Report - invoice.pdf

PDF ZIP Format
ScreenShot
Created 2023.10.04 15:25 Machine s1_win7_x6403
Filename invoice.pdf
Type PDF document, version 1.7
AI Score Not founds Behavior Score
1.4
ZERO API file : clean
VT API (file)
md5 13ed7470a064793e361df8e92ef48a5f
sha256 bd0d72b1c9e667d3dcd496334981305d9704885776791069ca84b6a1a3274ba5
ssdeep 768:5y2UC2QT/MBC2y6sMW36kfIa2Fzt5HhMIRstzQ9oI/7M2JXb1k4swrWpzz8U9jB7:5Kp7uICVUhqXweR9XR/wu
imphash
impfuzzy
  Network IP location

Signature (3cnts)

Level Description
watch One or more non-whitelisted processes were created
notice Performs some HTTP requests
notice Uses Windows utilities for basic Windows functionality

Rules (2cnts)

Level Name Description Collection
notice PDF_Format_Z PDF Format binaries (upload)
info zip_file_format ZIP file format binaries (download)

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/277_20_6_20042.zip Unknown 104.100.168.24 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/281_20_6_20042.zip Unknown 104.100.168.27 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/280_20_6_20042.zip Unknown 104.100.168.24 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/278_20_6_20042.zip Unknown 104.100.168.24 clean
http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/message.zip Unknown 104.100.168.24 clean

Suricata ids



Similarity measure (PE file only) - Checking for service failure