Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 11:57 UTC

General

  • Target

    340a3f8d03b7f73ee50b7d7abcaff7f0_NeikiAnalytics.pdf

  • Size

    70KB

  • MD5

    340a3f8d03b7f73ee50b7d7abcaff7f0

  • SHA1

    bf489ace2f2c059d04682e75e8aec251e27ab406

  • SHA256

    1ada0763de58b7cbf45b6b92d8d9104fc73ecc26b3346552e68eb4b587b66910

  • SHA512

    dfba00b909ef0c6c27569d7877f502cf1c8b020808e0392b5d47bde58bc5de2320f6d848ce13df20e12336b0159a9ace26b2ce7ec31ad03588a449ade8aa49e7

  • SSDEEP

    1536:/EgHieK1BpeMBjZZYF4ePN7XYX0qK583nzvTLZSlJWALC:lpSpeMZZZYF4ePNXq0X583zvUly

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\340a3f8d03b7f73ee50b7d7abcaff7f0_NeikiAnalytics.pdf"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    f9154ebf76e4fcdaa0a6cb5166ba067a

    SHA1

    4c6193e20cdeba661a46dd850650a9746d401bf3

    SHA256

    81d87b8588d22dc41c44defd2a238b4a45cd15b5128dfc5c4755e8ba197829a8

    SHA512

    c6025a7607bd100fa6059ca4629b6b65d86ed6980a9d9c0937e338b0f209898d5c3b29460322d9b4207d2befe8ac92bddd52393a4e0816021c01f1d9e759b00d

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.