Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 13:00
Behavioral task
behavioral1
Sample
BOLETO (2).pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BOLETO (2).pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
CNH-e (1).pdf
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
CNH-e (1).pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Declaração de Residência (a próprio punho).pdf
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Declaração de Residência (a próprio punho).pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
NF.pdf
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
NF.pdf
Resource
win10v2004-20240226-en
General
-
Target
Declaração de Residência (a próprio punho).pdf
-
Size
2.6MB
-
MD5
bbcb8d332b5abe2991cc2a2362896407
-
SHA1
311634772950fab8a06f4cb1811940f16310f0a1
-
SHA256
7de6462e6bead49dfe5b44bfccfde19def2db6eed9b977ee53dc0e9469de7ea2
-
SHA512
eace05522dda3c864f7322aa5b4369496584e05df843077110247bcf0bac973711bbce31e6eeee5149434eec7a73dca17a7531f451b1fb0828d12226012d4d7a
-
SSDEEP
49152:/aHuLl8Qt2DTC1xex+Z7s6JeaFoZBPL5M3oH+JUw1TdQioFVlHYEFM9S8gGHBC9f:/VL+DWmg7JoZ5L5+Uw1RhuDYsE1dB2aA
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2408 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2408 AcroRd32.exe 2408 AcroRd32.exe 2408 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Declaração de Residência (a próprio punho).pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2408
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d540f61daa97c80fefd2b3f7f3e34cf4
SHA1fabd2bedcfec32bf4398132e74698e7056a01e68
SHA256060a0aefbc535f426794eef189b107a4088c9297f9d8e9c4da9d7a0842426bda
SHA5125fd8f6a795b31930c028bdba29efbb35377be4a1b6b496fbe3fdfc0d8551fad307c81d13d462d08615a74e72e3e488e62f69a4625f34f85c5e78539b0c069822