popup

Report - Flightpath.lnk

PDF ZIP Format
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.07.05 09:48 Machine s1_win7_x6403
Filename Flightpath.lnk
Type PDF document, version 1.4
AI Score Not founds Behavior Score
1.4
ZERO API
VT API (file)
md5 256acb98c1c970818640ec89f1060458
sha256 39b92093b8c443c10ecb0066d44f539ea0af7c4727858db19eff58bae04e1fdb
ssdeep 196608:YdakjcQsUXbcCRGD83hsj/v6DweIQ0XJLeJVeI+d4EUtyNN+i8n9spp4:ejXs2bcCUys7UMXJLpHd4EsyNN+Nn9sw
imphash
impfuzzy
  Network IP location

Signature (3cnts)

Level Description
watch One or more non-whitelisted processes were created
notice Performs some HTTP requests
notice Uses Windows utilities for basic Windows functionality

Rules (2cnts)

Level Name Description Collection
notice PDF_Format_Z PDF Format binaries (upload)
info zip_file_format ZIP file format binaries (download)

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/277_20_6_20042.zip
whois
US Akamai International B.V. 23.204.147.9
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/281_20_6_20042.zip
whois
US Akamai International B.V. 23.204.147.9
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/280_20_6_20042.zip
whois
US Akamai International B.V. 23.204.147.32
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/278_20_6_20042.zip
whois
US Akamai International B.V. 23.204.147.32
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/message.zip
whois
US Akamai International B.V. 23.204.147.9

Suricata ids


Similarity measure (PE file only) - Checking for service failure