Report - One Million British Pounds.pdf

PDF
ScreenShot
Created 2021.08.16 18:12 Machine s1_win7_x6403
Filename One Million British Pounds.pdf
Type PDF document, version 1.3
AI Score Not founds Behavior Score
2.0
ZERO API file : clean
VT API (file) 17 detected (GenericKD, Fraud, Hufu, UnclassifiedMalware@0, ai score=80, Porter, bWoAYN)
md5 9b4e673fb8467b6dac5c13fff8db4213
sha256 3ebd161eee224f13579802e6583f5472f11d8b3986093ba0f0018bcc5efc3133
ssdeep 384:jxibVW7Pvv1uqmm7bTL/CubKcV7LBHX4dS7iqmABPi7gON05TzI3+8Dfh/Iq6Zw1:NixgnTDCun7LB3/Kgq05Tk3DDJIq60jX
imphash
impfuzzy
  Network IP location

Signature (4cnts)

Level Description
watch File has been identified by 17 AntiVirus engines on VirusTotal as malicious
watch One or more non-whitelisted processes were created
notice Performs some HTTP requests
notice Uses Windows utilities for basic Windows functionality

Rules (1cnts)

Level Name Description Collection
notice PDF_Format_Z PDF Format binaries (upload)

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/277_20_6_20042.zip US CCCH-3 23.43.165.9 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/281_20_6_20042.zip US CCCH-3 23.43.165.9 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/280_20_6_20042.zip US CCCH-3 23.43.165.9 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/278_20_6_20042.zip US CCCH-3 23.43.165.9 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/message.zip US CCCH-3 23.43.165.98 clean

Suricata ids



Similarity measure (PE file only) - Checking for service failure