popup

Report - Security Bugs in Operation.pdf

Anti_VM PDF
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.09.04 15:29 Machine s1_win7_x6403
Filename Security Bugs in Operation.pdf
Type PDF document, version 1.5
AI Score Not founds Behavior Score
1.4
ZERO API file : clean
VT API (file)
md5 887b611a15102af0238a4084c22be025
sha256 97abb19ccb7c4d9da75e6d5cfff758977145b0d42c7aec6462e8bccdf9fb6838
ssdeep 12288:Zx0KXPiZ5uTL8ZL0L3PsOfGgOtb1vnQfic6XKdr0n165shujrCiIhUfQNd6WOlBf:AK6wL8ZAL3EOK55+ddrc1ugNFqBiF6R
imphash
impfuzzy
  Network IP location

Signature (3cnts)

Level Description
watch One or more non-whitelisted processes were created
notice Performs some HTTP requests
notice Uses Windows utilities for basic Windows functionality

Rules (2cnts)

Level Name Description Collection
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (upload)
notice PDF_Format_Z PDF Format binaries (upload)

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/277_20_6_20042.zip
whois
US CCCH-3 23.43.165.98 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/280_20_6_20042.zip
whois
US CCCH-3 23.43.165.98 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/message.zip
whois
US CCCH-3 23.43.165.98 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/278_20_6_20042.zip
whois
US CCCH-3 23.43.165.98 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/281_20_6_20042.zip
whois
US CCCH-3 23.43.165.98 clean

Suricata ids


Similarity measure (PE file only) - Checking for service failure