popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

AL.pdf

PDF Suspicious Link PDF AntiDebug MSOffice File PNG Format AntiVM JPEG Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 11, 2023, 3:39 p.m. April 11, 2023, 3:42 p.m.
Size 53.8KB
Type PDF document, version 1.4
MD5 2a8d2f23d6dfda4df874b409d503ce39
SHA256 bdffc5a72a1180f33e764c0f80b8e30cab36193678cda450be9ac49a5ae7ce80
CRC32 A52DBB71
ssdeep 768:ZqTyfkC+fdckGN6QsF77VYgRVlVF8jbi6kRbCBYEMOfse8azj+Z3jK9s92:ZqefkC0cHNeRbXn8Hi63CT+LzjKjK9C2
Yara
  • PDF_Suspicious_Link_Z - PDF Suspicious Link
  • PDF_Format_Z - PDF Format

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49167 -> 162.0.217.30:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49171 -> 162.0.217.30:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49169 -> 162.0.217.30:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49170 -> 162.0.217.30:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 162.0.217.30:443 -> 192.168.56.102:49172 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49173 -> 162.0.217.30:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49166 -> 162.0.217.30:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.102:49192
172.217.27.13:443 		None None None
TLS 1.3
192.168.56.102:49193
172.217.24.100:443 		None None None
TLS 1.3
192.168.56.102:49196
172.217.24.74:443 		None None None
TLS 1.3
192.168.56.102:49198
172.217.25.3:443 		None None None
TLS 1.3
192.168.56.102:49197
172.217.25.3:443 		None None None
TLS 1.3
192.168.56.102:49200
142.250.207.67:443 		None None None
TLS 1.3
192.168.56.102:49191
142.251.220.99:443 		None None None
TLS 1.3
192.168.56.102:49201
142.250.66.78:443 		None None None
TLS 1.3
192.168.56.102:49194
172.217.24.100:443 		None None None
TLS 1.3
192.168.56.102:49214
142.251.220.99:443 		None None None
TLS 1.3
192.168.56.102:49204
162.0.217.30:443 		None None None
TLS 1.3
192.168.56.102:49205
162.0.217.30:443 		None None None
TLS 1.3
192.168.56.102:49241
172.217.25.3:443 		None None None
TLS 1.3
192.168.56.102:49242
216.58.203.67:443 		None None None
UNDETERMINED
192.168.56.102:49199
172.217.25.3:443 		None None None

request HEAD http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jewvegtcs2qdew3nlzz4kvsjqm_9.44.0/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.44.0_all_pywouuhjzu3khiqqvvfs2jt53q.crx3
request GET http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jewvegtcs2qdew3nlzz4kvsjqm_9.44.0/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.44.0_all_pywouuhjzu3khiqqvvfs2jt53q.crx3
request HEAD http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxpsjblnoxgjoqggdsbvujtof4_58/khaoiebndkojlmppeemjhbpbandiljpe_58_win_advr4ucepztwtigvw3fduftsvbeq.crx3
request GET http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxpsjblnoxgjoqggdsbvujtof4_58/khaoiebndkojlmppeemjhbpbandiljpe_58_win_advr4ucepztwtigvw3fduftsvbeq.crx3
request HEAD http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/g6v7tvx6ixuzstk5etcqebphhq_7954/hfnkpimlhhgieaddgfemjhofmfblmnib_7954_all_adj2i674lrtcwrqqfhv37vujcaya.crx3
request GET http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/g6v7tvx6ixuzstk5etcqebphhq_7954/hfnkpimlhhgieaddgfemjhofmfblmnib_7954_all_adj2i674lrtcwrqqfhv37vujcaya.crx3
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70c03000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1164
region_size: 7737344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a60000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x031c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743a3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74447000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75069000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75bf2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75742000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1164
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x030b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71372000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70c03000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x031c0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743a3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74447000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75069000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75bf2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75742000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 14094336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03620000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0
Symantec Scr.Qbot!gen12
McAfee-GW-Edition Artemis!Trojan
Sophos Troj/PDFDwn-ACI
Google Detected
AhnLab-V3 Phishing/PDF.Malurl.XG38
McAfee Artemis!2A8D2F23D6DF
Fortinet PDF/Phishing.EF14!tr
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x04fd0000
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome "https://zacuta.com/eupa/eupa.php"
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:1164 CREDAT:145409
cmdline "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --locale=ko-kr --backgroundcolor=16514043
parent_process acrord32.exe martian_process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome "https://zacuta.com/eupa/eupa.php"
parent_process acrord32.exe martian_process "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --locale=ko-kr --backgroundcolor=16514043
Process injection Process 1164 resumed a thread in remote process 2652
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000034c
suspend_count: 1
process_identifier: 2652
1 0 0