Analysis
- user interaction
yes - max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 16:17
General
- Target PDFExploitBuilder.exe
- Size 2.1MB
- Sample260718-trvgbsax2s
- SHA256 4d44e7d6bc3423672a623586196d0d6c7bf24dc82ce3ec7b2d800fdc64c16b15
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 3 IoCs
- AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PDFExploitBuilder.exe"C:\Users\Admin\AppData\Local\Temp\PDFExploitBuilder.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
skin.888.msstyles
skin.dll
memory/5312-0-0x0000000000BE0000-0x0000000001062000-memory.dmp
memory/5312-1-0x0000000000BE0000-0x0000000001062000-memory.dmp
memory/5312-3-0x0000000077B80000-0x0000000077B81000-memory.dmp
memory/5312-23-0x0000000010000000-0x00000000100BB000-memory.dmp
memory/5312-29-0x00000000764D0000-0x000000007654E000-memory.dmp
memory/5312-35-0x0000000075C50000-0x0000000075C75000-memory.dmp
memory/5312-33-0x00000000764D0000-0x000000007654E000-memory.dmp
memory/5312-31-0x00000000764D0000-0x000000007654E000-memory.dmp
memory/5312-38-0x0000000076A90000-0x0000000076BE5000-memory.dmp
memory/5312-50-0x00000000774E0000-0x0000000077591000-memory.dmp
memory/5312-54-0x00000000774E0000-0x0000000077591000-memory.dmp
memory/5312-55-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-63-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-69-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-68-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-67-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-66-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-65-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-64-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-62-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-61-0x0000000076A90000-0x0000000076BE5000-memory.dmp
memory/5312-60-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-59-0x00000000774E0000-0x0000000077591000-memory.dmp
memory/5312-56-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-52-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-51-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-58-0x0000000076680000-0x0000000076762000-memory.dmp
memory/5312-57-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-53-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-47-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-44-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-43-0x0000000076A90000-0x0000000076BE5000-memory.dmp
memory/5312-42-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-40-0x0000000076680000-0x0000000076762000-memory.dmp
memory/5312-49-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-48-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-46-0x00000000774E0000-0x0000000077591000-memory.dmp
memory/5312-45-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-39-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-41-0x00000000774E0000-0x0000000077591000-memory.dmp
memory/5312-37-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-30-0x00000000764D0000-0x000000007654E000-memory.dmp
memory/5312-36-0x00000000774E0000-0x0000000077591000-memory.dmp
memory/5312-34-0x0000000075C50000-0x0000000075C75000-memory.dmp
memory/5312-32-0x0000000075C50000-0x0000000075C75000-memory.dmp
memory/5312-28-0x00000000764D0000-0x000000007654E000-memory.dmp
memory/5312-83-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-71-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-87-0x0000000076A90000-0x0000000076BE5000-memory.dmp
memory/5312-88-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-86-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-82-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-81-0x0000000076A90000-0x0000000076BE5000-memory.dmp
memory/5312-80-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-78-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-90-0x0000000076F60000-0x0000000076F61000-memory.dmp
memory/5312-76-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-75-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-73-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-70-0x0000000075D80000-0x000000007635C000-memory.dmp
memory/5312-85-0x00000000774E0000-0x0000000077591000-memory.dmp
memory/5312-84-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-79-0x00000000774E0000-0x0000000077591000-memory.dmp
memory/5312-77-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-74-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-72-0x00000000753B0000-0x00000000755D7000-memory.dmp
memory/5312-89-0x0000000075080000-0x0000000075101000-memory.dmp
memory/5312-92-0x0000000010000000-0x00000000100BB000-memory.dmp
memory/5312-93-0x0000000000BE0000-0x0000000001062000-memory.dmp
memory/5312-94-0x0000000010000000-0x00000000100BB000-memory.dmp
memory/5312-186-0x0000000000BE0000-0x0000000001062000-memory.dmp
memory/5312-187-0x0000000010000000-0x00000000100BB000-memory.dmp