6d83c73d85a94eb72a0e80eff70f15ff89a7565db02b0d0a585b0c9da1c83b71 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 16:18

Sharing

Report Analysis Logs

General

Target

Scheidung.pdf
Size

129KB
MD5

ca2b2c56cc2ad313ed19b5bd9666cdb6
SHA1

b30fbc21d70080cee0c057cbddb4dc8e526c61a2
SHA256

6d83c73d85a94eb72a0e80eff70f15ff89a7565db02b0d0a585b0c9da1c83b71
SHA512

291be15bda7d3f5dc44830173cfe2e84a31bc7e69e098c9a770556c44e32eaff67a70ecbdaca5b9773ae58d0cea176fcbe0ccfa57bd042255a73923455213d7b
SSDEEP

1536:ps0hHilVzKkfVUeHZs9+xqRZJEiWo+MVGSaNvVCOjpesVFg/8oT7VXYQv:1HeNKkDZs9WqRZFlAt9fVe0KWY

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2984	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2984	AcroRd32.exe
2984	AcroRd32.exe
2984	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Scheidung.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
961f19f9ed0acec0e014ae3995d5d06f

SHA1
3a3ffd83a9977b982c1935ae2c480dfb3f25f5d2

SHA256
9a86e603fbff97246f3293e35f6da8492906a87e86f79d6da2f993e261666f95

SHA512
0a9ab868e21c931a3f375bdc9f9617ff26d219140d4862d3337f9d961ba9d578e4998bfa90fb8403d08d3ddc396f56147ba37c9fc3d7936e1b7db44406121040

Download Submit