Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
e90712dbb98417fd08b0d94987aa1bbcdfbf0e050aa74027a3e24a620530a4ed.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e90712dbb98417fd08b0d94987aa1bbcdfbf0e050aa74027a3e24a620530a4ed.pdf
Resource
win10v2004-20240226-en
General
-
Target
e90712dbb98417fd08b0d94987aa1bbcdfbf0e050aa74027a3e24a620530a4ed.pdf
-
Size
12KB
-
MD5
e1942882ae3482eb3bb31538ef1264d5
-
SHA1
dcd8604b8d139f93f19c554a8deedc7dea11b8f5
-
SHA256
e90712dbb98417fd08b0d94987aa1bbcdfbf0e050aa74027a3e24a620530a4ed
-
SHA512
617725420e1b72d0611d6f0cfc60df30dfe7d693955f1dce8b9ccea806903043be6b981a71c6941240103b940fa1893e135ae44f2f6cf04270f6a2723be3d598
-
SSDEEP
384:HFLmn1aLSsSfxIDsyi3P2IUbJXjvXP40kfqm9sDL1:HFan1amsSfxjy5FXQrNuDp
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2856 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2856 AcroRd32.exe 2856 AcroRd32.exe 2856 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e90712dbb98417fd08b0d94987aa1bbcdfbf0e050aa74027a3e24a620530a4ed.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2856
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5bb7a4e591187c2f94136a4457974217a
SHA13f6475fb97f8647cff2babe8fa8ed1b90cedfbdd
SHA25687a779b52d1d88933634a5efc9721bcc0c37f30e42bdee33431ecfef7aa475ef
SHA51237368ad3a0482512e377c44f3d70ac8c3e7280019b8f0fdb08b5625139799aa01355ddf08537056d22c82c4f2dafd3d8c38673e2addb1dd96ec9a7f60ff85a90