2661ec0a0e9292c580ae663ffad6b19e860278dfa681af9e49db137819b9bd16 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:07

Sharing

Report Analysis Logs

General

Target

DE/OpenVPN-License.pdf
Size

498KB
MD5

b4d2304eaf695ea736267d711f51c744
SHA1

87f98beffe523b56120272636e0b68fa16ff5aae
SHA256

9ec9a8a661ffec35799b707717380ee4ba828dae8ca7dd2cdff8883d2a10107b
SHA512

de59557d374c23edc73dc7e3b440cbaf48bbd1805970a239844f7833b5a96b14ea0990d415890f5e0376530e0a28107d62dfece7e984cce1218ec18557b977b2
SSDEEP

12288:iRIasjj4EWwuOpc8UcFUgj3j8qkrvR/FrPg:iRlsjM3w5p0cXjjxERg

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2288 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2288 AcroRd32.exe
2288 AcroRd32.exe
2288 AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DE\OpenVPN-License.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1cf3cc5f6f9cb1fc5750a7d6f9772218

SHA1
cb67ba16d504127d1b7c8f38abe3aabcbdcab300

SHA256
0b984e1e47b68852c1bf6808fc3cea3fe66af072b2197c70efce06fdec6e13be

SHA512
48816743af946656863917ded9f8256de4f0d56f58fac51c2a80a8c2ca1d7ecc9ccd045bd6a673edb91cc756bd52126a5f9a44080608abc84bc89c36829e4ff0

Download Submit