fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b | Triage

Analysis

max time kernel
359s
max time network
361s
platform
windows7_x64
resource
win7-20240220-es
resource tags

arch:x64arch:x86image:win7-20240220-eslocale:es-esos:windows7-x64systemwindows
submitted
22-04-2024 19:58

Sharing

Report Analysis Logs

General

Target

$TEMP/PCSX2 1.6.0/Docs/PCSX2_FAQ.pdf
Size

286KB
MD5

42a7d9ebb4dde5cdff264f2e3057e5af
SHA1

6b6c355b93c70be2858dabd4361ac979e0d877cd
SHA256

4259363a44d177aa2cf39394531b2325a6049468f75e23ee2fe7701f8b16b0cd
SHA512

9e30a978b84b2666bd4af7630d6615f04d1c408182f286d7541b7c046587676d9ed75abf40592c9ac338382c22f8748a944fd6f5ac42a1eeac519a6b18527d37
SSDEEP

6144:3ZflfQ2uS0CPNcve5mtaNNqq2gJgXD0bIclL:3ZJQk0C1EeWqzgXD0PlL

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

3040 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

3040 AcroRd32.exe
3040 AcroRd32.exe
3040 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Docs\PCSX2_FAQ.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3040

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
afac249b05aebc7a2fb7294e43085b1a

SHA1
d624951215dbb4223bc494d56ba45796df793e78

SHA256
64b0b5fd02585610ddc57a8b4a568b5ba1a1069c8ffcab48b214d6456bd604ea

SHA512
185adb643c0840cb0ac6b5ad5d6e90eb76b1a2731585c019eea0dd2cb77551e152cb598170ea03e7c3800505c3a9cfefc3ecf98b3feba2dd830bd4e2c8d3ffbf

Download Submit