popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

51216324738.pdf

PDF Suspicious Link PDF AntiDebug MSOffice File PNG Format JPEG Format AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 5, 2023, 3:32 p.m. June 5, 2023, 3:35 p.m.
Size 111.2KB
Type PDF document, version 1.4
MD5 e44cdb9b41b9e644d0a7366029ae9ec0
SHA256 662c3ebc15ce27480cd232e7af324b5a76f316c3416190452a4f62222da46762
CRC32 B6B32963
ssdeep 3072:wC+roBABDeHh+GZfWW5sw6NbJ2PUJni/LvPPBL:w7K0o5sw6/6/zx
Yara
  • PDF_Suspicious_Link_Z - PDF Suspicious Link
  • PDF_Format_Z - PDF Format

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49168 -> 172.67.198.220:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49167 -> 172.67.198.220:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49168
172.67.198.220:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=synerhu.ru 0e:e1:e1:4f:ed:d3:9d:06:1e:86:79:f7:3e:44:2b:fc:9c:b5:67:7c
TLSv1
192.168.56.102:49167
172.67.198.220:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=synerhu.ru 0e:e1:e1:4f:ed:d3:9d:06:1e:86:79:f7:3e:44:2b:fc:9c:b5:67:7c
TLS 1.3
192.168.56.102:49190
142.250.204.99:443 		None None None
TLS 1.3
192.168.56.102:49182
142.250.207.77:443 		None None None
TLS 1.3
192.168.56.102:49184
142.251.220.4:443 		None None None
TLS 1.3
192.168.56.102:49183
142.251.220.4:443 		None None None
TLS 1.3
192.168.56.102:49186
142.250.66.67:443 		None None None
TLS 1.3
192.168.56.102:49195
172.67.198.220:443 		None None None
TLS 1.3
192.168.56.102:49193
142.250.66.142:443 		None None None
TLS 1.3
192.168.56.102:49188
142.250.204.99:443 		None None None
TLS 1.3
192.168.56.102:49196
35.190.80.1:443 		None None None
TLS 1.3
192.168.56.102:49189
142.250.204.99:443 		None None None
TLS 1.3
192.168.56.102:49200
142.250.66.131:443 		None None None
TLS 1.3
192.168.56.102:49192
142.251.222.195:443 		None None None
TLS 1.3
192.168.56.102:49185
142.251.220.4:443 		None None None
TLS 1.3
192.168.56.102:49187
142.251.222.202:443 		None None None

request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET https://synerhu.ru/uplcv?utm_term=bad+boys+for+life+2020+torrent
domain synerhu.ru description Russian Federation domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70c03000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1624
region_size: 3215360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1624
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743a3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74447000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75069000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75bf2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75742000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1624
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02840000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71372000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70c03000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028c0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743a3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74447000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75069000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75bf2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75742000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 564
region_size: 16519168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03570000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7578f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7577c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7575c000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x04d90000
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome "https://synerhu.ru/uplcv?utm_term=bad+boys+for+life+2020+torrent"
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:1624 CREDAT:145409
cmdline "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --locale=ko-kr --backgroundcolor=16514043
host 142.250.66.131
parent_process acrord32.exe martian_process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome "https://synerhu.ru/uplcv?utm_term=bad+boys+for+life+2020+torrent"
parent_process acrord32.exe martian_process "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --locale=ko-kr --backgroundcolor=16514043
Process injection Process 1624 resumed a thread in remote process 564
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000344
suspend_count: 1
process_identifier: 564
1 0 0
Lionic Trojan.PDF.Phishing.4!c
FireEye PDF.Spam.Heur.1
CAT-QuickHeal PDF.Phishing.43917
McAfee PDF/Phish-FAK!E44CDB9B41B9
Sangfor Malware.Generic-HTML.Save.06ea357a
Cyren PDF/Phish.U.gen!Camelot
Symantec Trojan.Gen.NPE
ESET-NOD32 PDF/Phishing.Agent.NDP
Avast PDF:PhishingX-gen [Phish]
Cynet Malicious (score: 99)
BitDefender PDF.Spam.Heur.1
MicroWorld-eScan PDF.Spam.Heur.1
Emsisoft PDF.Spam.Heur.1 (B)
F-Secure Malware.HTML/Malicious.PDF.Gen2
DrWeb PDF.Phisher.197
VIPRE PDF.Spam.Heur.1
McAfee-GW-Edition BehavesLike.PDF.Suspicious.cb
Ikarus Trojan.PDF.Phishing
Avira HTML/Malicious.PDF.Gen2
Antiy-AVL Trojan[Phishing]/JS.Agent
Arcabit PDF.Spam.Heur.1
GData PDF.Trojan-Stealer.Phishing.E
Google Detected
AhnLab-V3 Phishing/PDF.Malurl.XG5
MAX malware (ai score=82)
Rising Trojan.Phishing/PDF!1.D56E (CLASSIC)
SentinelOne Static AI - Malicious PDF
MaxSecure Trojan.Phishing.e
Fortinet PDF/Phishing.4BCA!tr
AVG PDF:PhishingX-gen [Phish]