Overview
overview
6Static
static
6W8 or Cert...ms.pdf
windows7-x64
4W8 or Cert...ms.pdf
windows10-2004-x64
3Certificat...us.pdf
windows7-x64
3Certificat...us.pdf
windows10-2004-x64
3W-8BEN Ind...ls.pdf
windows7-x64
3W-8BEN Ind...ls.pdf
windows10-2004-x64
3W-8BEN-E Entities.pdf
windows7-x64
3W-8BEN-E Entities.pdf
windows10-2004-x64
3W-8ECI Inc...ss.pdf
windows7-x64
3W-8ECI Inc...ss.pdf
windows10-2004-x64
3W-8EXP Tax Exempt.pdf
windows7-x64
3W-8EXP Tax Exempt.pdf
windows10-2004-x64
3W-8IMY For...ip.pdf
windows7-x64
3W-8IMY For...ip.pdf
windows10-2004-x64
3Analysis
-
max time kernel
41s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 23:13
Behavioral task
behavioral1
Sample
W8 or Certificate of Non-US Status Forms.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
W8 or Certificate of Non-US Status Forms.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Certificate of Non-US Status.pdf
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Certificate of Non-US Status.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
W-8BEN Individuals.pdf
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
W-8BEN Individuals.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
W-8BEN-E Entities.pdf
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
W-8BEN-E Entities.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
W-8ECI Income connected with trade and business.pdf
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
W-8ECI Income connected with trade and business.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
W-8EXP Tax Exempt.pdf
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
W-8EXP Tax Exempt.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
W-8IMY Foreign Partnership.pdf
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
W-8IMY Foreign Partnership.pdf
Resource
win10v2004-20240802-en
General
-
Target
W8 or Certificate of Non-US Status Forms.pdf
-
Size
772KB
-
MD5
e975fd397949dc5300618c93eb0b038c
-
SHA1
6795bb2f71da658d4d8eeb580bbe562b50c46d3e
-
SHA256
31e2ac1d5595bba0ab7edbb7275f3eb35e4f68c640ae7bb8ec35401199efb55c
-
SHA512
c12c6426c3df8c354e5ca64241b7fe893b8e955fd428cec66f57225c7ba15539387433bcf6f5859b722701ab1103a1d0bbe2da381e5224c42813538e79f08f19
-
SSDEEP
24576:nPMAf9m9t2hFk4WAE9RTNWDUhKnc7updG8Fs1:UAlm9tojlTUhIz5C1
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
AcroRd32.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico AcroRd32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1512 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
AcroRd32.exepid process 1512 AcroRd32.exe 1512 AcroRd32.exe 1512 AcroRd32.exe 1512 AcroRd32.exe 1512 AcroRd32.exe 1512 AcroRd32.exe 1512 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\W8 or Certificate of Non-US Status Forms.pdf"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD54618312ec50b52c81043bb6ff393cfc3
SHA180537497d939529b34de993b14d96510068bf075
SHA256e8e27396e2a043abd283eed4fd5b8fa256cc22e741defd522158fc9e29205839
SHA512fc589a974f35ee83c297784c7d7cc62826854422ceec2d5ff46aa6575f5b2bade27d26c1dfc0686602c81e5c14f75f7abd23e6c19fd90a2dbe70e0f5c09251e9
-
Filesize
3KB
MD51f64f9aa7fad50c3c5a7ef881a6ee113
SHA12d29ee5fb37f2df4e2c731f45f3af58f66664a42
SHA25629d648382e1e4d381f8b12587e181c1d5afd9778d51da357ae736da78ceffabc
SHA512946a3eabf8deeda442067f227df068ec3eb2ff93cacc83e4a767023f95106e0de0c640e1c4bdd1b460c7ac84c5d9869d2bca6ba0d663e8c37bd7c9105c37fed5