Overview
overview
4Static
static
4AIR FORCE/...FP.pdf
windows7-x64
1AIR FORCE/...FP.pdf
windows10-2004-x64
1AIR FORCE/...ed.pdf
windows7-x64
1AIR FORCE/...ed.pdf
windows10-2004-x64
1AIR FORCE/...T).pdf
windows7-x64
1AIR FORCE/...T).pdf
windows10-2004-x64
1AIR FORCE/... 1.pdf
windows7-x64
1AIR FORCE/... 1.pdf
windows10-2004-x64
1AIR FORCE/...22.pdf
windows7-x64
1AIR FORCE/...22.pdf
windows10-2004-x64
1AIR FORCE/...ce.pdf
windows7-x64
1AIR FORCE/...ce.pdf
windows10-2004-x64
1AIR FORCE/...02.pdf
windows7-x64
1AIR FORCE/...02.pdf
windows10-2004-x64
1AIR FORCE/...05.pdf
windows7-x64
1AIR FORCE/...05.pdf
windows10-2004-x64
1AIR FORCE/...1 .pdf
windows7-x64
1AIR FORCE/...1 .pdf
windows10-2004-x64
1AIR FORCE/...ed.pdf
windows7-x64
1AIR FORCE/...ed.pdf
windows10-2004-x64
1AIR FORCE/...19.pdf
windows7-x64
1AIR FORCE/...19.pdf
windows10-2004-x64
1AIR FORCE/...AL.pdf
windows7-x64
1AIR FORCE/...AL.pdf
windows10-2004-x64
1AIR FORCE/...17.pdf
windows7-x64
1AIR FORCE/...17.pdf
windows10-2004-x64
1AIR FORCE/...20.pdf
windows7-x64
1AIR FORCE/...20.pdf
windows10-2004-x64
1AIR FORCE/...ts.pdf
windows7-x64
1AIR FORCE/...ts.pdf
windows10-2004-x64
1AIR FORCE/...30.pdf
windows7-x64
1AIR FORCE/...30.pdf
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 15:46
Behavioral task
behavioral1
Sample
AIR FORCE/3. TMQ53 CLS PWS-RFP.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
AIR FORCE/3. TMQ53 CLS PWS-RFP.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
AIR FORCE/Attachment 0013g - D-IBCS-0471_Delta2_Suppl_PE_redacted.pdf
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
AIR FORCE/Attachment 0013g - D-IBCS-0471_Delta2_Suppl_PE_redacted.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
AIR FORCE/Attachment_7_-_Compliance_and_Reference_Documents_(DRAFT).pdf
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
AIR FORCE/Attachment_7_-_Compliance_and_Reference_Documents_(DRAFT).pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
AIR FORCE/DRAFT JNWC-IV-IDIQ Work Statement v. 1.pdf
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
AIR FORCE/DRAFT JNWC-IV-IDIQ Work Statement v. 1.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
AIR FORCE/Draft GRIM SOW 7 Nov 2022.pdf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
AIR FORCE/Draft GRIM SOW 7 Nov 2022.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
AIR FORCE/FTUAS Applicable Documents for Reference.pdf
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
AIR FORCE/FTUAS Applicable Documents for Reference.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
AIR FORCE/GEN-12-AMAM-02.pdf
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
AIR FORCE/GEN-12-AMAM-02.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
AIR FORCE/HSIP_FY21_SOW_BusinessPoints_20210105.pdf
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
AIR FORCE/HSIP_FY21_SOW_BusinessPoints_20210105.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
AIR FORCE/HYDRA PWS_Draft_RFI V1 .pdf
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
AIR FORCE/HYDRA PWS_Draft_RFI V1 .pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
AIR FORCE/PBL_PWS_-_DRAFT_02212019.pdf
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
AIR FORCE/PBL_PWS_-_DRAFT_02212019.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
AIR FORCE/PSIR-APC-01 Industry Day 4_21_2021 FINAL.pdf
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
AIR FORCE/PSIR-APC-01 Industry Day 4_21_2021 FINAL.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
AIR FORCE/Polaris_Draft_SOW_1_Jun_2017.pdf
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
AIR FORCE/Polaris_Draft_SOW_1_Jun_2017.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
AIR FORCE/RFI_FMI_11192020.pdf
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
AIR FORCE/RFI_FMI_11192020.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
AIR FORCE/Site Visit Sign In Sheets.pdf
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
AIR FORCE/Site Visit Sign In Sheets.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
AIR FORCE/VoICE Industry Day Presentation 20200930.pdf
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
AIR FORCE/VoICE Industry Day Presentation 20200930.pdf
Resource
win10v2004-20240508-en
General
-
Target
AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf
-
Size
856KB
-
MD5
47078052d5ab665b327be8e36a6599a8
-
SHA1
dfb8db0769a680baceba07f07d15ab2dd6d44baa
-
SHA256
c5cd043fb57b0ff49d539ba937460c8f048c03984bccd544b9a0a8010e8b4cbf
-
SHA512
3592af9494cb8c1e51206aaf1b09f7cda203f06d44c94bbe46a5ba56dd98638bdb8676778b8ed50f19dec47be497dd6d3a75618d7623b0a657b9196239a10b67
-
SSDEEP
12288:DccFx6IUA/GREWcchalfMj+BMpWccc43WeEImLgjVccJIhGcdvQEzs:DD0IUDgCqJ2xeB6gjVyrds
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2036 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2036 AcroRd32.exe 2036 AcroRd32.exe 2036 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AIR FORCE\LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2036
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d9b572e0b237e161d5efa8479c6df2d9
SHA13cad347a9def6652d2b6500b8596961a7e9cc754
SHA256bfed65b188c9ff358b4abcf1833a888e053959b9741a80104533c2e9f9c36b5b
SHA512f296db0294b13cc5d687c8ccd608f36127996e8ef7a3d81cddf642b0abf1ca4ba613ec87e87bbafb9f489e6aa22201a97ad1213e45a47ce5aaca07cdd3c14f25