Edit tour

Windows Analysis Report
AZfDGVWF68.pdf

Overview

General Information

Sample name:	AZfDGVWF68.pdf renamed because original name is a hash value
Original sample name:	b24c416e0247cf131d4e8b634c712612bf35d0ee13fca05c62ff0534d273da28.pdf
Analysis ID:	1584735
MD5:	85ae7a9c76612dfad87fc1cac7259714
SHA1:	b6030d827cc3ee50badc1b24d908bea488c5f673
SHA256:	b24c416e0247cf131d4e8b634c712612bf35d0ee13fca05c62ff0534d273da28
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Detected clear text password fields (password is not hidden)

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7068 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\AZfDGVWF68.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7208 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1556,i,2814437525766773916,2514006706851234816,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://bohlepropiedades.com/M3o2cjJJNkM0MjAyMEo=" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1972,i,17501448836344422679,2360784714452452957,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T12:09:11.150786+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	50049	51.68.82.147	443	TCP
2025-01-06T12:09:11.401249+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	50048	51.68.82.147	443	TCP
2025-01-06T12:09:12.641960+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	50052	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://bohlepropiedades.com/	Avira URL Cloud: Label: phishing
Source: https://bohlepropiedades.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://bohlepropiedades.com/includes/contact.php	Avira URL Cloud: Label: phishing
Source: https://bohlepropiedades.com/includes/sse.php	Avira URL Cloud: Label: phishing
Source: https://bohlepropiedades.com/includes/assets/index-qoqlwAed.js	Avira URL Cloud: Label: phishing
Source: https://bohlepropiedades.com/includes/3z6r2I6C42020J	Avira URL Cloud: Label: phishing
Source: https://bohlepropiedades.com/includes/assets/index-B_awNbnU.css	Avira URL Cloud: Label: phishing
Source: https://forspearowor.com/sync-do	Avira URL Cloud: Label: malware

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'View On Adobe' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'view on adobe'

AI detected suspicious Javascript

Source: 1.6.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://azz.underbellymeet.asia/?utm_term=74567579... The script exhibits high-risk behavior by redirecting the user to a suspicious domain after a 4-second delay, which is a common tactic used in malicious scripts. The URL contains obfuscated parameters, further indicating potential malicious intent.
Source: 1.17.i.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://wungoangeredsa.com/finance-survey/272/?sva... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While some contextual factors like the use of analytics-related functionality may suggest legitimate intent, the overall aggressive and suspicious nature of the script warrants a high-risk score.
Source: 1.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://www.umbrellaland.fit/?sl=5879905-0031c&pub... The script demonstrates several high-risk behaviors, including data exfiltration, redirects to a suspicious domain, and obfuscated code. While some of the behaviors may be related to legitimate analytics or device detection, the overall risk is elevated due to the lack of transparency and the potential for abuse.
Source: 1.4.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://azz.underbellymeet.asia/?utm_term=74567579... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of history manipulation, hash changes, and click event handling to redirect users to potentially malicious URLs is highly suspicious and indicative of malicious intent. The obfuscated URLs and query parameters further increase the risk score. Overall, this script demonstrates a clear attempt to engage in malicious activities and should be considered a high-risk threat.
Source: 1.3.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://azz.underbellymeet.asia/?1=173475&utm_medi... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a suspicious domain. The use of obfuscated URLs and the redirection to an unknown domain 'azz.underbellymeet.asia' are strong indicators of malicious intent. Additionally, the script appears to be collecting sensitive information like the user's platform via the 'navigator.platform' API. Overall, this script poses a significant security risk and should be treated with caution.
Source: 1.11.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://wungoangeredsa.com/finance-survey/272/?sva... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While some of the script's functionality may be legitimate (e.g., analytics or telemetry), the overall risk level is elevated due to the presence of these concerning indicators.
Source: 1.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://azz.underbellymeet.asia/?utm_term=74567579... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script uses the `eval` function to execute remote code, sends user data to an unknown domain, and redirects the user to a potentially malicious website. Additionally, the script uses obfuscated code and URLs, further increasing the risk. Overall, this script demonstrates a high level of malicious intent and should be considered a significant security threat.