Analysis
-
max time kernel
10s -
max time network
3s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 09:41
Behavioral task
behavioral1
Sample
Your boarding pass to Bilbao - ETIHAD AIRWAYS.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Your boarding pass to Bilbao - ETIHAD AIRWAYS.pdf
Resource
win10v2004-20240412-en
General
-
Target
Your boarding pass to Bilbao - ETIHAD AIRWAYS.pdf
-
Size
53KB
-
MD5
e8e7d198c6a32c65accd2ab4e89c5ed8
-
SHA1
db358962b88cf32f6db7b17974a296aa8e7ec690
-
SHA256
22502c3002c9781fcd6c754cde2b76a602b7af82ccc3398027e7b27e98e0bab2
-
SHA512
4749f65bcd62a64c02a9680167d89e0b7d7d7aa9ba659a112e671086a8ed9c47e4de8414e113b748ae5dd3c25f65e8f8fcfac5eb0ef8d95f02dc1a0dceb2256f
-
SSDEEP
768:1w18yTBU0DS0sXrxs/UObBRSXUAo6592kn67vxWkVtGOlNCJ4cZiwU+OSr4jv/fK:yjK0s1sUOLSkAo6vOpdQQ1Y
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5181487f0c7aba74e9092f6de457205a7
SHA12c2b5350cc3d7b0a65121991a1036384b00bee4b
SHA2565b29bef1be17c5bcc0e9ab214da5237fb03fc54d1f9c72d5f5d25537e43af290
SHA5124d8c3e52236e5c02e9c795a5530527c1c484287121976aa6b3d470a4a09d76657cace94e32f41608549a10950db0d51148dde52c3c27fc2eee6b0a1531004d9c