8cbcf688d8cf2be8cfcdb397569fc979c8ac591b7a8d0056e897093ef069ffc6 | Triage

Resubmissions

15/08/2023, 18:42

230815-xcjytsda27 3

15/08/2023, 18:09

230815-wrmgtscg74 3

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/08/2023, 18:09

Sharing

Report Analysis Logs

General

Target

whirlpool/D/Whirlpool-ip-statement.pdf
Size

31KB
MD5

b19d16a7aa924f28bfe54b423af2c469
SHA1

262b222467cafb36b3f484d7ca5112f80f3852cb
SHA256

b25510752b658246fe2afa2779bb2a44e58a1635d82800c5d4e1d96adf1347d1
SHA512

69ba88b193f2a67bec3812525fe316da0e10b2552995f7380c1afbdc83d6de3097b63a739b641d9e9f80390bfa28ab76f96f5c163f122a7599a0682649e1e988
SSDEEP

768:bnvF74nE4KqErNNT2K504qZJf4lv4QplD7:rt74El0eSZJgl

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2160	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2160	AcroRd32.exe
2160	AcroRd32.exe
2160	AcroRd32.exe
2160	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\whirlpool\D\Whirlpool-ip-statement.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e70c4152e68de77d48784855bc711db4

SHA1
1f0622a80617ec6982fbbfa1f790d45b6bd84f5d

SHA256
2f2607a3241da970523ad09dd5f3e968dd2ef18c35a76fd131e7ca01a1080a22

SHA512
01461e8625a9df19a0af0e778d4829d24c27bc1e7dad1d4cee1a6dd32f57d84c88319f36559132335041035d98a38c83c92084d1f4d6f320741989b433748f16

Download Submit