Report - 2.pdf

Kimsuky PDF
ScreenShot
Created 2021.08.05 11:13 Machine s1_win7_x6401
Filename 2.pdf
Type PDF document, version 2.0
AI Score Not founds Behavior Score
1.4
ZERO API file : clean
VT API (file) 18 detected (AFWQ, GenericKD, FakePDF, Malware@#1nnwapqfqw1d0, PDFEXP, Artemis, Casdet, FakeDocu, jsexp)
md5 de2a8a728f81d44562bfd3e91c95f002
sha256 7900ca98a6fbed74aa5a393758c43ad7abc9d8c73c3fbab7af93bae681065f4e
ssdeep 12288:e9wwBpdbie7g84OTKuBqOX1BNVT5m+YH+JARGEwuxkIOcaj/5vDTWjaOyGj:Xkdz7y2DBJ1dYHoARzTkjcwvDTWOO
imphash
impfuzzy
  Network IP location

Signature (3cnts)

Level Description
watch File has been identified by 18 AntiVirus engines on VirusTotal as malicious
notice The PDF file contains an attachment
notice The PDF file contains JavaScript code

Rules (2cnts)

Level Name Description Collection
danger APT_Kimsuky_PDF_Shellcode_Aug_2021_1 Detect Kimsuky shellcode used in fake PDF against South Korea binaries (upload)
notice PDF_Format_Z PDF Format binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure