Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 13:16
Behavioral task
behavioral1
Sample
CN-Blockchain-dark-forest-selfguard-handbook-V1.1.pdf
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
CN-Blockchain-dark-forest-selfguard-handbook-V1.1.pdf
Resource
win10v2004-20240709-en
General
-
Target
CN-Blockchain-dark-forest-selfguard-handbook-V1.1.pdf
-
Size
2.8MB
-
MD5
b333c5ad8572adc14aa0100b952e209e
-
SHA1
82551e53fec80f844609224bf4001f0b6376a43c
-
SHA256
ed2ae6022d434ea984d1c0e7599b358bbd97b8022d7c1dcf85610caebe8240fa
-
SHA512
2cd19c72687d2a538fe9759ad7c005278d0e6925bb8a1b462dbdf9274b7cd755f556228a16f67d7453629ffdd3b78691ca1cedba8af2cf6623a8d8c451358c62
-
SSDEEP
49152:WAy+iIi0wNI5egBK6OfM2ZJ0Z/68o9idNyPmYPnMh0mOU70V0EKGk0m3j:WAd/ILFZFSdN0mJ0/Ay05Gdw
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3044 AcroRd32.exe 3044 AcroRd32.exe 3044 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CN-Blockchain-dark-forest-selfguard-handbook-V1.1.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3044
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53c765c13ba6c44599d8b02b2986399d3
SHA1d1d6c3c5f60dadcd17f4f069d3f7c6a1c9d03e84
SHA25611ed012c815e0a6f29f963cbec312d158a65c54d5e317f91c0e3d653c2243d9b
SHA5123bee3d946709dac023a14ac1b570617458536105d35b8acc29c29553976d0c50e5c056f87433cb34457da257b2d748b12b88bbc4b1172648609f85f696b240b9