a4bcf7b04d27ee71cf2e00488f98469ed8bec37171e80e54be60025a74645677 | Triage

Analysis

max time kernel
154s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-09-2022 06:32

Sharing

Report Analysis Logs

General

Target

Release/Pokemon Locations.pdf
Size

1.9MB
MD5

e45ba8d6cef23f455c54a552770c5b95
SHA1

27fe62fbe26273f833ce505d43d53d6160b16268
SHA256

a6e781309a5cd8604ad395cb1556de5a89c2e82559ed5d0402481b4f5c1a3ad7
SHA512

def9df503b87a161bef263cb9f54fddb03bd8e0237652a25ccbf15a769109e763df70351577f02b0970c64dd23317324310f0415bb017ddc79d1c6cb62ddc0b1
SSDEEP

49152:nv1l0YXeWMFJTWrheQa2dJR9BQQk6JMwhzp:n9lxXdMmrNHR8QkKM8l

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1632 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1632 AcroRd32.exe
1632 AcroRd32.exe
1632 AcroRd32.exe
1632 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Release\Pokemon Locations.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1632

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download