Overview

overview

10

Static

static

10

78769e4085...7e.zip

windows7_x64

1

78769e4085...7e.zip

windows10-2004_x64

malware-an...er.pdf

windows7_x64

1

malware-an...er.pdf

windows10-2004_x64

1

malware-an...is.pdf

windows7_x64

1

malware-an...is.pdf

windows10-2004_x64

1

malware-an...ypt.py

linux_amd64

malware-an...ypt.py

linux_armhf

malware-an...ypt.py

linux_mips

malware-an...ypt.py

linux_mipsel

malware-an...ons.py

windows7_x64

3

malware-an...ons.py

windows10-2004_x64

3

malware-an...is.pdf

windows7_x64

1

malware-an...is.pdf

windows10-2004_x64

malware-an...tt.ps1

windows7_x64

10

malware-an...tt.ps1

windows10-2004_x64

8

malware-an...tt.vbs

windows7_x64

malware-an...tt.vbs

windows10-2004_x64

7

malware-an...er.ps1

windows7_x64

1

malware-an...er.ps1

windows10-2004_x64

malware-an...od.ps1

windows7_x64

malware-an...od.ps1

windows10-2004_x64

10

malware-an...44.exe

windows7_x64

10

malware-an...44.exe

windows10-2004_x64

malware-an...55.dll

windows7_x64

1

malware-an...55.dll

windows10-2004_x64

malware-an...xes.py

linux_amd64

malware-an...xes.py

linux_armhf

malware-an...xes.py

linux_mips

malware-an...xes.py

linux_mipsel

malware-an...dra.py

windows7_x64

malware-an...dra.py

windows10-2004_x64

3

Analysis

  • max time kernel
    149s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 11:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    malware-analysis-writeups-master/ava-maria-rat/AvaMariaAnalysis.pdf

  • Size

    955KB

  • MD5

    8b3cf9450a93b459f1b653b0c061392b

  • SHA1

    318c85b01f14675c56adff4bf8d8fd0e8dd54408

  • SHA256

    c5d46440ef22a1555ba7d344d7d6f420ee7a819800c9dc926c1edf4ae1acc8f4

  • SHA512

    5002abf3884fdb5cf62f44d4cf5831806d71dcd9f47b612fa8d4567c77d492fd2fe4bf6246e8042d12735ec36fc0b798be8f1fec6384f084b6ff35a92ae205a1

Score
1/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\malware-analysis-writeups-master\ava-maria-rat\AvaMariaAnalysis.pdf"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1964-54-0x0000000075401000-0x0000000075403000-memory.dmp
    Filesize

    8KB

    Download