990bcaf138c29483b5573089b243cc6f4751ccd521148297130e3e36aa70e9f8 | Triage

Analysis

max time kernel
601s
max time network
432s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 14:44

Sharing

Report Analysis Logs

General

Target

读写器API接口开发包/800系列读写器API调用快速入门.pdf
Size

385KB
MD5

3907e1199e564fb4654cc3fe59af6a0b
SHA1

ce2576e00442d43d9904ee54918c66753554ceac
SHA256

1cd3482f82b340ec43491e00cf3a55a2bbf19d60ae0dcac9141b88171d8d6ae0
SHA512

21d6b6dc6c79bd0ef2c064fd5fb68c57ffb97ca3424679b423e7cfaa12107edfe7c9ccd006de9b5dc7fda79b053f887bb2d3a384e8a55c1d850bf217ff7add97
SSDEEP

12288:/6U/5UYXIBHfbLBZ/T34BMXfnyNE3A1gj:zIBHjFZjfy2

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

960 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

960 AcroRd32.exe
960 AcroRd32.exe
960 AcroRd32.exe
960 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\读写器API接口开发包\800系列读写器API调用快速入门.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download