d6670265e1f44465f41d4464a8505a16b6b9e3610e42f57bdc99f206ea6b85eb | Triage

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 04:23

Sharing

Report Analysis Logs

General

Target

NEAS.1404b4cb68cd0cff171473df0af11de0_JC.pdf
Size

396KB
MD5

1404b4cb68cd0cff171473df0af11de0
SHA1

a0373f30a522a72a8f5e4a590cbd0afe0b78ae49
SHA256

d6670265e1f44465f41d4464a8505a16b6b9e3610e42f57bdc99f206ea6b85eb
SHA512

e583208cc0e340a89aabfa2f2ee5bd17971e91215fb4d5543c63ce0c41207500fdec2931b885b4c5b0fc94f61b67d754415e370e237abc76ac5a90aa1adee313
SSDEEP

12288:Jb2Pi5GbMj7S7lI/MHhRSIsCMjmzrCsCPMR0:Ei5GP7eOMaCH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2428	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2428	AcroRd32.exe
2428	AcroRd32.exe
2428	AcroRd32.exe
2428	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.1404b4cb68cd0cff171473df0af11de0_JC.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5b5dc4b074e0d9ebe34df7bc85d46b93

SHA1
074a7fd6528fee8ff4cf1cfe192332815d76e19d

SHA256
8ad02ef7010fce18de2cd2c71e3b79dc5f7a375036b31df64e113cf3bc59f442

SHA512
3a002e664dee11b6ae4275a3dfab667b49390541d1e8b6332ba3e8b8017a623c92d5f87ec5d7053c9a9d7549d2ce25d77a11a32c1b8e0e060c09306f7003085f

Download Submit