b4c3d3715f78fbed02598d490f0961fb512d7deaea514b905782a0683c96f8d8

Submit
Reports

Overview

overview

Static

static

BNG/Chenie...3.xlsx

windows7-x64

BNG/Chenie...3.xlsx

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...-1.pdf

windows7-x64

Commercial...-1.pdf

windows10-2004-x64

Commercial...ce.pdf

windows7-x64

Commercial...ce.pdf

windows10-2004-x64

Fire Water...1.xlsx

windows7-x64

Fire Water...1.xlsx

windows10-2004-x64

Paddle, Bl...P.xlsx

windows7-x64

Paddle, Bl...P.xlsx

windows10-2004-x64

Paddle, Bl...s.xlsx

windows7-x64

Paddle, Bl...s.xlsx

windows10-2004-x64

Paddle, Bl...-4.pdf

windows7-x64

Paddle, Bl...-4.pdf

windows10-2004-x64

Paddle, Bl...-4.pdf

windows7-x64

Paddle, Bl...-4.pdf

windows10-2004-x64

Paddle, Bl...-4.pdf

windows7-x64

Paddle, Bl...-4.pdf

windows10-2004-x64

Paddle, Bl...-4.pdf

windows7-x64

Paddle, Bl...-4.pdf

windows10-2004-x64

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 11:59

Sharing

Copy URL

Twitter E-mail

Static task

static1

pdf link

1 signatures

Behavioral task

behavioral1

Sample

BNG/Cheniere AML Rev. 3.xlsx

Resource

win7-20240215-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

BNG/Cheniere AML Rev. 3.xlsx

Resource

win10v2004-20240412-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

Commercial Docs/COW - Confined Space Entry Permitting Procedure.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

Commercial Docs/COW - Confined Space Entry Permitting Procedure.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral5

Sample

Commercial Docs/COW - Energized Electrical Work Permitting Procedure.pdf

Resource

win7-20240215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

Commercial Docs/COW - Energized Electrical Work Permitting Procedure.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral7

Sample

Commercial Docs/COW - Energy Isolation Permitting Procedure.pdf

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

Commercial Docs/COW - Energy Isolation Permitting Procedure.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral9

Sample

Commercial Docs/COW - Excavation and Trenching Permitting Procedure.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

Commercial Docs/COW - Excavation and Trenching Permitting Procedure.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral11

Sample

Commercial Docs/COW - Lifting Operations Permitting Procedure.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

Commercial Docs/COW - Lifting Operations Permitting Procedure.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral13

Sample

Commercial Docs/COW - Permit to Work Procedure.pdf

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

Commercial Docs/COW - Permit to Work Procedure.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral15

Sample

Commercial Docs/Cheniere Prevailing Wage Labor Study - Heavy-1.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

Commercial Docs/Cheniere Prevailing Wage Labor Study - Heavy-1.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral17

Sample

Commercial Docs/Simultaneous Operations SIMOPS - Safe Work Practice.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

Commercial Docs/Simultaneous Operations SIMOPS - Safe Work Practice.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral19

Sample

Fire Water Specialties RFP/Cheniere AML Rev. 3-1.xlsx

Resource

win7-20240221-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral20

Sample

Fire Water Specialties RFP/Cheniere AML Rev. 3-1.xlsx

Resource

win10v2004-20240226-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral21

Sample

Paddle, Blanks and Spacers/Cheniere SP CO2 FEED - Paddles Blanks and Spacers RFP.xlsx

Resource

win7-20240221-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral22

Sample

Paddle, Blanks and Spacers/Cheniere SP CO2 FEED - Paddles Blanks and Spacers RFP.xlsx

Resource

win10v2004-20240412-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral23

Sample

Paddle, Blanks and Spacers/Specials - Paddles and Specs.xlsx

Resource

win7-20240215-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral24

Sample

Paddle, Blanks and Spacers/Specials - Paddles and Specs.xlsx

Resource

win10v2004-20240412-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

Paddle, Blanks and Spacers/Tech Specs/A2A_Rev00B-4.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

Paddle, Blanks and Spacers/Tech Specs/A2A_Rev00B-4.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral27

Sample

Paddle, Blanks and Spacers/Tech Specs/A3_Rev00B-4.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

Paddle, Blanks and Spacers/Tech Specs/A3_Rev00B-4.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral29

Sample

Paddle, Blanks and Spacers/Tech Specs/A5_Rev00B-4.pdf

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

Paddle, Blanks and Spacers/Tech Specs/A5_Rev00B-4.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral31

Sample

Paddle, Blanks and Spacers/Tech Specs/B1A_Rev00B-4.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

Paddle, Blanks and Spacers/Tech Specs/B1A_Rev00B-4.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Report Analysis Logs

General

Target

Paddle, Blanks and Spacers/Tech Specs/A3_Rev00B-4.pdf
Size

419KB
MD5

84c27c930594837a40f7e080691a565d
SHA1

f04a49bde0a2f64bbb646cadee440899c7da4cb0
SHA256

30ab5c46d67f9bdb34deb1a3cfe6fc537f46772a7b7e1a7c5ec086ee13253cd5
SHA512

ef280e74f3f4aa34eeae3e4cc6869b6903701554fb5eb64ae091534b74f0bebffead324ef9eab2da2f67b04d779ee8c45eaf4b82963b7ceaf81838702479a1e7
SSDEEP

12288:RKRC4GbxtmRBI6sgDuzInXhz1cw75/hic:k8pxtgeBgDuMnXtWQhj

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1796 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1796 AcroRd32.exe
1796 AcroRd32.exe
1796 AcroRd32.exe

pid	process
1796	AcroRd32.exe

pid	process
1796	AcroRd32.exe
1796	AcroRd32.exe
1796	AcroRd32.exe

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Paddle, Blanks and Spacers\Tech Specs\A3_Rev00B-4.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
0a243a1226d93d10ec94573783baeece

SHA1
4dc431b3bf192820450e85a78eb78eb08241c3c0

SHA256
71052d99fbabeaf3a3259deb31d410594dd627f489e6aae15c0498638f577b57

SHA512
7b48a4a23ea1a9058db366a711f586e386eaf25fef671afff318724193523028944d94aa82cfd194b5d80ce6e8fcdacfeb533c33eeb5e8c1523b4afdb0a309c8

Download Submit