Overview

overview

6

Static

static

6

Payload/ES...ts.pdf

windows7-x64

1

Payload/ES...ts.pdf

windows10-2004-x64

1

Payload/ES.../ESign

macos-10.15-amd64

1

Payload/ES...x.html

windows7-x64

1

Payload/ES...x.html

windows10-2004-x64

1

Payload/ES...min.js

windows7-x64

1

Payload/ES...min.js

windows10-2004-x64

1

Payload/ES...min.js

windows7-x64

1

Payload/ES...min.js

windows10-2004-x64

1

Payload/ES...dex.js

windows7-x64

1

Payload/ES...dex.js

windows10-2004-x64

1

Payload/ES...oad.js

windows7-x64

1

Payload/ES...oad.js

windows10-2004-x64

1

Payload/ES...ort.js

windows7-x64

1

Payload/ES...ort.js

windows10-2004-x64

1

Payload/ES...ble.js

windows7-x64

1

Payload/ES...ble.js

windows10-2004-x64

1

Payload/ES...min.js

windows7-x64

1

Payload/ES...min.js

windows10-2004-x64

1

Payload/ES...get.js

windows7-x64

1

Payload/ES...get.js

windows10-2004-x64

1

Payload/ES...min.js

windows7-x64

1

Payload/ES...min.js

windows10-2004-x64

1

Payload/ES...min.js

windows7-x64

1

Payload/ES...min.js

windows10-2004-x64

1

Payload/ES...ts.pdf

windows7-x64

1

Payload/ES...ts.pdf

windows10-2004-x64

1

Analysis

  • max time kernel
    199s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2023 02:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Payload/ESign.app/Assets.pdf

  • Size

    1.5MB

  • MD5

    8f63256f6deb6681dc55c9adf92669e6

  • SHA1

    c86a3c611f182bf21ba9622df3fddcf74b384694

  • SHA256

    8b8ee995e41859ef45cfe5ae1d5147e7d127fdc89b74d98822f767f7b63e0365

  • SHA512

    0b19107961103faed1f836ffa6f844227ed3f98d8c09b454fbbca5ddf6d531febe1b2645acc4ba9d0fbb101b6d949c55fb995f53b11cb14a2e654f7e6007f90a

  • SSDEEP

    12288:VIdD6RdK+bPdzRibfZUeEsoUsTgBbVJzyoygT6SfzXCp+c0SvggkWxXkvZkoXT/8:Vqg154TpXgvJkWtsT/1xU/qZx

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Payload\ESign.app\Assets.pdf"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
    Filesize

    3KB

    MD5

    acf3b7179f7c8add391b25fd35633771

    SHA1

    af2e1e853d1198708ea624b528c270d514107529

    SHA256

    36e16410c45299365753da572fefdd1ef7d2bc13dd1c47ac098665c806c35a35

    SHA512

    eff4f31f4ac4e911250605782f92423cc4c43f09061c9643ac91489957b8da7faf8c9fbee96463f90251eb5f94441cd603bf9c635f500c2e0ef8309b0249fee5

    Download Submit