d53ea35e38bb6496cbe6023cdaa6980b37d90e1e7fc35a57e0c8ac2172c15673 | Triage

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 08:53

Sharing

Report Analysis Logs

General

Target

NEAS.41b695c4be66e23fd3f647d74efc2220.pdf
Size

54KB
MD5

41b695c4be66e23fd3f647d74efc2220
SHA1

e9bf6a5b07199d64efaa98949cf7d29741591c09
SHA256

d53ea35e38bb6496cbe6023cdaa6980b37d90e1e7fc35a57e0c8ac2172c15673
SHA512

993a38d163ddd6daf4aeaf38b97d15b3530f758c769226c3f0d5340a244cdf0b6e380ece240b2b3b288d4e25f54fea22b5f3c42cc445d3dbb95478e2f2df3f93
SSDEEP

1536:N/MCVrDLPQS6M2hsHT9PWxHSmKA3pEt75IPWIB5G:aY7Z2hszQmCEt7i7m

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2964	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2964	AcroRd32.exe
2964	AcroRd32.exe
2964	AcroRd32.exe
2964	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.41b695c4be66e23fd3f647d74efc2220.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ddce8bfc496b5db086cab960f1760379

SHA1
b0a7cb200907f2f73a56cade29b056af90f4d086

SHA256
dac97bbe534ca5795692cd52bc502aad48972c9b9082d3a2d921e86e90e5474d

SHA512
0cd9d8efe888e36ae84c99d0a5659afd82082db32e65897c05f10e9d989fb57b3cd1d8e5b1f60bf5490d1a912c4a41324dcf75f94d63932c7b53b5c9167e0aa0

Download Submit