Edit tour

Windows Analysis Report
Eveshaw.pdf

Overview

Sample name:	Eveshaw.pdf
Analysis ID:	1549267
MD5:	f8fb3ee1549096e21de724a679a3800b
SHA1:	2f3142647e7718af1994a76c9a3f77a3e65bc12c
SHA256:	6053691cafcceb95fc0fb8791781ccba39ac241d7189e7d2f7643e2f146594de
Infos:

AI detected phishing page

Antivirus detection for URL or domain

AI detected landing page (webpage, office document or email)

AI detected suspicious URL

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Suspicious PDF detected (based on various text indicators)

Detected suspicious crossdomain redirect

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Suricata IDS alerts with low severity for network traffic

Acrobat.exe (PID: 6228 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Eveshaw.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2916 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1704,i,4426704591743724729,18414428344747589589,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://www-share-docu-view-one-drive-amended-mortgage-review.s3.us-west-2.amazonaws.com/indexfinal.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=1988,i,4717625965641288325,17490191105496498806,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T13:49:14.831366+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.4	49740	TCP
2024-11-05T13:49:52.931000+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49782	TCP

Click to jump to signature section

Show All Signature Results

AV Detection

Source: https://www-share-docu-view-one-drive-amended-mortgage-review.s3.us-west-2.amazonaws.com/indexfinal.html	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/flodesk/index.html	Avira URL Cloud: Label: phishing

Phishing