4e9973142d6ee089c61830fd18e779c3385c1a41c6799df1888202a61e65a5c4 | Triage

Resubmissions

13/06/2023, 19:03

230613-xqrktsag94 1

13/06/2023, 18:15

230613-wvzxbsad7z 1

Analysis

max time kernel
122s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 18:15

Sharing

Report Analysis Logs

General

Target

DCJAMLIBZIWJFNT185.pdf
Size

60KB
MD5

024f777c971d77eb1af37e6891752579
SHA1

114f9a34cab92cc3bc7a0f65d777d671221aeb02
SHA256

4e9973142d6ee089c61830fd18e779c3385c1a41c6799df1888202a61e65a5c4
SHA512

813fe1eb28d81c2d14127bcbba19b6f4bbafd8efa8a5326eef5d5b34905cd079669fe588d942b1310dd4b00a1b0f19b8abf56a150e6d4ccc99ed82f14810f0e3
SSDEEP

1536:TZH3x/HM9Zy/t0rVndSMrioIK0QOcubpBoSQkf:TZBWy/tKnTLubfRQkf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1676	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1676	AcroRd32.exe
1676	AcroRd32.exe
1676	AcroRd32.exe
1676	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DCJAMLIBZIWJFNT185.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3d066ac631833a78a0d36928f8c20a15

SHA1
5a13391c90e5ddd2b52b02d922ba232024101857

SHA256
ba8a5269decb9ba193d958c2feaab986406c834cfeb67063277c65d8e1b4022d

SHA512
f98c875d8148371f6a377bc9e38b247600c7bb41e677053b3661f64b2bf86122475bbcc885efdd5198638b2e474301d9ed967bfa1a1a82688e045d8ba4c0ac8e

Download Submit