f5cf9afaa2944a1318e8b23dbc7685ed12558933879b4c475facb42b3fb540ea | Triage

Analysis

max time kernel
152s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-09-2023 02:23

Sharing

Report Analysis Logs

General

Target

EFT Form 2023.pdf
Size

307KB
MD5

7755ec887f148c5a0943392c810fc477
SHA1

a253e5bd42192f11c4c4dfb0cdc3f903c571ac6c
SHA256

db5565bcf63e257562fe138d6ce2f7505a0e824cb1e161bae66d65c3c9f3a722
SHA512

c7a2ba1d6201af39613fa0d8e133a9b465bd131afa280b9bf98ce90404f541742a52437cc713111a6145fdc6ca2050cf05568cf8054fd1d4f0cd075eb8978ff2
SSDEEP

6144:gSnGUZbsmCx4H6in0+Kdt+oyVhHq2OW+NYDS3PpVf9M:gIGUm4HXnPKdt+oyVh0tYDehVfG

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2160 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2160 AcroRd32.exe
2160 AcroRd32.exe
2160 AcroRd32.exe
2160 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\EFT Form 2023.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6b81516c50578d02b88087f1f3f13980

SHA1
b75daa24c5b49723e590200c1953e32943400e38

SHA256
8b4a6de68d0a52327880111a5182ef329fb5d53fa205e22f39296c337eb92563

SHA512
a585c97b70d8f27eac29eff1dd2cae5c04dc52916ae3fd11ca98ebd0a52f678660a09c0bdb63ead4ed81f1d1476c542be64d4c1095e383c60bd3ae179e004ada

Download Submit