1c371280ef5ddb832d5534e015869a5fe79a379649c64b69160533b81a219e46

Submit
Reports

Overview

overview

Static

static

AIR FORCE/...FP.pdf

windows7-x64

AIR FORCE/...FP.pdf

windows10-2004-x64

AIR FORCE/...ed.pdf

windows7-x64

AIR FORCE/...ed.pdf

windows10-2004-x64

AIR FORCE/...T).pdf

windows7-x64

AIR FORCE/...T).pdf

windows10-2004-x64

AIR FORCE/... 1.pdf

windows7-x64

AIR FORCE/... 1.pdf

windows10-2004-x64

AIR FORCE/...22.pdf

windows7-x64

AIR FORCE/...22.pdf

windows10-2004-x64

AIR FORCE/...ce.pdf

windows7-x64

AIR FORCE/...ce.pdf

windows10-2004-x64

AIR FORCE/...02.pdf

windows7-x64

AIR FORCE/...02.pdf

windows10-2004-x64

AIR FORCE/...05.pdf

windows7-x64

AIR FORCE/...05.pdf

windows10-2004-x64

AIR FORCE/...1 .pdf

windows7-x64

AIR FORCE/...1 .pdf

windows10-2004-x64

AIR FORCE/...ed.pdf

windows7-x64

AIR FORCE/...ed.pdf

windows10-2004-x64

AIR FORCE/...19.pdf

windows7-x64

AIR FORCE/...19.pdf

windows10-2004-x64

AIR FORCE/...AL.pdf

windows7-x64

AIR FORCE/...AL.pdf

windows10-2004-x64

AIR FORCE/...17.pdf

windows7-x64

AIR FORCE/...17.pdf

windows10-2004-x64

AIR FORCE/...20.pdf

windows7-x64

AIR FORCE/...20.pdf

windows10-2004-x64

AIR FORCE/...ts.pdf

windows7-x64

AIR FORCE/...ts.pdf

windows10-2004-x64

AIR FORCE/...30.pdf

windows7-x64

AIR FORCE/...30.pdf

windows10-2004-x64

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 15:46

Sharing

Copy URL

Twitter E-mail

Static task

static1

pdf link

2 signatures

Behavioral task

behavioral1

Sample

AIR FORCE/3. TMQ53 CLS PWS-RFP.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

AIR FORCE/3. TMQ53 CLS PWS-RFP.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

AIR FORCE/Attachment 0013g - D-IBCS-0471_Delta2_Suppl_PE_redacted.pdf

Resource

win7-20240215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

AIR FORCE/Attachment 0013g - D-IBCS-0471_Delta2_Suppl_PE_redacted.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral5

Sample

AIR FORCE/Attachment_7_-_Compliance_and_Reference_Documents_(DRAFT).pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

AIR FORCE/Attachment_7_-_Compliance_and_Reference_Documents_(DRAFT).pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral7

Sample

AIR FORCE/DRAFT JNWC-IV-IDIQ Work Statement v. 1.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

AIR FORCE/DRAFT JNWC-IV-IDIQ Work Statement v. 1.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral9

Sample

AIR FORCE/Draft GRIM SOW 7 Nov 2022.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

AIR FORCE/Draft GRIM SOW 7 Nov 2022.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral11

Sample

AIR FORCE/FTUAS Applicable Documents for Reference.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

AIR FORCE/FTUAS Applicable Documents for Reference.pdf

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral13

Sample

AIR FORCE/GEN-12-AMAM-02.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

AIR FORCE/GEN-12-AMAM-02.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral15

Sample

AIR FORCE/HSIP_FY21_SOW_BusinessPoints_20210105.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

AIR FORCE/HSIP_FY21_SOW_BusinessPoints_20210105.pdf

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral17

Sample

AIR FORCE/HYDRA PWS_Draft_RFI V1 .pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

AIR FORCE/HYDRA PWS_Draft_RFI V1 .pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral19

Sample

AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral21

Sample

AIR FORCE/PBL_PWS_-_DRAFT_02212019.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

AIR FORCE/PBL_PWS_-_DRAFT_02212019.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral23

Sample

AIR FORCE/PSIR-APC-01 Industry Day 4_21_2021 FINAL.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral24

Sample

AIR FORCE/PSIR-APC-01 Industry Day 4_21_2021 FINAL.pdf

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral25

Sample

AIR FORCE/Polaris_Draft_SOW_1_Jun_2017.pdf

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

AIR FORCE/Polaris_Draft_SOW_1_Jun_2017.pdf

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral27

Sample

AIR FORCE/RFI_FMI_11192020.pdf

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

AIR FORCE/RFI_FMI_11192020.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral29

Sample

AIR FORCE/Site Visit Sign In Sheets.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

AIR FORCE/Site Visit Sign In Sheets.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral31

Sample

AIR FORCE/VoICE Industry Day Presentation 20200930.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

AIR FORCE/VoICE Industry Day Presentation 20200930.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Report Analysis Logs

General

Target

AIR FORCE/Site Visit Sign In Sheets.pdf
Size

6.5MB
MD5

222bc41d73b52c4689f6d1524b38c48d
SHA1

e79ae0bec0a6b4bb2500849e8cdb2b3c3d967c6f
SHA256

771c6373bbdaf5bfbc254c99912629d6d6f941d50881a93d2151355d8dcdb481
SHA512

4e0a7ef451bceae74c3357e30f81decbfed662bfd2af7899f0ae60694dd6a75e04ffd94148126569f93ca198f6495767dee8c66a6e433b514ac7a924c0a786cf
SSDEEP

196608:ku/k5gVOzFA5feU5Zaps5ypGdijk3FdEkiW:zMO8RSP5ZGKy9jeIW

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2156	AcroRd32.exe
2156	AcroRd32.exe
2156	AcroRd32.exe

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AIR FORCE\Site Visit Sign In Sheets.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1500d9ff0365e538bf87c5f400eba35f

SHA1
1ca5617f88e1ae4e08f8df0060f3316764e7a238

SHA256
af529d3a2ae0133193b0f6d3a397b83026c75799c73b164610da72b6b794b7d5

SHA512
75ea9c1ddd520e3fbc4afe499393d28b038da9f6341f02af5809bdbba9036f49443a3b4bdd89cfebd37efa913dbb97502d1a443fd56e09ba69fb628c1a9de5b4

Download Submit