8afb5f67a8e982c5e09c46cc115d65a5f18e5afa9378a1710828064d1fe277f5 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 08:30

Sharing

Report Analysis Logs

General

Target

Rechnung Werkstatt 12879.pdf
Size

285KB
MD5

be57f4c2ec555dc6b20725313240640f
SHA1

5e80608c09e45e1d2ae35c0053d7380f4904eb1b
SHA256

8afb5f67a8e982c5e09c46cc115d65a5f18e5afa9378a1710828064d1fe277f5
SHA512

9317fa318a16b98efe308fbbb07320429adc6b76af39476079a28a81b7bdb0d424e9c86aeaa200fc8499044ff8976ca213f7ebf80bac7e1285c47b4c697e9b51
SSDEEP

6144:ffi9sstakaoDsESwLpMe1p3DNE28y2Ngo72FcO0LGll:fKnRZPpMUzO28n72FN0LGf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2392	AcroRd32.exe
2392	AcroRd32.exe
2392	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Rechnung Werkstatt 12879.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d5b1944e1ff9650559c665fad221751e

SHA1
591cfa381b694e4b1435cb8e0b4c0ee08b4928e8

SHA256
f49de5f1235a21899d36908596239199e0a8f88403114e119755dfd60592c059

SHA512
17a2d600a4228e56381436f44aa65b4e84f7b65557ed9914ad374e4e40720b4505825da7ce09c5f691d7634b25d96c355b1f46899356d05753bed502f3ac8988

Download Submit