baa163f82e96d421ef67af9826e06195ac7d26ee20a87db20d92e5d0968ae9d0 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 13:11

Sharing

Report Analysis Logs

General

Target

Nam.pdf
Size

105KB
MD5

3bd50393cd73db89921f61aa4ee5a028
SHA1

08886fa71da4eef73eb1514e84fe213d662b4552
SHA256

baa163f82e96d421ef67af9826e06195ac7d26ee20a87db20d92e5d0968ae9d0
SHA512

4208f38715afb773e1d0fd81911c118116a8e2ce69d89da103d27c6ca0b3cfadf0aa0e529d1b232966dd0fec85d2c6db29369fa535536414ce691c3dc47b9c0a
SSDEEP

3072:LgTzFLkZUSpQsqVt4+AIRGgxcx2Gseequu:LgTRLkZK9VFRGWcE7S

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2944 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2944 AcroRd32.exe
2944 AcroRd32.exe
2944 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nam.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
23e5c9ff250af375d194f2dbfd1f0d36

SHA1
0d93be71460ab96d5df74ef80656d6319e71adc3

SHA256
a1b88991e39a51d35aff22e3344eef15ecf71ac458f88620bb80074be8841eee

SHA512
d63bbc581e851ea3269bb2f933b19dea9095abaaa2f51a094c1f6dd4ef184bc8d79e3b50b57068cbe71650e82c34ca661800f055e92358fae0e4356b240510ad

Download Submit