341f97e83e1ccfe0a11dc3211ae5d1211268ac63c9b6c2c778b3b4ae60864e55 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 09:30

Sharing

Report Analysis Logs

General

Target

15 Cable 4.0/rhodiatongue.pdf
Size

410KB
MD5

58fe5c7724f291173b865a4e38a70990
SHA1

2510e72f6d074e4afb94e7fe5a948dbd95cdd006
SHA256

0dd9b5e63cacf6a3bd93f8eaa4b953ab4f539a5dc9e09858500f2ee28f6fd30d
SHA512

fcd9b1a639b0a46b43f6e5012f265b4110d60dae9c420004cc9f7f2e893b9bfa0bf146c7d93af7e95efcf0c34947a80383ff30babcdb1956d0625e467c8433b0
SSDEEP

6144:ETp0UnLmc+Ltc+QI8BYnf6QjJMkXbbTh//e7kf76b4n:Eec+LtcgQYnfHXHUgfWq

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1724 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1724 AcroRd32.exe
1724 AcroRd32.exe
1724 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\15 Cable 4.0\rhodiatongue.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1724

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
b81dcd37ffef949c614ca481116efb14

SHA1
b3202c896f78b11b227c7a89caa331ac86ca476a

SHA256
148b055107dcb04d7acb1b19efec8f40af33ed376a41160134c11a1063fa278b

SHA512
5e2dca25ca70e0a2f21a00769fd09963caf8d9624d45eda9bb8088db87b666105b372229b7a237b4867777ea33ec4fb22f9eaeeee7c3c31e17a97a34c4f94015

Download Submit