1c371280ef5ddb832d5534e015869a5fe79a379649c64b69160533b81a219e46

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

AIR FORCE/...FP.pdf

windows7-x64

AIR FORCE/...FP.pdf

windows10-2004-x64

AIR FORCE/...ed.pdf

windows7-x64

AIR FORCE/...ed.pdf

windows10-2004-x64

AIR FORCE/...T).pdf

windows7-x64

AIR FORCE/...T).pdf

windows10-2004-x64

AIR FORCE/... 1.pdf

windows7-x64

AIR FORCE/... 1.pdf

windows10-2004-x64

AIR FORCE/...22.pdf

windows7-x64

AIR FORCE/...22.pdf

windows10-2004-x64

AIR FORCE/...ce.pdf

windows7-x64

AIR FORCE/...ce.pdf

windows10-2004-x64

AIR FORCE/...02.pdf

windows7-x64

AIR FORCE/...02.pdf

windows10-2004-x64

AIR FORCE/...05.pdf

windows7-x64

AIR FORCE/...05.pdf

windows10-2004-x64

AIR FORCE/...1 .pdf

windows7-x64

AIR FORCE/...1 .pdf

windows10-2004-x64

AIR FORCE/...ed.pdf

windows7-x64

AIR FORCE/...ed.pdf

windows10-2004-x64

AIR FORCE/...19.pdf

windows7-x64

AIR FORCE/...19.pdf

windows10-2004-x64

AIR FORCE/...AL.pdf

windows7-x64

AIR FORCE/...AL.pdf

windows10-2004-x64

AIR FORCE/...17.pdf

windows7-x64

AIR FORCE/...17.pdf

windows10-2004-x64

AIR FORCE/...20.pdf

windows7-x64

AIR FORCE/...20.pdf

windows10-2004-x64

AIR FORCE/...ts.pdf

windows7-x64

AIR FORCE/...ts.pdf

windows10-2004-x64

AIR FORCE/...30.pdf

windows7-x64

AIR FORCE/...30.pdf

windows10-2004-x64

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Static task

static1

pdf link

2 signatures

Behavioral task

behavioral1

Sample

AIR FORCE/3. TMQ53 CLS PWS-RFP.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

AIR FORCE/3. TMQ53 CLS PWS-RFP.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

AIR FORCE/Attachment 0013g - D-IBCS-0471_Delta2_Suppl_PE_redacted.pdf

Resource

win7-20240215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

AIR FORCE/Attachment 0013g - D-IBCS-0471_Delta2_Suppl_PE_redacted.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral5

Sample

AIR FORCE/Attachment_7_-_Compliance_and_Reference_Documents_(DRAFT).pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

AIR FORCE/Attachment_7_-_Compliance_and_Reference_Documents_(DRAFT).pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral7

Sample

AIR FORCE/DRAFT JNWC-IV-IDIQ Work Statement v. 1.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

AIR FORCE/DRAFT JNWC-IV-IDIQ Work Statement v. 1.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral9

Sample

AIR FORCE/Draft GRIM SOW 7 Nov 2022.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

AIR FORCE/Draft GRIM SOW 7 Nov 2022.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral11

Sample

AIR FORCE/FTUAS Applicable Documents for Reference.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

AIR FORCE/FTUAS Applicable Documents for Reference.pdf

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral13

Sample

AIR FORCE/GEN-12-AMAM-02.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

AIR FORCE/GEN-12-AMAM-02.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral15

Sample

AIR FORCE/HSIP_FY21_SOW_BusinessPoints_20210105.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

AIR FORCE/HSIP_FY21_SOW_BusinessPoints_20210105.pdf

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral17

Sample

AIR FORCE/HYDRA PWS_Draft_RFI V1 .pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

AIR FORCE/HYDRA PWS_Draft_RFI V1 .pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral19

Sample

AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

AIR FORCE/LCMP-IDE_Follow-on_Exception_to_Fair_Opportunity_Justification_(004)_Redacted.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral21

Sample

AIR FORCE/PBL_PWS_-_DRAFT_02212019.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

AIR FORCE/PBL_PWS_-_DRAFT_02212019.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral23

Sample

AIR FORCE/PSIR-APC-01 Industry Day 4_21_2021 FINAL.pdf

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral24

Sample

AIR FORCE/PSIR-APC-01 Industry Day 4_21_2021 FINAL.pdf

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral25

Sample

AIR FORCE/Polaris_Draft_SOW_1_Jun_2017.pdf

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

AIR FORCE/Polaris_Draft_SOW_1_Jun_2017.pdf

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral27

Sample

AIR FORCE/RFI_FMI_11192020.pdf

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

AIR FORCE/RFI_FMI_11192020.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral29

Sample

AIR FORCE/Site Visit Sign In Sheets.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

AIR FORCE/Site Visit Sign In Sheets.pdf

Resource

win10v2004-20240226-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral31

Sample

AIR FORCE/VoICE Industry Day Presentation 20200930.pdf

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

AIR FORCE/VoICE Industry Day Presentation 20200930.pdf

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Report Analysis Logs

General

Target

AIR FORCE/Draft GRIM SOW 7 Nov 2022.pdf
Size

547KB
MD5

f2960ff82d36a81e4c1984d46faf27e8
SHA1

f1105b203f62368c2728745cb63099a781425357
SHA256

8c768d7cf361ef2d214b64c3e57a08bdf21ba8871dba9e77f826044646f25341
SHA512

d664320fa63f2ae50a18c7b95fa4933d8308fb1a5b033889c77870329da6ffce4f2e88a2464ad66279f5cf8e61f7a3999238685146f1d55ced815758636f6903
SSDEEP

12288:fo2fadcsVXTFlSk5umOTKo53RZtLNaPYor2u5SzL:fo2f8nrpOT55ZNaFCQS/

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2888	AcroRd32.exe
2888	AcroRd32.exe
2888	AcroRd32.exe
2888	AcroRd32.exe

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AIR FORCE\Draft GRIM SOW 7 Nov 2022.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d1e78ee11bb7bb918575b6809ea9e8c9

SHA1
410ed3600fec06dc8e8a9a5b34f75cbed679fdf8

SHA256
1662de06503326d7280f64d0cec95cf9c33dcd5c413f03957191f626c04e2eb4

SHA512
c56a190808b6d7c750eef6b93377f3515b4491b8f5632b07140b1b84dd8a411fae8db720c83d1892a3bcc1e9be5aa15c7668933c064ae5d269c64f468b4f0fe3

Download Submit