Analysis
- max time kernel
298s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 12:13
Behavioral task
behavioral1
Sample
INSISTÊNCIA) Pedido de documentação bancária - Inquérito nº 382_26.4PAPVZ.eml
Resource
win10v2004-20260911-en
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
INSISTÊNCIA) Pedido de documentação bancária - Inquérito nº 382_26.4PAPVZ.eml
Resource
win11ltsc2024-20260911-en
9 signatures
300 seconds
Behavioral task
behavioral3
Sample
94a3d83d-8e3d-454e-8f51-874f3738a3e0_temp.pdf
Resource
win10v2004-20260911-en
7 signatures
300 seconds
Behavioral task
behavioral4
Sample
94a3d83d-8e3d-454e-8f51-874f3738a3e0_temp.pdf
Resource
win11ltsc2024-20260911-en
7 signatures
300 seconds
Behavioral task
behavioral5
Sample
image001.jpg
Resource
win10v2004-20260911-en
2 signatures
300 seconds
Behavioral task
behavioral6
Sample
image001.jpg
Resource
win11ltsc2024-20260911-en
3 signatures
300 seconds
General
- Target image001.jpg
- Size 19KB
- Sample260930-pd5b6aeg65
- SHA256 721ee8b2db5ccce75018b65e1e92302d0f4cb7edb6714e9eddc4cc42acbcd51a
- MD5 390755473b291933b7e4eadcc8ade6a8
- SHA1 dbc6486d6d67276aadcda4f990c923bc844cb8cb
- SHA512 86ed50c701d3283b50e2e5af14e99972fa3cf37c047e3ba58e0813f64173468e3c2c7e2b28eea89837aa2f2f6d5005d0802bd14debdc7e919378f6fb2cbe26cb
- SSDEEP 384:yYx87O3B/xtjXrWhetd+v2PpBD8L75P3H8AgJ7JbnJ:yYWO3Fx5Chk+vyV8uAgJFJ
- TLSH T189928D57591ACB978148D7E23E4B5FEC1F1B2F49EC163BDB64602D9EAFA00070E6849C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4032 mspaint.exe 4032 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4032 mspaint.exe 4032 mspaint.exe 4032 mspaint.exe 4032 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image001.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3720