dfc413f1f32e00e07232b6ef976de322f8cdd6396fe174838dba87d696e8836a | Triage

Analysis

max time kernel
179s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-12-2023 03:03

Sharing

Report Analysis Logs

General

Target

密码1129.pdf
Size

162KB
MD5

298ff11515e13992b1cddc2bfe1be6b8
SHA1

5838ce9e1c612aa1abce5773104fb23d1603834e
SHA256

ed7484f5d5b25593944dae28d401e3412b1e47e6c62677b547f155751c7f14fc
SHA512

9cbf3d489c9aec38125516f716fef887294fe7f96304bf80282f841b64a546dea247471e5b027fa6d690c18a67a21539beb18ada51d32801deabce4b02ca2eb7
SSDEEP

3072:4H9ebySXGFSzd29mmfAYRY/Fl60jToIUQcRZ8pEkXl3YJG6GSW68CE26:Y9SRMSUoCW/FsGoIUnj8Nr6Gw8z

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2192	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2192	AcroRd32.exe
2192	AcroRd32.exe
2192	AcroRd32.exe
2192	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\密码1129.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
820ee69e41b99379536891af2c1cf217

SHA1
c1e4f2aee957a0804c5cff3ab1e35c61149198e6

SHA256
20752aa7614af895b553fb7df90637dbfb9e1d560130cfb1c1d40a685aa777fb

SHA512
e1b202e6453f0bfec1be1bd9137ccd507a33710a9b7efb94a305c73154c4c311eff49d58d3c33ddf36fe9087eec8f26ce033133b9d350658026867d98d63d6ce

Download Submit