b2ebeb1311e7944fa1da71a1ca0699fbe60b107d1147543e0e912ea3288240f1 | Triage

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/08/2023, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f.hahn.pdf
Size

282KB
MD5

746eb2ed40698bb454d106f2a8ce9218
SHA1

33c7b7c655acb001bd399b4d0d251eccd1f6026a
SHA256

b2ebeb1311e7944fa1da71a1ca0699fbe60b107d1147543e0e912ea3288240f1
SHA512

a0d8262d46d3b73b351f5129aa48b044002ea3b43bed08f5c7e1f930478363b67a3ce420e360c48b17d9761168e033c33d610d6dda88e30320a8d65e13b4615c
SSDEEP

6144:6cK4hQQ2+5Ao23jz7js3TwHvI+HoJr+U7ETLDe+8CI:PKOQw5ATz7w3TwHvpHoJrzETLDepH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f.hahn.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
daecc23057155e584e1e37cb8e1172d0

SHA1
be9b4c724fed23eb9b392670a59ea4eed489849f

SHA256
b26cdd65caac50e89478c8ae783e3c154e42b7ebc5fa613d21a0e58089dd8903

SHA512
e0409c54809f01a9f2e67372242f21d2d5d30539fa889a87d4e67eb66783af190310123f78202b105f2e3d5150b96be422c9f75f2a9dcbbcffbe37b9337eeefc

Download Submit