Overview
overview
7Static
static
3(03) PDF R....2.exe
windows7-x64
7(03) PDF R....2.exe
windows10-2004-x64
7PDFR_Print...00.exe
windows7-x64
1PDFR_Print...00.exe
windows10-2004-x64
1PDF_reDirect.exe
windows7-x64
1PDF_reDirect.exe
windows10-2004-x64
1Stamps/APPROVED.pdf
windows7-x64
1Stamps/APPROVED.pdf
windows10-2004-x64
1Stamps/COMPLETED.pdf
windows7-x64
1Stamps/COMPLETED.pdf
windows10-2004-x64
1Stamps/CON...AL.pdf
windows7-x64
1Stamps/CON...AL.pdf
windows10-2004-x64
1Stamps/DRAFT BLUE.pdf
windows7-x64
1Stamps/DRAFT BLUE.pdf
windows10-2004-x64
1Stamps/DRAFT_ULH.pdf
windows7-x64
1Stamps/DRAFT_ULH.pdf
windows10-2004-x64
1Stamps/E-Mail.pdf
windows7-x64
1Stamps/E-Mail.pdf
windows10-2004-x64
1Stamps/EXP...rd.pdf
windows7-x64
1Stamps/EXP...rd.pdf
windows10-2004-x64
1Stamps/FINAL.pdf
windows7-x64
1Stamps/FINAL.pdf
windows10-2004-x64
1Stamps/FOR...NT.pdf
windows7-x64
1Stamps/FOR...NT.pdf
windows10-2004-x64
1Stamps/FOR...SE.pdf
windows7-x64
1Stamps/FOR...SE.pdf
windows10-2004-x64
1Stamps/INF...LY.pdf
windows7-x64
1Stamps/INF...LY.pdf
windows10-2004-x64
1Stamps/NOT...ED.pdf
windows7-x64
1Stamps/NOT...ED.pdf
windows10-2004-x64
1Stamps/NOT...SE.pdf
windows7-x64
1Stamps/NOT...SE.pdf
windows10-2004-x64
1Analysis
- max time kernel
119s - max time network
120s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
14/03/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
(03) PDF ReDirect v2.5.2.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
(03) PDF ReDirect v2.5.2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
PDFR_Printer_Cmds_v25000.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
PDFR_Printer_Cmds_v25000.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
PDF_reDirect.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
PDF_reDirect.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Stamps/APPROVED.pdf
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
Stamps/APPROVED.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Stamps/COMPLETED.pdf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
Stamps/COMPLETED.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Stamps/CONFIDENTIAL.pdf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
Stamps/CONFIDENTIAL.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Stamps/DRAFT BLUE.pdf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
Stamps/DRAFT BLUE.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Stamps/DRAFT_ULH.pdf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
Stamps/DRAFT_ULH.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Stamps/E-Mail.pdf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
Stamps/E-Mail.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Stamps/EXP Business Card.pdf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
Stamps/EXP Business Card.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Stamps/FINAL.pdf
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral22
Sample
Stamps/FINAL.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Stamps/FOR COMMENT.pdf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
Stamps/FOR COMMENT.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Stamps/FOR PUBLIC RELEASE.pdf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
Stamps/FOR PUBLIC RELEASE.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Stamps/INFORMATION_ONLY.pdf
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral28
Sample
Stamps/INFORMATION_ONLY.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Stamps/NOT APPROVED.pdf
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral30
Sample
Stamps/NOT APPROVED.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Stamps/NOT FOR PUBLIC RELEASE.pdf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
Stamps/NOT FOR PUBLIC RELEASE.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target Stamps/APPROVED.pdf
- Size 6KB
- Sample240314-d9pe2abh97
- SHA256 7025adb480253228d921d8375eb5c8c748904a6229783c2283964db2b71dae77
- MD5 e80189805217c2895e6485c43dca469f
- SHA1 ef1728dd6c33be4dbc513d121aa6da354266c5d7
- SHA512 95f5391d6eac025efc44d5c1719fdedaabf93d32f72f40a25c9df97d2343cdbb87a642ad2e6f499ad5e4ebea037e6cca9ec929352ce5de464c0afeae230a7734
- SSDEEP 96:lBxFTRl1SB3Pba/PAOPpm3haBW/84py/N6XVXVUiF2fJusS3TTU7Hfes:bbTRWPOXBPAz8wy/N6llxF3sskzp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2368 AcroRd32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2368 AcroRd32.exe 2368 AcroRd32.exe 2368 AcroRd32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
- Size 3KB
- SHA256 bfa91bb7074366bc2393ee5a99c8bcd28056f952c9b695424272e4e2cd42cb89
- MD5 52473cc9fb1f2db32c9b21fcde354ba6
- SHA1 480cdfe3c28e026110444605864ac5c8d017e0ee
- SHA512 c6fcfb412ffbbbbe4106aac44cd6e9e237494e68761d78c1b1bc1b5b1a4b2d018ee02ec0c01b30eb837db5e64d898e7130745f8cda7abcb7186b3bd4f9ad93f4
- MD5 SHA1 SHA512