4c8e2d282a7f5e0c0f1142bfc9499fa39b7c6581d73b469e2e1a4569e9c6fc85 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 01:28

Sharing

Report Analysis Logs

General

Target

PO 50018137-14.pdf.exe
Size

1.2MB
MD5

7f3495645a47fbe0aed3b69518af96c3
SHA1

91a01966c9007daed292e9a7fcacc29cac90abe9
SHA256

ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953
SHA512

78ba7f692c8d207a8e9685c83d06fd25fd3e6297ed757ffa15e4ee68fa852bdb802fdf1a680b58512c32755356a3ef961c5e8bcec986a8099df8f172b96e240b
SSDEEP

24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aOuLpHmBzFFM1ONQ9:LTvC/MTQYxsWR7aOuezPXy

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

PO 50018137-14.pdf.exe

pid process

2192 PO 50018137-14.pdf.exe
2192 PO 50018137-14.pdf.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

PO 50018137-14.pdf.exe

pid process

2192 PO 50018137-14.pdf.exe
2192 PO 50018137-14.pdf.exe

C:\Users\Admin\AppData\Local\Temp\PO 50018137-14.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO 50018137-14.pdf.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-10-0x00000000001E0000-0x00000000001E4000-memory.dmp

Filesize
16KB

Download