b4c3d3715f78fbed02598d490f0961fb512d7deaea514b905782a0683c96f8d8

Submit
Reports

Overview

overview

Static

static

BNG/Chenie...3.xlsx

windows7-x64

BNG/Chenie...3.xlsx

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...re.pdf

windows7-x64

Commercial...re.pdf

windows10-2004-x64

Commercial...-1.pdf

windows7-x64

Commercial...-1.pdf

windows10-2004-x64

Commercial...ce.pdf

windows7-x64

Commercial...ce.pdf

windows10-2004-x64

Fire Water...1.xlsx

windows7-x64

Fire Water...1.xlsx

windows10-2004-x64

Paddle, Bl...P.xlsx

windows7-x64

Paddle, Bl...P.xlsx

windows10-2004-x64

Paddle, Bl...s.xlsx

windows7-x64

Paddle, Bl...s.xlsx

windows10-2004-x64

Paddle, Bl...-4.pdf

windows7-x64

Paddle, Bl...-4.pdf

windows10-2004-x64

Paddle, Bl...-4.pdf

windows7-x64

Paddle, Bl...-4.pdf

windows10-2004-x64

Paddle, Bl...-4.pdf

windows7-x64

Paddle, Bl...-4.pdf

windows10-2004-x64

Paddle, Bl...-4.pdf

windows7-x64

Paddle, Bl...-4.pdf

windows10-2004-x64

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 11:59

Sharing

Copy URL

Twitter E-mail

Static task

static1

pdf link

1 signatures

Behavioral task

behavioral1

Sample

BNG/Cheniere AML Rev. 3.xlsx

Resource

win7-20240215-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

BNG/Cheniere AML Rev. 3.xlsx

Resource

win10v2004-20240412-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

Commercial Docs/COW - Confined Space Entry Permitting Procedure.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

Commercial Docs/COW - Confined Space Entry Permitting Procedure.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral5

Sample

Commercial Docs/COW - Energized Electrical Work Permitting Procedure.pdf

Resource

win7-20240215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

Commercial Docs/COW - Energized Electrical Work Permitting Procedure.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral7

Sample

Commercial Docs/COW - Energy Isolation Permitting Procedure.pdf

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

Commercial Docs/COW - Energy Isolation Permitting Procedure.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral9

Sample

Commercial Docs/COW - Excavation and Trenching Permitting Procedure.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

Commercial Docs/COW - Excavation and Trenching Permitting Procedure.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral11

Sample

Commercial Docs/COW - Lifting Operations Permitting Procedure.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

Commercial Docs/COW - Lifting Operations Permitting Procedure.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral13

Sample

Commercial Docs/COW - Permit to Work Procedure.pdf

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

Commercial Docs/COW - Permit to Work Procedure.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral15

Sample

Commercial Docs/Cheniere Prevailing Wage Labor Study - Heavy-1.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

Commercial Docs/Cheniere Prevailing Wage Labor Study - Heavy-1.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral17

Sample

Commercial Docs/Simultaneous Operations SIMOPS - Safe Work Practice.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

Commercial Docs/Simultaneous Operations SIMOPS - Safe Work Practice.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral19

Sample

Fire Water Specialties RFP/Cheniere AML Rev. 3-1.xlsx

Resource

win7-20240221-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral20

Sample

Fire Water Specialties RFP/Cheniere AML Rev. 3-1.xlsx

Resource

win10v2004-20240226-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral21

Sample

Paddle, Blanks and Spacers/Cheniere SP CO2 FEED - Paddles Blanks and Spacers RFP.xlsx

Resource

win7-20240221-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral22

Sample

Paddle, Blanks and Spacers/Cheniere SP CO2 FEED - Paddles Blanks and Spacers RFP.xlsx

Resource

win10v2004-20240412-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral23

Sample

Paddle, Blanks and Spacers/Specials - Paddles and Specs.xlsx

Resource

win7-20240215-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral24

Sample

Paddle, Blanks and Spacers/Specials - Paddles and Specs.xlsx

Resource

win10v2004-20240412-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

Paddle, Blanks and Spacers/Tech Specs/A2A_Rev00B-4.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

Paddle, Blanks and Spacers/Tech Specs/A2A_Rev00B-4.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral27

Sample

Paddle, Blanks and Spacers/Tech Specs/A3_Rev00B-4.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

Paddle, Blanks and Spacers/Tech Specs/A3_Rev00B-4.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral29

Sample

Paddle, Blanks and Spacers/Tech Specs/A5_Rev00B-4.pdf

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

Paddle, Blanks and Spacers/Tech Specs/A5_Rev00B-4.pdf

Resource

win10v2004-20240412-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral31

Sample

Paddle, Blanks and Spacers/Tech Specs/B1A_Rev00B-4.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

Paddle, Blanks and Spacers/Tech Specs/B1A_Rev00B-4.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Report Analysis Logs

General

Target

Paddle, Blanks and Spacers/Tech Specs/B1A_Rev00B-4.pdf
Size

414KB
MD5

cdd5318d21c82ed8dc63f86ea9afc4b7
SHA1

a5088f0218b00e497ecb67614c9e27230fb67324
SHA256

f7d525b7314605fded64b48e0a192c869e603b2e661fc28bfc867d7599c7d433
SHA512

532b68734fb62407d01decf6a9802495c2c0c47f458cc0345e5120826917e8abb88f1cf33e69caff14c0b8a48385041d13f5bab1ef614f4628c417fc7ddfa360
SSDEEP

12288:u1LdO8RSGm1guWFdZKsSNluzInXhz1cc75/hic:z1lW7VMNluMnXtWchN

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2300 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2300 AcroRd32.exe
2300 AcroRd32.exe
2300 AcroRd32.exe

pid	process
2300	AcroRd32.exe

pid	process
2300	AcroRd32.exe
2300	AcroRd32.exe
2300	AcroRd32.exe

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Paddle, Blanks and Spacers\Tech Specs\B1A_Rev00B-4.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
131376a8ff9065377bf716afc8aec9e2

SHA1
7e0ee07f81db9ce694f07ecd687f4ffe6a7e33a2

SHA256
56f1c549fcee1bf16796c19beb1c42733deac84a27e736e5bee3020768a05fcf

SHA512
9d1bfff04143dc596d76cbb8dc8251a03d343ab7c30350c46026dbc7211f8e3bc07744fa1e30c857d881b26c019fadb01c7cfd95228a5011c6af50f59235ac81

Download Submit