Analysis
-
max time kernel
152s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 19:08
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c40db1d58ca682254d113559c1b00140_JC.pdf
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c40db1d58ca682254d113559c1b00140_JC.pdf
Resource
win10v2004-20231020-en
General
-
Target
NEAS.c40db1d58ca682254d113559c1b00140_JC.pdf
-
Size
109KB
-
MD5
c40db1d58ca682254d113559c1b00140
-
SHA1
f6f4473048680373e0c3edb3984d5ed7803d41cf
-
SHA256
2afca7abadc0cdb26c1da2d01f36d906adbd97a70a8ddeccb7dc0c1d4727da6e
-
SHA512
1c21f3f5aee9cab62d8f35852fd5e9ab68c55b9366702a1f02b9b3dbcbe1808c0e9061e020d303145af86e29be9a6a4c69a197b812524ca83a4a3129dd6cba9b
-
SSDEEP
1536:83JSLlZsvVWgYVIP6BdMHdsVBaZlsYmrSUcRY59efiXPWyJGWjTM2:PlZO0gYmSRVBaZlsYacI0mbM2
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1220 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1220 AcroRd32.exe 1220 AcroRd32.exe 1220 AcroRd32.exe 1220 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.c40db1d58ca682254d113559c1b00140_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1220
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f38cbfb3c9179dc1cddb461311843fe0
SHA14edb0b53c4ba0be0407247eaf859d99f98183eb6
SHA256aa20a8d651cf7e11ea608f2bfe43aba0bb02a990207db5eec3b31a860a720289
SHA512415bb0e29cc92fce39d27701cbb22c2f6e4009dbdf34e5fc7e72a4504fba56de69f9deea3f138f06e99e4bf5582619d7accaea88b7800b1962fd54b2308e7ba8