Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 20:57
Behavioral task
behavioral1
Sample
190bbddc5c7af9956401ad39caad61f2573da3dfcaa2dd2ed4c3923b9c12cc20_NeikiAnalytics.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
190bbddc5c7af9956401ad39caad61f2573da3dfcaa2dd2ed4c3923b9c12cc20_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
190bbddc5c7af9956401ad39caad61f2573da3dfcaa2dd2ed4c3923b9c12cc20_NeikiAnalytics.pdf
-
Size
190KB
-
MD5
786f793524a9fb0c503bfe0eccef94c0
-
SHA1
925241a38e59471cc9522294261d422f411d0e95
-
SHA256
190bbddc5c7af9956401ad39caad61f2573da3dfcaa2dd2ed4c3923b9c12cc20
-
SHA512
1d339195266e4b6233a1298321e1b8069639766a2a014bab92a9a739aea0979e9e0864a82c5283e38c442661641de67d3758e395b5a8a1d145d72791a00dc5a1
-
SSDEEP
3072:pRhM/463x2yYss7UAldWzRvLZuFr8gtKMJvJSC/uNbePru2m8IagI/OD:e/4KPYtgvDEikB/R7PvHGD
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2580 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 2580 AcroRd32.exe 2580 AcroRd32.exe 2580 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\190bbddc5c7af9956401ad39caad61f2573da3dfcaa2dd2ed4c3923b9c12cc20_NeikiAnalytics.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Security\addressbook.acrodataFilesize
5KB
MD54618312ec50b52c81043bb6ff393cfc3
SHA180537497d939529b34de993b14d96510068bf075
SHA256e8e27396e2a043abd283eed4fd5b8fa256cc22e741defd522158fc9e29205839
SHA512fc589a974f35ee83c297784c7d7cc62826854422ceec2d5ff46aa6575f5b2bade27d26c1dfc0686602c81e5c14f75f7abd23e6c19fd90a2dbe70e0f5c09251e9
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5cce067c7d55685b8758da727749642c1
SHA121f9a76d3d2097bf11bfe02aa2dcf4176aefa333
SHA25664bea5e14f6c8a51d83ddf36458d70216c92db532d668d7631d9fc19f474a007
SHA51223e2fe405d5edc4a7102cbdd62868a85aec1dc4eb9249d1b231eaa499a2556b4d88e2303fa99fc818a0664729f3ac57af54981f48579e09d3775739629b6393c
-
memory/2580-0-0x0000000002DD0000-0x0000000002E46000-memory.dmpFilesize
472KB