ab122c292b7e68db1d812cc6920bb259da5c9b521082416f68eb8a9a894b06f4 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 08:08

Sharing

Report Analysis Logs

General

Target

S MUD THERAPY.pdf
Size

2.1MB
MD5

76d481a2986e818c08dc6976f3bdd62d
SHA1

b7d4a0b9226826d4bb5ffce05824c1dac33508a7
SHA256

ab122c292b7e68db1d812cc6920bb259da5c9b521082416f68eb8a9a894b06f4
SHA512

9f7b43241ee8135b9e8077bf2fd258e4fad6974f8d9d525e36a5288b31cb12dbe90c814b12f8ab361bcc5a90ae91cee50ba7e3e5153ae9dd0316e38e1689386f
SSDEEP

49152:2uDz8EjV4Qcy8Ja4U8AHBgarzTRqZtNmxSSO6Y0IHkcLul:2GV49PjAh1rzUzdIIEcql

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1888	AcroRd32.exe
1888	AcroRd32.exe
1888	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\S MUD THERAPY.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0ce72791098bb40393804b9e05189077

SHA1
48948cc2534913abb743ce9b4f5cdc6dcd03b50b

SHA256
3462aa5f930793d5131df2100146b17b2d5fedea5fe5f79f0fbb758fdfb8e60f

SHA512
ab2c7c83ab0ab45aa7ff3d9a61a3446f00b084d03e56bd8021fc422e0211849f275003f032514ee796b4f642eb2541f9d59dbf2725fdcc6519606a2d2ff8d431

Download Submit