c82566eed1fcda8b34589c0e7911415d6159fe4f1c89cc49b42906e92994aa63 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 14:42

Sharing

Report Analysis Logs

General

Target

Invoice_2168.pdf
Size

324KB
MD5

acb7b8f7ff78e85d670ee0024c51f994
SHA1

1d361a9b477f2f86e241de8105e99854f5b65ff7
SHA256

c82566eed1fcda8b34589c0e7911415d6159fe4f1c89cc49b42906e92994aa63
SHA512

4a37a93ad9549fb4753fb54ba909017bc655f61f0bb0e9e59e8035abdb0ba800896430c187e8c9a3b141695d5af99aee9679d0e49717d0f168df6222327cd0a0
SSDEEP

6144:gimsgxR1t64Vwylvx/0zSAOnrUHj5xBvhiCFKnmN5pWvk:gwgdtTVwk/0zrOgD5zvktnmN5pWvk

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2528 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2528 AcroRd32.exe
2528 AcroRd32.exe
2528 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice_2168.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2528

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
f09f6a4d2d51407e98162ae4c6ae9eb4

SHA1
14703842ae5a7f5d369c84feb833d4f27a2a5402

SHA256
561b5b59798d8b306d0b08fa52f00ceb30e0fcfb756ba390dda9edc634c96b0d

SHA512
4ff62e4f28d875731c4ef59cd33c7645ec2eb5c9f384fac71ae22571e358168e696e44b422d03e54b702b4e9e4134a0103536ee51318409aac564599d2d5ef52

Download Submit