5d885a856a19e7bde389cfd43391c6c55aad9c1cf9a8f14f2f6c820abb3b4637 | Triage

Analysis

max time kernel
152s
max time network
130s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 08:58

Sharing

Report Analysis Logs

General

Target

NEAS.1952f5b32b53278c8a715326446d48b0.pdf
Size

390KB
MD5

1952f5b32b53278c8a715326446d48b0
SHA1

995e0ff138335c239ad418a58317ca2c72f09221
SHA256

5d885a856a19e7bde389cfd43391c6c55aad9c1cf9a8f14f2f6c820abb3b4637
SHA512

3d05429d870f763fc0e8ba1c9ce5f9e9368c5e6b037a6aa0fe00d4cb010371f758d691b38a737257441f20f1e50a110a02e6c8a98567266469612b133e3864dd
SSDEEP

12288:Z7rust+r9pVcKX3/88DBS/okw0ymy5SxJ+Y:Z73t+r9LZ8RwBdCb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.1952f5b32b53278c8a715326446d48b0.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
863969bb8bef0fe16627df0ab09f5a9e

SHA1
cbfe2c5d4d1b0b580e9d5eb975db41d99db7880c

SHA256
ec8b3369d4a8b77dd50b87e40058d5612688bf86ee8c10eab1db139143a3d55d

SHA512
4c56d225267a2be6d591aa1372073412b35a04ea811c5396cbfd8f3a3f7344d1104656da5e92b252f0ac31bbb290b09d8b340d75064e342a4610c01181dd9f0b

Download Submit