Analysis
-
max time kernel
152s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 17:06
Behavioral task
behavioral1
Sample
NEAS.0be973d1d4198ddf9ff2e71bf3ea68a0_JC.pdf
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.0be973d1d4198ddf9ff2e71bf3ea68a0_JC.pdf
Resource
win10v2004-20230915-en
General
-
Target
NEAS.0be973d1d4198ddf9ff2e71bf3ea68a0_JC.pdf
-
Size
50KB
-
MD5
0be973d1d4198ddf9ff2e71bf3ea68a0
-
SHA1
c0aabf3a19708b5dd8986ce2c66e53440d3029ed
-
SHA256
f435af6144fe3427b37c79d447fafd97c62f68eeaced52eae447abead6509477
-
SHA512
fde647eeb4cf280ee89cee93ce2569bc56ddcc9983efbe6344888f512d75b6a5f496348a13911d4fd298c0004248cfd121387f8360cfe6a42582a27d49142102
-
SSDEEP
768:Vzrcw49z1A6zIPz5lLxNl1ddc+nVDfbWulU+fexvj6NeWkofrnqG48wqaCsWM7XJ:JcwdumfbWulpQjdBojvRPbkq5p/kR
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2988 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2988 AcroRd32.exe 2988 AcroRd32.exe 2988 AcroRd32.exe 2988 AcroRd32.exe 2988 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.0be973d1d4198ddf9ff2e71bf3ea68a0_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2988
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e6cdcba360924871544a15f7cc76ada8
SHA1ec7e31f85c7df966f07c88d00ce670ff53484f91
SHA2568905059b0a53452c23ce01df08850d96845dd5b435856b026a7db3bbd5cd77d1
SHA512923f6e86af88b56edc0b2ec84b23182582c6bded3e1ba7ac009e233482e6ef2647707c1bff45718cdb48a7d6093a7808fdfbb76e098e2bce336470e7f0f4c419