Edit tour

Windows Analysis Report
Purchase_order-001.pdf

Overview

General Information

Sample name:	Purchase_order-001.pdf
Analysis ID:	1573568
MD5:	b9ea0b9010bd7d0240958f962dd5117d
SHA1:	eef8cc56809366554980f2c59ede43842fc20ec7
SHA256:	92fd9207d8af4116e2fbbefd27d4f0be1063b2cb8249f998b751ddcf85e44348
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected landing page (webpage, office document or email)

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7064 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Purchase_order-001.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3452 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1668,i,11315360981870695973,8460651063831671874,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1956,i,10788683583747250684,14816824960367168231,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Purchase_order-001.pdf

ReversingLabs: Detection: 13%

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'AUTHORIZE & VIEW DOCUMENT' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'authorize & view document'

Source: https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs

HTTP Parser: No favicon

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 149.137.136.16 149.137.136.16

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs HTTP/1.1Host: f005.backblazeb2.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: f005.backblazeb2.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: f005.backblazeb2.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757

Source: classification engine

Classification label: mal52.winPDF@38/53@5/4

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-12 03-40-36-017.log

Jump to behavior

Source: unknown

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs"

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Purchase_order-001.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1668,i,11315360981870695973,8460651063831671874,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1956,i,10788683583747250684,14816824960367168231,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1668,i,11315360981870695973,8460651063831671874,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1956,i,10788683583747250684,14816824960367168231,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Purchase_order-001.pdf	Initial sample: PDF keyword /JS count = 0
Source: Purchase_order-001.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
Purchase_order-001.pdf	13%	ReversingLabs	Document-PDF.Trojan.Heuristic
Purchase_order-001.pdf	3%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
f005.backblazeb2.com	149.137.136.16	true	false	high
www.google.com	172.217.19.228	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs	false		high
https://f005.backblazeb2.com/favicon.ico	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
149.137.136.16	f005.backblazeb2.com	United States	30103	ZOOM-VIDEO-COMM-ASUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573568
Start date and time:	2024-12-12 09:39:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Purchase_order-001.pdf
Detection:	MAL
Classification:	mal52.winPDF@38/53@5/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Input	Output
URL: https://f005.backblazeb2.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://f005.backblazeb2.com
URL: https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "AUTHORIZE & VIEW DOCUMENT", "prominent_button_name": "AUTHORIZE & VIEW DOCUMENT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: PDF document Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://brand.site/896562718995127961820892	Get hash	malicious	Unknown	Browse
	https://chrysalis-lynx-nhfj.squarespace.com/	Get hash	malicious	Unknown	Browse
	https://kolobrownsalesye-fong.com/v/hum.ps1	Get hash	malicious	Unknown	Browse
	https://objmapper.com/CtmE0s2ZteC8BuQLNprxjCPB8gAgAcIi7niu-9oX3Q2e	Get hash	malicious	Unknown	Browse
	https://r.clk71.com/s.ashx?ms=AZ71:223314_102051&e=susanne_hentschel%40qvc.com&eId=74256157&c=h&url=https%3a%2f%2fwww.carltonusa.com%2f	Get hash	malicious	Unknown	Browse
	https://analytics-prd.aws.wehaa.net/trackings?value=1&action=click&category=external&origin=detailpage&url=http://notifix.info/scales/ec49f59be146f69f3ea00c211d5cccd90524b2cf7f8aec665534fc020c910734b9e18d0945bd518a0e55b407c5bf7443cf6179/paige_williams@newyorker.com&cat=firstpage&label_item_id=9633&label_owner_id=646&label_url=http://notifix.info/scales/ec49f59be146f69f3ea00c211d5cccd90524b2cf7f8aec665534fc020c910734b9e18d0945bd518a0e55b407c5bf7443cf6179/paige_williams@newyorker.com&idle=8d15bf95831b32126e4b3bd02a20cf592eade0e3442422aeaf0db14b2e91ae186a5549c468519863594ece59910ee541&tenant=minnesotastate.jobs	Get hash	malicious	Captcha Phish	Browse
	https://analytics-prd.aws.wehaa.net/trackings?value=1&action=click&category=external&origin=detailpage&url=http://notifix.info/scales/0af634fca2eaf3a11c0597691f5616c7d16f5580d650d17201024b374ebe92a8e0c492c822b6be6f4332bb93acc2ba02298f78/christa_sgobba@condenast.com&cat=firstpage&label_item_id=9633&label_owner_id=646&label_url=http://notifix.info/scales/0af634fca2eaf3a11c0597691f5616c7d16f5580d650d17201024b374ebe92a8e0c492c822b6be6f4332bb93acc2ba02298f78/christa_sgobba@condenast.com&idle=8d15bf95831b32126e4b3bd02a20cf592eade0e3442422aeaf0db14b2e91ae186a5549c468519863594ece59910ee541&tenant=minnesotastate.jobs	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse
	REMITTANCE_10023Tdcj.html	Get hash	malicious	Unknown	Browse
	phish_alert_iocp_v1.4.48 - 2024-12-11T151927.331.eml	Get hash	malicious	Unknown	Browse
	https://planner.cloud.microsoft/	Get hash	malicious	HTMLPhisher	Browse
149.137.136.16	https://lnkfwd.com/u/MhDkLABR	Get hash	malicious	HTMLPhisher	Browse
	rQTI6IKszT.exe	Get hash	malicious	Unknown	Browse
	LKEAHetlG6.exe	Get hash	malicious	Unknown	Browse
	zCYHTVvEqm.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	http://www.ln.run/BSrHQ/	Get hash	malicious	Unknown	Browse
	https://f005.backblazeb2.com/file/roboties48/index.html	Get hash	malicious	Unknown	Browse
	https://na4.docusign.net/Signing/EmailStart.aspx?a=ba2f41e9-baaf-4cfa-bac9-97afaa73a1c7&acct=97628bf5-2dcc-4379-8c8b-719995aa39f7&er=432aa911-ffaa-47c2-9cba-5584ad4ba6ec	Get hash	malicious	HTMLPhisher	Browse
	https://f005.backblazeb2.com/file/yahoos66/glogin.html	Get hash	malicious	Unknown	Browse
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=tg1j7YnlEUCGCEN8r-hdbL2y774DAIJEjU_nCKb9wOlUNUlFWjRMS0ZCNloyVTM4R0U3T0c1TjBCVi4u	Get hash	malicious	HTMLPhisher	Browse
	https://ecv.microsoft.com/BcEEKIqBNU	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	199.232.210.172
	MHDeXPq2uB.exe	Get hash	malicious	RedLine	Browse	199.232.210.172
	n70CrSGL8G.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	1.e	Get hash	malicious	DanaBot	Browse	199.232.210.172
	xuhu.exe	Get hash	malicious	AsyncRAT	Browse	199.232.210.172
	Review_Approval_rocjr.pdf	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	199.232.210.172
	https://computeroids.com/hp-printer-driver?utm_source=Google&utm_medium=Click&utm_campaign=HP&utm_term=%7Bkeywords%7D&utm_content=%7Bmedium%7D&tm=tt&ap=gads&aaid=adaHxflMmgPq7&camp_id=12260099411&ad_g_id=118845692873&keyword=install%20hp%20printer%20to%20computer&device=c&network=searchAd&adposition=&gad_source=5&gclid=EAIaIQobChMI0JDUvuabigMV_Uf_AR2MuQCMEAAYASAAEgKQMPD_BwE	Get hash	malicious	PureLog Stealer	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	199.232.210.172
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	SSTS218947014.pdf	Get hash	malicious	ScreenConnect Tool, Phisher	Browse	199.232.210.172
f005.backblazeb2.com	https://lnkfwd.com/u/MhDkLABR	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16
	rQTI6IKszT.exe	Get hash	malicious	Unknown	Browse	149.137.136.16
	LKEAHetlG6.exe	Get hash	malicious	Unknown	Browse	149.137.136.16
	zCYHTVvEqm.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	149.137.136.16
	http://www.ln.run/BSrHQ/	Get hash	malicious	Unknown	Browse	149.137.136.16
	https://f005.backblazeb2.com/file/roboties48/index.html	Get hash	malicious	Unknown	Browse	149.137.136.16
	https://na4.docusign.net/Signing/EmailStart.aspx?a=ba2f41e9-baaf-4cfa-bac9-97afaa73a1c7&acct=97628bf5-2dcc-4379-8c8b-719995aa39f7&er=432aa911-ffaa-47c2-9cba-5584ad4ba6ec	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16
	https://f005.backblazeb2.com/file/yahoos66/glogin.html	Get hash	malicious	Unknown	Browse	149.137.136.16
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=tg1j7YnlEUCGCEN8r-hdbL2y774DAIJEjU_nCKb9wOlUNUlFWjRMS0ZCNloyVTM4R0U3T0c1TjBCVi4u	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16
	https://ecv.microsoft.com/BcEEKIqBNU	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ZOOM-VIDEO-COMM-ASUS	teste.i686.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	149.137.206.106
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	198.251.214.52
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	149.137.95.155
	pbnpvwfhco.elf	Get hash	malicious	Unknown	Browse	149.137.206.127
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	149.137.206.109
	https://lnkfwd.com/u/MhDkLABR	Get hash	malicious	HTMLPhisher	Browse	149.137.136.16
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	64.211.148.226
	novo.ppc440fp.elf	Get hash	malicious	Mirai, Moobot	Browse	204.80.105.51
	https://reviewscope.s3.us-east-005.backblazeb2.com/info.htm	Get hash	malicious	Unknown	Browse	149.137.136.9
	rQTI6IKszT.exe	Get hash	malicious	Unknown	Browse	149.137.136.16

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.189915277452635
Encrypted:	false
SSDEEP:	6:770f+q2Pwkn2nKuAl9OmbnIFUt8O7hdXZmw+O7hd3VkwOwkn2nKuAl9OmbjLJ:74mvYfHAahFUt8OVdX/+OVdF5JfHAaSJ
MD5:	193FBBC770C122B92A648CCDCCA8507C
SHA1:	C7DCB3A85C2F48F982D8190C73060CE5AD05A1C8
SHA-256:	01D5ECFF1A2E3CC32585A24497E2771B56C53F4D646731A174529F8563B56767
SHA-512:	063B0564EEFB366F2C2072530481EEA3A0F2EEB84152199F57FA541B7A83A732BB43013EC37ACB6F24E94020764480189C4E02573C3E9792D0A03C17186D908D
Malicious:	false
Reputation:	low
Preview:	2024/12/12-03:40:33.582 1be8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/12-03:40:33.585 1be8 Recovering log #3.2024/12/12-03:40:33.585 1be8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

File type:	PDF document, version 2.0 (zip deflate encoded)
Entropy (8bit):	7.990794691409106
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Purchase_order-001.pdf
File size:	40'883 bytes
MD5:	b9ea0b9010bd7d0240958f962dd5117d
SHA1:	eef8cc56809366554980f2c59ede43842fc20ec7
SHA256:	92fd9207d8af4116e2fbbefd27d4f0be1063b2cb8249f998b751ddcf85e44348
SHA512:	90a2226a6a7a101e680966e2e0c2ab2a137b5363835b07d3ab2a06ec5b63ab1cad6c718445bbdd022a0f0b488ffdafc0a462ee01a3515a744076403cedd7b9a6
SSDEEP:	768:ZdCtfFVd+i26nDI0H0J7/2uSf+uIs4cZdI7BBMMSFSEghetuMS:oFV2ijH0Z2nf+ARZeBBCLtuj
TLSH:	4503F12C9509133EEC2CA600E6CE127C9763E734868965D43D2F8598BA17D96CE79ECC
File Content Preview:	%PDF-2.0.%.....1 0 obj<</Type/Catalog/Pages 3 0 R>>.endobj.2 0 obj<</Type/ObjStm/N 17/First 121/Filter/FlateDecode/Length 711>>stream.x...kO.0.....2....%F....M...M.VU(m.dtI..e...8ii.!X.h...u...\....H..x.A.C..4..3.L...E.8..q.%......]..b.q.1.......).q......

General
Header:	%PDF-2.0
Total Entropy:	7.990795
Total Bytes:	40883
Stream Entropy:	7.991918
Stream Bytes:	40210
Entropy outside Streams:	5.396997
Bytes outside Streams:	673
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	5
endobj	5
stream	4
endstream	4
xref	0
trailer	0
startxref	1
/Page	0
/Encrypt	0
/ObjStm	1
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 09:40:35.791557074 CET	49675	443	192.168.2.4	173.222.162.32
Dec 12, 2024 09:41:00.259078979 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:00.259176016 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:00.259254932 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:00.260628939 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:00.260668039 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:01.484564066 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:01.485090017 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:01.485131979 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:01.486155987 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:01.486236095 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:01.488821983 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:01.488898993 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:01.489309072 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:01.489326954 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:01.537863016 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:01.920588970 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:01.920665979 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:01.920748949 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:01.994931936 CET	49753	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:01.994949102 CET	443	49753	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:02.054344893 CET	49757	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:02.054379940 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:02.054438114 CET	49757	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:02.054847002 CET	49757	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:02.054860115 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:03.282655954 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:03.283077002 CET	49757	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:03.283108950 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:03.283601046 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:03.283884048 CET	49757	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:03.283951998 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:03.284039021 CET	49757	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:03.331334114 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:03.720633030 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:03.720819950 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:03.721143007 CET	49757	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:03.722337008 CET	49757	443	192.168.2.4	149.137.136.16
Dec 12, 2024 09:41:03.722357035 CET	443	49757	149.137.136.16	192.168.2.4
Dec 12, 2024 09:41:04.775183916 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:04.775233030 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:41:04.775319099 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:04.775542021 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:04.775557041 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:41:06.471951008 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:41:06.472358942 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:06.472395897 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:41:06.474050999 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:41:06.474128962 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:06.475277901 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:06.475380898 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:41:06.516527891 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:06.516572952 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:41:06.563275099 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:16.175103903 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:41:16.175199986 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:41:16.175417900 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:16.408870935 CET	49758	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:41:16.408943892 CET	443	49758	172.217.19.228	192.168.2.4
Dec 12, 2024 09:42:04.689659119 CET	49838	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:42:04.689709902 CET	443	49838	172.217.19.228	192.168.2.4
Dec 12, 2024 09:42:04.689795017 CET	49838	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:42:04.690098047 CET	49838	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:42:04.690119982 CET	443	49838	172.217.19.228	192.168.2.4
Dec 12, 2024 09:42:06.380968094 CET	443	49838	172.217.19.228	192.168.2.4
Dec 12, 2024 09:42:06.381701946 CET	49838	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:42:06.381732941 CET	443	49838	172.217.19.228	192.168.2.4
Dec 12, 2024 09:42:06.382200003 CET	443	49838	172.217.19.228	192.168.2.4
Dec 12, 2024 09:42:06.382505894 CET	49838	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:42:06.382591963 CET	443	49838	172.217.19.228	192.168.2.4
Dec 12, 2024 09:42:06.422725916 CET	49838	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:42:16.075547934 CET	443	49838	172.217.19.228	192.168.2.4
Dec 12, 2024 09:42:16.075695992 CET	443	49838	172.217.19.228	192.168.2.4
Dec 12, 2024 09:42:16.075752020 CET	49838	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:42:16.428538084 CET	49838	443	192.168.2.4	172.217.19.228
Dec 12, 2024 09:42:16.428566933 CET	443	49838	172.217.19.228	192.168.2.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 09:40:42.090373039 CET	52048	53	192.168.2.4	1.1.1.1
Dec 12, 2024 09:40:54.329560041 CET	138	138	192.168.2.4	192.168.2.255
Dec 12, 2024 09:41:00.071975946 CET	57452	53	192.168.2.4	1.1.1.1
Dec 12, 2024 09:41:00.072117090 CET	49886	53	192.168.2.4	1.1.1.1
Dec 12, 2024 09:41:00.140472889 CET	53	52346	1.1.1.1	192.168.2.4
Dec 12, 2024 09:41:00.211747885 CET	53	57452	1.1.1.1	192.168.2.4
Dec 12, 2024 09:41:00.212717056 CET	53	49886	1.1.1.1	192.168.2.4
Dec 12, 2024 09:41:00.409296036 CET	53	50244	1.1.1.1	192.168.2.4
Dec 12, 2024 09:41:03.098778009 CET	53	53856	1.1.1.1	192.168.2.4
Dec 12, 2024 09:41:04.625581026 CET	62598	53	192.168.2.4	1.1.1.1
Dec 12, 2024 09:41:04.625713110 CET	56089	53	192.168.2.4	1.1.1.1
Dec 12, 2024 09:41:04.762671947 CET	53	62598	1.1.1.1	192.168.2.4
Dec 12, 2024 09:41:04.773999929 CET	53	56089	1.1.1.1	192.168.2.4
Dec 12, 2024 09:41:12.623847008 CET	53	65414	1.1.1.1	192.168.2.4
Dec 12, 2024 09:41:20.062722921 CET	53	65065	1.1.1.1	192.168.2.4
Dec 12, 2024 09:41:38.921566963 CET	53	54213	1.1.1.1	192.168.2.4
Dec 12, 2024 09:42:00.016129017 CET	53	52525	1.1.1.1	192.168.2.4
Dec 12, 2024 09:42:01.517024994 CET	53	52101	1.1.1.1	192.168.2.4
Dec 12, 2024 09:42:31.016479969 CET	53	63996	1.1.1.1	192.168.2.4
Dec 12, 2024 09:43:17.936712980 CET	53	62000	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 09:40:42.228367090 CET	1.1.1.1	192.168.2.4	0xac1c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 09:40:43.990566969 CET	1.1.1.1	192.168.2.4	0x8197	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 12, 2024 09:40:43.990566969 CET	1.1.1.1	192.168.2.4	0x8197	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 12, 2024 09:41:00.211747885 CET	1.1.1.1	192.168.2.4	0x37dd	No error (0)	f005.backblazeb2.com		149.137.136.16	A (IP address)	IN (0x0001)	false
Dec 12, 2024 09:41:04.762671947 CET	1.1.1.1	192.168.2.4	0x76f5	No error (0)	www.google.com		172.217.19.228	A (IP address)	IN (0x0001)	false
Dec 12, 2024 09:41:04.773999929 CET	1.1.1.1	192.168.2.4	0x6f67	No error (0)	www.google.com			65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-12 08:41:01 UTC	729	OUT	GET /file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs HTTP/1.1 Host: f005.backblazeb2.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 08:41:01 UTC	246	IN	HTTP/1.1 403 Server: nginx Date: Thu, 12 Dec 2024 08:41:01 GMT Content-Type: application/json;charset=utf-8 Content-Length: 199 Connection: close Cache-Control: max-age=0, no-cache, no-store Strict-Transport-Security: max-age=63072000
2024-12-12 08:41:01 UTC	199	IN	Data Raw: 7b 0a 20 20 22 63 6f 64 65 22 3a 20 22 64 6f 77 6e 6c 6f 61 64 5f 63 61 70 5f 65 78 63 65 65 64 65 64 22 2c 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 43 61 6e 6e 6f 74 20 64 6f 77 6e 6c 6f 61 64 20 66 69 6c 65 2c 20 64 6f 77 6e 6c 6f 61 64 20 62 61 6e 64 77 69 64 74 68 20 6f 72 20 74 72 61 6e 73 61 63 74 69 6f 6e 20 28 43 6c 61 73 73 20 42 29 20 63 61 70 20 65 78 63 65 65 64 65 64 2e 20 53 65 65 20 74 68 65 20 43 61 70 73 20 26 20 41 6c 65 72 74 73 20 70 61 67 65 20 74 6f 20 69 6e 63 72 65 61 73 65 20 79 6f 75 72 20 63 61 70 2e 22 2c 0a 20 20 22 73 74 61 74 75 73 22 3a 20 34 30 33 0a 7d Data Ascii: { "code": "download_cap_exceeded", "message": "Cannot download file, download bandwidth or transaction (Class B) cap exceeded. See the Caps & Alerts page to increase your cap.", "status": 403}

Timestamp	Bytes transferred	Direction	Data
2024-12-12 08:41:03 UTC	662	OUT	GET /favicon.ico HTTP/1.1 Host: f005.backblazeb2.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-12 08:41:03 UTC	245	IN	HTTP/1.1 404 Server: nginx Date: Thu, 12 Dec 2024 08:41:03 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 43 Connection: close Cache-Control: max-age=0, no-cache, no-store Strict-Transport-Security: max-age=63072000
2024-12-12 08:41:03 UTC	43	IN	Data Raw: 7b 0a 20 20 22 63 6f 64 65 22 3a 20 22 6e 6f 74 5f 66 6f 75 6e 64 22 2c 0a 20 20 22 73 74 61 74 75 73 22 3a 20 34 30 34 0a 7d 0a Data Ascii: { "code": "not_found", "status": 404}

Target ID:	0
Start time:	03:40:32
Start date:	12/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Purchase_order-001.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Purchase_order-001.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4686515a-804f-4933-b6b0-71fcaf051171.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\903845d4-3050-49d7-9858-481c82126a7b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6936e0.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241212084037Z-150.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6312

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6312

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Windows Analysis Report
Purchase_order-001.pdf

Target ID:	1
Start time:	03:40:33
Start date:	12/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	03:40:58
Start date:	12/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://f005.backblazeb2.com/file/gavupdas-viauto-downloas-serve-updated/Purchase+Order_001.vbs"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	03:40:59
Start date:	12/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1956,i,10788683583747250684,14816824960367168231,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre