Overview
overview
1Static
static
1202404-925...VE.pdf
windows7-x64
1202404-925...VE.pdf
windows10-2004-x64
1925 silver...VE.pdf
windows7-x64
1925 silver...VE.pdf
windows10-2004-x64
1NewColl...24.pdf
windows7-x64
1NewColl...24.pdf
windows10-2004-x64
1Small jewe...er.pdf
windows7-x64
1Small jewe...er.pdf
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
202404-925 silver jewelries New collection-TOLOVE.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
202404-925 silver jewelries New collection-TOLOVE.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
925 silver jewelries New collections-April TOLOVE.pdf
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
925 silver jewelries New collections-April TOLOVE.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
NewCollection of sweet heart series2024.pdf
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
NewCollection of sweet heart series2024.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
Small jewelry series-925 sterling silver.pdf
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
Small jewelry series-925 sterling silver.pdf
Resource
win10v2004-20240412-en
General
-
Target
925 silver jewelries New collections-April TOLOVE.pdf
-
Size
5.2MB
-
MD5
289bd064458d06b6ec837c45ed003ee0
-
SHA1
11baca37598c758668e16e03c807b8ce55030985
-
SHA256
a73594e9387f5efa5a58491138bc5f37bea5b93915081f852836ff872cb0a225
-
SHA512
a3aa277c33c08aecdcfc59b5c866ae4eeb6c01cf114696d49dcd046978a0ab4a990138cd19c82f236aab1929eec72793da312d7ff99e3dca184735fdc719314d
-
SSDEEP
98304:XLT8o4un16ekCW51RV+/+QHc5BPDPQB/e5pC:XLT8HIBY+H8zbPQ45pC
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1308 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1308 AcroRd32.exe 1308 AcroRd32.exe 1308 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\925 silver jewelries New collections-April TOLOVE.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1308
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fc0c45419c9ab5e2761b1f97a5a3cd9c
SHA15055f9b4890b2da542ae448071db8ce330d776e2
SHA25658d3a2c74add979bcaaecd6b6b30fdfb52518f5aa7cd10c5eabf63f5298102e8
SHA5129ddf2e704c12cc6ec49de3ef3cb54ed35811a8239833f2d8c00de11df644d8cb59d0ee1a3ac01293012d76159271a0e0f6a3e042a3f32c8337d47bf50510709b