0bd03f34680481827bd0ad2f06d5302986de08ed43789184c5708170d3ba252c | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 23:06

Sharing

Report Analysis Logs

General

Target

2966420537915NIKG.pdf
Size

26KB
MD5

1948f5d42aa4699d9fa5cf614e59fb11
SHA1

f496c9d2589f9a4c2c3b68a012e7ff56d1efc0ed
SHA256

0bd03f34680481827bd0ad2f06d5302986de08ed43789184c5708170d3ba252c
SHA512

bd1d39541fc05065693de7cd2ccd768c660526891ee92efe3764a8bc55398fb9937a2a6e46b034257be1bd053d2289cac908d8595e9ea2418392d75bb92907c5
SSDEEP

768:YFqHSD8HSZprkfr5i4ACr/qdzE5hWf7auYd+:9HSZp8dgKGzQh6++

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2196	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2196	AcroRd32.exe
2196	AcroRd32.exe
2196	AcroRd32.exe
2196	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2966420537915NIKG.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0ad02715497022a6b68b3ca2086879c3

SHA1
13ca53f08cb08c3f76b091984273eccb48d910fe

SHA256
10a07574f67f3a1a3f9b52e89cade386ab1de4d7f81e8d4e8110bbc4e7f6bdb0

SHA512
9237d937e3c14f76f14dadd02bb951064db44d0d9cb38e13b57545afe4d1bc29e244c6fae8fdc63bef2b3c525aae08921dbd96540ac5dbdf2a551da49c090169

Download Submit