Overview
overview
10Static
static
10OSbot judi...ve.pdf
windows7-x64
1OSbot judi...ve.pdf
windows10-2004-x64
1OSbot judi...rd.pdf
windows7-x64
1OSbot judi...rd.pdf
windows10-2004-x64
1OSbot judi...nd.pdf
windows7-x64
1OSbot judi...nd.pdf
windows10-2004-x64
1OSbot judi...lp.pdf
windows7-x64
1OSbot judi...lp.pdf
windows10-2004-x64
1OSbot judi...me.pdf
windows7-x64
1OSbot judi...me.pdf
windows10-2004-x64
1OSbot judi...ib.pdf
windows7-x64
1OSbot judi...ib.pdf
windows10-2004-x64
1OSbot judi...ve.pdf
windows7-x64
1OSbot judi...ve.pdf
windows10-2004-x64
1OSbot judi...ns.pdf
windows7-x64
1OSbot judi...ns.pdf
windows10-2004-x64
1OSbot judi...ts.pdf
windows7-x64
1OSbot judi...ts.pdf
windows10-2004-x64
1OSbot judi...ct.pdf
windows7-x64
1OSbot judi...ct.pdf
windows10-2004-x64
1OSbot judi...t__.py
windows7-x64
3OSbot judi...t__.py
windows10-2004-x64
3OSbot judi...10.pyc
windows7-x64
3OSbot judi...10.pyc
windows10-2004-x64
3OSbot judi...10.pyc
windows7-x64
3OSbot judi...10.pyc
windows10-2004-x64
3OSbot judi...10.pyc
windows7-x64
3OSbot judi...10.pyc
windows10-2004-x64
3OSbot judi...bot.py
windows7-x64
3OSbot judi...bot.py
windows10-2004-x64
3OSbot judi...t__.py
windows7-x64
3OSbot judi...t__.py
windows10-2004-x64
3Resubmissions
03/05/2024, 18:40
240503-xa7xwagb26 1003/05/2024, 18:19
240503-wynngach5t 1003/05/2024, 15:38
240503-s26fxaad2t 10Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 18:19
Behavioral task
behavioral1
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/filesave.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/filesave.pdf
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/forward.pdf
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/forward.pdf
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/hand.pdf
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/hand.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/help.pdf
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/help.pdf
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/home.pdf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/home.pdf
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/matplotlib.pdf
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/matplotlib.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/move.pdf
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/move.pdf
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/qt4_editor_options.pdf
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/qt4_editor_options.pdf
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/subplots.pdf
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/subplots.pdf
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/zoom_to_rect.pdf
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
OSbot judicable/_internal/matplotlib/mpl-data/images/zoom_to_rect.pdf
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
OSbot judicable/_internal/model/__init__.py
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
OSbot judicable/_internal/model/__init__.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
OSbot judicable/_internal/model/__pycache__/__init__.cpython-310.pyc
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
OSbot judicable/_internal/model/__pycache__/__init__.cpython-310.pyc
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
OSbot judicable/_internal/model/__pycache__/bot.cpython-310.pyc
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
OSbot judicable/_internal/model/__pycache__/bot.cpython-310.pyc
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
OSbot judicable/_internal/model/__pycache__/runelite_bot.cpython-310.pyc
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
OSbot judicable/_internal/model/__pycache__/runelite_bot.cpython-310.pyc
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
OSbot judicable/_internal/model/bot.py
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
OSbot judicable/_internal/model/bot.py
Resource
win10v2004-20240419-en
Behavioral task
behavioral31
Sample
OSbot judicable/_internal/model/near_reality/__init__.py
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
OSbot judicable/_internal/model/near_reality/__init__.py
Resource
win10v2004-20240419-en
General
-
Target
OSbot judicable/_internal/matplotlib/mpl-data/images/hand.pdf
-
Size
4KB
-
MD5
b3b3fa6ded8eb65c3558cb62dee66094
-
SHA1
e47c3b24f90332d1291b8fa9787c76f433cd6cd3
-
SHA256
86ca7090d63dd7928f0fb00c5a7550b3b2c53ceb65723d155222eeefa74c69b4
-
SHA512
0ec03b7dc38458611143b161cb5527fe171a7b682da6612e74aaa7be3e5dc74eb61763b19f2d312ae20f887cff05ecef52ebb34cc70c2dd92ada549525f7f978
-
SSDEEP
96:cWOoFQJL+JxMXH+8qBsJSBVcSp6+XWcb2Dn591q:cLoMk98nSXZ4+TmnM
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1648 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1648 AcroRd32.exe 1648 AcroRd32.exe 1648 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OSbot judicable\_internal\matplotlib\mpl-data\images\hand.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1648
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD532175bb9cf70df513c14981306f38310
SHA1af9dfe89737dfc8b567419a0f39fcedda64a1e8b
SHA256576d2653e9ab766e1bed5f31f917b600508da2497be1187be33e726392420626
SHA51283b842f61383692d145afeb20b4297bd2119faaacb00dd337217c44dd670163f8a989d39c533a19699c1ebb585df48048b02bfbc5c558397d42e1f8fce3d8f6a