012119721ed9de6b4f7cb2384423e63bb5e8093319ecccff5091b51edbb55e1f | Triage

Analysis

max time kernel
359s
max time network
363s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-02-2024 21:54

Sharing

Report Analysis Logs

General

Target

water.pdf
Size

2.2MB
MD5

9433dd42515a296d1da339ae4b5e9429
SHA1

b9547f3788105563949dc95d016350c12f429525
SHA256

012119721ed9de6b4f7cb2384423e63bb5e8093319ecccff5091b51edbb55e1f
SHA512

c33d949bb35cf7c3b1ff825e796fd1b08ea3132d305cdb102d3591177c45d0c26c9f5da4d4d9d5d446d962fc56bf109670f2ea8f01e9340d166f4edf2eb91062
SSDEEP

49152:XgPsLITpmtUh0Jvv+kds3MIZs1sS9Qoxak:XZITplavNfAS9Qoxak

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\water.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2b4eac9c680a27cd1fbbbe51aa281750

SHA1
78cbca959ec348b8eba3d061776e730c47914ed2

SHA256
aed27eb8613228dd24405d9e185cc024c487b361ba74348470b50bdb97026b4d

SHA512
4d3ded2d8e9389a1dfb2b72e2da6556c186252f3848874c1a67dc92f05fbe837674d632c1150fcf946d4c810c4483c03cd976786ec67599400f106e9268a44ec

Download Submit