popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

disruptive.lnk

PDF
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 11, 2023, 11:27 a.m. Oct. 11, 2023, 11:29 a.m.
Size 113.7KB
Type PDF document, version 1.5
MD5 70964a6ad358b8e1ed36b1d6ebd3a03b
SHA256 3ce3b4fc5334ed0ae78be9add21a15cc47e39f4bc9dbe9226bb0e84b78e963fe
CRC32 E03AAF71
ssdeep 3072:/X/inTK8d8KDVgeBGcrtR5APS7nl8xylP:/X/iG8+KDVgTcrbSS7l8oP
Yara
  • PDF_Format_Z - PDF Format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70f73000
process_handle: 0xffffffff
1 0 0
cmdline "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --locale=ko-kr --backgroundcolor=16514043
parent_process acrord32.exe martian_process "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --locale=ko-kr --backgroundcolor=16514043