Overview
overview
6Static
static
6W8 or Cert...ms.pdf
windows7-x64
4W8 or Cert...ms.pdf
windows10-2004-x64
3Certificat...us.pdf
windows7-x64
3Certificat...us.pdf
windows10-2004-x64
3W-8BEN Ind...ls.pdf
windows7-x64
3W-8BEN Ind...ls.pdf
windows10-2004-x64
3W-8BEN-E Entities.pdf
windows7-x64
3W-8BEN-E Entities.pdf
windows10-2004-x64
3W-8ECI Inc...ss.pdf
windows7-x64
3W-8ECI Inc...ss.pdf
windows10-2004-x64
3W-8EXP Tax Exempt.pdf
windows7-x64
3W-8EXP Tax Exempt.pdf
windows10-2004-x64
3W-8IMY For...ip.pdf
windows7-x64
3W-8IMY For...ip.pdf
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 23:13
Behavioral task
behavioral1
Sample
W8 or Certificate of Non-US Status Forms.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
W8 or Certificate of Non-US Status Forms.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Certificate of Non-US Status.pdf
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Certificate of Non-US Status.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
W-8BEN Individuals.pdf
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
W-8BEN Individuals.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
W-8BEN-E Entities.pdf
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
W-8BEN-E Entities.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
W-8ECI Income connected with trade and business.pdf
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
W-8ECI Income connected with trade and business.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
W-8EXP Tax Exempt.pdf
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
W-8EXP Tax Exempt.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
W-8IMY Foreign Partnership.pdf
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
W-8IMY Foreign Partnership.pdf
Resource
win10v2004-20240802-en
General
-
Target
Certificate of Non-US Status.pdf
-
Size
64KB
-
MD5
bbc2cfcbac49a8f545d2d5846432bd1b
-
SHA1
9b0ee4dfe68db6dbc85017fe1c26acabcd2bfb58
-
SHA256
986c655ed0c5327eaf0b53cb8770c9c755b2b7497d3007f326c01a6b823fa499
-
SHA512
d49744299cf426a3eafa4a94c3bf0cd5c5b743412303dc4610ac12487943d1e56f217954f1c345a3d6e7a571abc1d013738168f7e00eea248bbc981226f2aab3
-
SSDEEP
1536:+q25yiJdiSTUv7BM6vKS8RzwgJ/B0ue6jDPe1SR:+qcycw1eS8hwnrM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2068 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Certificate of Non-US Status.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e4cf4e0d02c0e716cd4265d38d99ccde
SHA197c382f022427a9c3c2d8054ee3ab0e9853a64ad
SHA2561f5b559ab06dc4f55f7baf664b662dc8e56e57820c32bb628778414ee8ccd306
SHA5128f810fd8aef4823d9d4ef27df8a4d55487732908b7269a8832754bfa975b85241bd9675fcb38972875c150b36307c835c2b5609806280e5a4bb71b43e399eb30