25abc3b189e2cee6320fc691730a150250b1a8831a5fc126f5665fb963beb8ff | Triage

Resubmissions

12/10/2023, 07:16

231012-h3y34sff43 3

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 07:16

Sharing

Report Analysis Logs

General

Target

darkgate_1.pdf
Size

18KB
MD5

7f3625037599ece29d4e984ee7550443
SHA1

b257d9c6cd8a75058800441f4a73da2259ef0601
SHA256

25abc3b189e2cee6320fc691730a150250b1a8831a5fc126f5665fb963beb8ff
SHA512

7c3a84cf71f25c1109b18c43c45132f2ba2d0df3e2e3ad1d08332fd6196708f5d6fc811e3b533f4bf869e896f67032eb058e45acb23480d8493d61b07eb546d5
SSDEEP

384:u1a2O2F3YUPSwWuwYDGpH6E0crlXwy0imbWipOFp3M0rRSWnr:u1a72F3DqHuwaGpt0crZTiwFxM0r7

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1704	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1704	AcroRd32.exe
1704	AcroRd32.exe
1704	AcroRd32.exe
1704	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\darkgate_1.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0bad9c39694de116fdeb8d2fa9f99267

SHA1
3aed24da0b85f88eb7344b99aaa8a2b7e1476db9

SHA256
6eb8ff577275c2a7bf4bd270da0f8c26fec7ccc8a322229d1654a5d6ffe7d7e1

SHA512
06559879a86d4fc07628f3509384c9ab663b9a2e674f2311bbd6e48b49414e3d1493453a99ab90d47f86e8b31570e2fb143e5bdea75f34177dcdc4f4fd459845

Download Submit