f5cf9afaa2944a1318e8b23dbc7685ed12558933879b4c475facb42b3fb540ea | Triage

Analysis

max time kernel
300s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-09-2023 02:26

Sharing

Report Analysis Logs

General

Target

EFT Form 2023.pdf
Size

307KB
MD5

7755ec887f148c5a0943392c810fc477
SHA1

a253e5bd42192f11c4c4dfb0cdc3f903c571ac6c
SHA256

db5565bcf63e257562fe138d6ce2f7505a0e824cb1e161bae66d65c3c9f3a722
SHA512

c7a2ba1d6201af39613fa0d8e133a9b465bd131afa280b9bf98ce90404f541742a52437cc713111a6145fdc6ca2050cf05568cf8054fd1d4f0cd075eb8978ff2
SSDEEP

6144:gSnGUZbsmCx4H6in0+Kdt+oyVhHq2OW+NYDS3PpVf9M:gIGUm4HXnPKdt+oyVh0tYDehVfG

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2988 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2988 AcroRd32.exe
2988 AcroRd32.exe
2988 AcroRd32.exe
2988 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\EFT Form 2023.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7a4ecb33d1992e8dcf89558d5072a680

SHA1
db0c32950e24b9c79f0fb3a0b0f19187bdc78806

SHA256
051a99982f1e11188856c1ad282b17806f7dc2c07cbc51c7be4e562f49c85ec8

SHA512
58941bf6173410a7abc7898fbc30236b05600dcdcc1ca384121c2b74191cfe035b4ed31409567fac910ecc7442a17e18989d426aec6b0dbf8d2c0ce9d65daf54

Download Submit