdf
-
Size
1.3MB
-
MD5
0ac98d966c7c83052514b0b95bfaf917
-
SHA1
f78bdf03fd50246845b7db51085af9df5c67dd74
-
SHA256
78c72870895db7e07205f66515ace0dd520cb969032df825d98bec2947fb1300
-
SHA512
636eea4e6aab3d5de11ccd717372af3317e1fd99aa4af23af72dee947ec506efcd01effcb5a65cee2176c1ddf24c8ac3cb75fc2b8a1907f042098ac2d0a0ca06
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1684 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1588 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1588 AUDIODG.EXE Token: 33 1588 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1588 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AcroRd32.exepid process 1684 AcroRd32.exe 1684 AcroRd32.exe 1684 AcroRd32.exe 1684 AcroRd32.exe 1684 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Correct Your Spanish Blunders How to Avoid 99 of the Common Mistakes Made by Learners of Spanish (Jean Yates) (z-lib.org).pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4801⤵
- Suspicious use of AdjustPrivilegeToken