Analysis
-
max time kernel
172s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 04:06
Behavioral task
behavioral1
Sample
277714497e414e3184663c986b201655.pdf
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
277714497e414e3184663c986b201655.pdf
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
277714497e414e3184663c986b201655.pdf
-
Size
49KB
-
MD5
277714497e414e3184663c986b201655
-
SHA1
098cfbdd5ad1de8512f5ac7b0c0d6d2b977fbe5e
-
SHA256
163147b8078513f4ec1c159f8b0ee5aba3925c805f57f8bf253136762f8aca5c
-
SHA512
bc0063f7233e8b2bcf9e215e4b4962449980d8161df668bbfd44dfd69191975bfa50e986824386d5e9a523c648bf987033773e8969e0596cce075dc56dae3f81
-
SSDEEP
768:1zkYKCSGkHXgBevIfiqfVjSB8Aw81/o5UZEaW9It/nkRK4T+A:14Y0GmGeHReAt/uUZqi/kk4Tj
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 804 AcroRd32.exe 804 AcroRd32.exe 804 AcroRd32.exe 804 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\277714497e414e3184663c986b201655.pdf"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:804