Overview
overview
6Static
static
6Additional...on.pdf
windows7-x64
1Additional...on.pdf
windows10-2004-x64
1IMM0008_Sc...2).pdf
windows7-x64
1IMM0008_Sc...2).pdf
windows10-2004-x64
1IMM5562 SU...ON.pdf
windows7-x64
1IMM5562 SU...ON.pdf
windows10-2004-x64
1IMM5669 - ...on.pdf
windows7-x64
1IMM5669 - ...on.pdf
windows10-2004-x64
1IMM5955 Me...re.pdf
windows7-x64
1IMM5955 Me...re.pdf
windows10-2004-x64
1Use of Rep...G).pdf
windows7-x64
1Use of Rep...G).pdf
windows10-2004-x64
1Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
11/01/2024, 03:51
Behavioral task
behavioral1
Sample
Additional Family Information.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Additional Family Information.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
IMM0008_Schedule 3 Economic Classes - Fedral Skilled Workers (2).pdf
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
IMM0008_Schedule 3 Economic Classes - Fedral Skilled Workers (2).pdf
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
IMM5562 SUPPLEMENTARY INFORMATION.pdf
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
IMM5562 SUPPLEMENTARY INFORMATION.pdf
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
IMM5669 - Schedule A Background Declaration.pdf
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
IMM5669 - Schedule A Background Declaration.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
IMM5955 Medical Condition Questionnaire.pdf
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
IMM5955 Medical Condition Questionnaire.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Use of Representative Form _canada_IMM5476E (G).pdf
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
Use of Representative Form _canada_IMM5476E (G).pdf
Resource
win10v2004-20231215-en
General
- Target IMM5955 Medical Condition Questionnaire.pdf
- Size 621KB
- Sample240111-eep9hseafn
- SHA256 ce89116ca8b593544f0c58dcc3feeeee8afad4a20abe68e75beb6fcd97c5bc38
- MD5 3a8fec2889eb37d67153e4db3d35c4ad
- SHA1 b89dc4260ab0bd7bff933c67617ad205f826fc0e
- SHA512 fa5d3ac7d44f3d030bf0b7a47b00c60678977598de81e5f32a1e319d6f153d4b45cbb479a7c8649735e639ba9ec93dc2c9d01ad7f84e0079521cd9b489d68fad
- SSDEEP 12288:mArRD3903pUgcEh6fbPckc5/CxtIpRUjA1uxpOMshYAdLDPTEh8xwI7QeSqqcgZK:mAdp026hyDJC02pRmrxelLjFxd7QTNc9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2140 AcroRd32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2140 AcroRd32.exe 2140 AcroRd32.exe 2140 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IMM5955 Medical Condition Questionnaire.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2140
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Security\addressbook.acrodata
- Size 5KB
- SHA256 e8e27396e2a043abd283eed4fd5b8fa256cc22e741defd522158fc9e29205839
- MD5 4618312ec50b52c81043bb6ff393cfc3
- SHA1 80537497d939529b34de993b14d96510068bf075
- SHA512 fc589a974f35ee83c297784c7d7cc62826854422ceec2d5ff46aa6575f5b2bade27d26c1dfc0686602c81e5c14f75f7abd23e6c19fd90a2dbe70e0f5c09251e9
- SSDEEP 96:ecKWEX3eqvAPYnSlsMlY0G5aFlcCu3/Rmy9suumMXYASls/1rgVy73ddi:ecPqYV/saFlcTlZMX1sgUVa3ddi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
- Size 3KB
- SHA256 edab09c344c6da2eeb2f81b103899f1e30b4e41c41be1bad472a2241d89742f1
- MD5 7638927359f2bf52b1cda2f7944a6c99
- SHA1 5ef7b4a423448d57456a8b14d8835ab902b793b3
- SHA512 e7f0cf05c05ee56c7a581c8ff4a7e24cf91950ce8547c63e7924ce5f50ed296a9bbf3a204da345786c8129b2d2e270ac1b03ecea2b9c70979801505569abaa1c
- MD5 SHA1 SHA512