Overview
overview
10Static
static
1Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10Xaw-VPN/Xa...cy.pdf
windows7-x64
1Xaw-VPN/Xa...cy.pdf
windows10-2004-x64
1Xaw-VPN/index.html
windows7-x64
1Xaw-VPN/index.html
windows10-2004-x64
1Xaw-VPN/in...e.html
windows7-x64
1Xaw-VPN/in...e.html
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
30-10-2023 07:14
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Xaw-VPN/Xaw-VPN _ Secure, Fast, Free VPN service for online privacy.pdf
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
Xaw-VPN/Xaw-VPN _ Secure, Fast, Free VPN service for online privacy.pdf
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
Xaw-VPN/index.html
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
Xaw-VPN/index.html
Resource
win10v2004-20231025-en
Behavioral task
behavioral7
Sample
Xaw-VPN/index.html@n=best.free.xvpn.NetflixPage.html
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
Xaw-VPN/index.html@n=best.free.xvpn.NetflixPage.html
Resource
win10v2004-20231023-en
General
-
Target
Xaw-VPN/Xaw-VPN _ Secure, Fast, Free VPN service for online privacy.pdf
-
Size
1.2MB
-
MD5
03699f66473a7213d11b8d45ee796b7f
-
SHA1
7841ae3da113d40174b52b0c55b2881acb451a51
-
SHA256
8d96ee4906fa9f4bfef2f8452eca70a114ec399b3887639567110aaa0eee89d0
-
SHA512
d63b182af0033026d33311e053b1169ff8465f33282bf6e7bee9ca9c6050dd2e2875a3e0e0499445f68a94e768f23d199c2223936d363cf819416c7bbb732029
-
SSDEEP
24576:7fG/ni5tTjd4TvZTu++ay4JAUT5uTBIK3DbuwS:bGfQJjsH+T4TgywS
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2000 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2000 AcroRd32.exe 2000 AcroRd32.exe 2000 AcroRd32.exe 2000 AcroRd32.exe 2000 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xaw-VPN\Xaw-VPN _ Secure, Fast, Free VPN service for online privacy.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2000
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD527701103a45f5c101713182cf9b9df19
SHA12727ab410eb378ee63f480ef9fdf99600bef9f73
SHA25650b4d576e930451620a1123546b302319352a4a28fcb8311cb31a7d6bbe497f0
SHA5122fccd971affe71d8183a1bfe698453e9f2191daea2810b40fbf29f3e70d292a1cec9e689d1bf90c77b75adb5782b8f9dbad79987168c076dbedf821adb9aa599