e49189a705cf9fe8c6f99f7cacd044ccc91c9f750c98b6739dadd7cdbb10dc7d | Triage

Analysis

max time kernel
152s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 10:58

Sharing

Report Analysis Logs

General

Target

NEAS.eeab952872db5a1084bbbc44b75795a0.pdf
Size

111KB
MD5

eeab952872db5a1084bbbc44b75795a0
SHA1

9c0df307bf91af40b55a9744c21221a13b834618
SHA256

e49189a705cf9fe8c6f99f7cacd044ccc91c9f750c98b6739dadd7cdbb10dc7d
SHA512

b11d200e959889cad62e67f63a0f48d930cbc13e64053b3f2b8a9d0b14222dd9129bbcc7f7f8d4d49e87689919e17ced5d99ffa9f2862ea1fa2e383ced43beae
SSDEEP

3072:fQ87HpXeHx94ahjnvBmH7mejZmf/Q+oh6:o4puHgKjnvB+mjf/noY

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1864	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.eeab952872db5a1084bbbc44b75795a0.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ee385ffcd07ba7c2412c838a491bd876

SHA1
9b1d3e1e2dd1ebc2e49950e03100b552216340f3

SHA256
4151d923fe3927dcf6bbb6c76a40a7cc81825d8b3f0487ba9c1f5dbe81410fb1

SHA512
f599c79e71429c0eaba8e163e43ba1840030189f61cd551e836efc2e30e03c8ae83edc339cf76976e1f83ecef68c273dd98488a65d653be9f65f1d1fda9704ea

Download Submit