Overview
overview
6Static
static
6Additional...on.pdf
windows7-x64
1Additional...on.pdf
windows10-2004-x64
1IMM0008_Sc...2).pdf
windows7-x64
1IMM0008_Sc...2).pdf
windows10-2004-x64
1IMM5562 SU...ON.pdf
windows7-x64
1IMM5562 SU...ON.pdf
windows10-2004-x64
1IMM5669 - ...on.pdf
windows7-x64
1IMM5669 - ...on.pdf
windows10-2004-x64
1IMM5955 Me...re.pdf
windows7-x64
1IMM5955 Me...re.pdf
windows10-2004-x64
1Use of Rep...G).pdf
windows7-x64
1Use of Rep...G).pdf
windows10-2004-x64
1Analysis
- max time kernel
119s - max time network
120s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
11/01/2024, 03:51
Behavioral task
behavioral1
Sample
Additional Family Information.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Additional Family Information.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
IMM0008_Schedule 3 Economic Classes - Fedral Skilled Workers (2).pdf
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
IMM0008_Schedule 3 Economic Classes - Fedral Skilled Workers (2).pdf
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
IMM5562 SUPPLEMENTARY INFORMATION.pdf
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
IMM5562 SUPPLEMENTARY INFORMATION.pdf
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
IMM5669 - Schedule A Background Declaration.pdf
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
IMM5669 - Schedule A Background Declaration.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
IMM5955 Medical Condition Questionnaire.pdf
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
IMM5955 Medical Condition Questionnaire.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Use of Representative Form _canada_IMM5476E (G).pdf
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
Use of Representative Form _canada_IMM5476E (G).pdf
Resource
win10v2004-20231215-en
General
- Target IMM5669 - Schedule A Background Declaration.pdf
- Size 770KB
- Sample240111-eep9hseafn
- SHA256 0440efdf01cbc5f80ed88c9b199334c0b847fbfa6d9429173ddf4c7ee44946dd
- MD5 317a872081abce1d46cc092938cd8b1e
- SHA1 ebd763a0e16f56cc05d85d36cf96a4b2d8304f72
- SHA512 95947d5628e52c73437b193808ebef33e781b004310b512b3f58338c21e0e2c08e41fa98087bcb4c092931230a05bc520820873caa734d0bb7a3393dab1d3d21
- SSDEEP 12288:V7uVkWYP5F1tmmdwpHbAZl/gGeFGzWWeKMPOAIVBNCXe1EliVQaVF:V6Vdu1tmCwpxgKBmACvX1ElimaP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2956 AcroRd32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2956 AcroRd32.exe 2956 AcroRd32.exe 2956 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IMM5669 - Schedule A Background Declaration.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2956
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
- Size 3KB
- SHA256 5798889c81561deba56195e7eca06f532c8d8c17b1e0aca8b3e446df0be1636d
- MD5 6aa83be4a7c0749b712f6c54d6a133af
- SHA1 867eec6195453973c8b1d5a7e5e966f8f030375e
- SHA512 8195aacae79b82bdd440d0b46c8883b1a714892ebb5d474f22965cf3f219ec79e6bc79366e5f2ad4a825a9d4c73d5e165304dc9f8147a782005a859785b93264
- MD5 SHA1 SHA512