874ab0c4c76ffb4b7c7149016fa2346ae8b209fd35083901009f053e08815b40 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 13:56

Sharing

Report Analysis Logs

General

Target

Mockingbird.pdf
Size

29KB
MD5

ebaa5ba501a915363a159fac7d7930b0
SHA1

57d88e8e2bd130714d8f3dc9499b992c57cc4fd4
SHA256

874ab0c4c76ffb4b7c7149016fa2346ae8b209fd35083901009f053e08815b40
SHA512

a3ee8fb103a1dda7fa51258cdfd4aa0fb15e14e4fc7e4e08bb27464ea4d8d40b96c1cf23ecd24f5a542b18cfa1b4f56ab9f8696d3cd7d9d9887a8ce8be83622e
SSDEEP

768:+0nKgBb6RUCNRefU+Lf+srnmbZj6nGw0f+xyTxftouwARIcT:ExnszLf3mbYGuEbouz

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2836	AcroRd32.exe
2836	AcroRd32.exe
2836	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Mockingbird.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
749a194ef0571724fa7bc1316919da0a

SHA1
dfc5494c2d23ffa4d1d89d8b1918e0403a329459

SHA256
43e4ae95b53ba5e77f44548dd713d277ac213bc4090e54508f7d7362dbd98dcf

SHA512
1421144d290f105f7dff15cc06f2c4c91132a7931e5c16c72c16d588b5f6720d11f833b8c739032c339e56df87fb66627a87f9377890ad054b4dbc74a759f5d7

Download Submit