Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
Contract Invoice Approval.pdf

Overview

General Information

Sample name:Contract Invoice Approval.pdf
Analysis ID:1644933
MD5:efb7afc23b2cc667f0205e3df6b70161
SHA1:4dbe6fd3870b16f1b61ee2aa1022ae2182ebde68
SHA256:5aebca6ebf77f7611fad29e2ce958e3c933d7ad088457c9fb82e5645bc830034
Infos:

Detection

Score:56
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Creates hidden files and/or directories
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644933
Start date and time:2025-03-21 07:21:54 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 58s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Contract Invoice Approval.pdf
Detection:MAL
Classification:mal56.linPDF@0/2@2/0
  • VT rate limit hit for: http://freedesktop.org
  • VT rate limit hit for: http://www.freedesktop.org/standards/shared-mime-info
  • VT rate limit hit for: https://vleducationdemo.com/cllascio.php?342d3638373437343730373333613266326635613539333737613265363

Runtime Messages

Command:sudo -u saturnino xdg-open "/tmp/Contract Invoice Approval.pdf"
PID:5494
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:(evince:5522): IBUS-WARNING **: 01:22:51.068: Unable to connect to ibus: Could not connect: Connection refused

Process Tree

  • system is lnxubuntu20
  • exo-open (PID: 5515, Parent: 5502, MD5: 60a307a6a6325e2034eb5cc56bff1abd) Arguments: exo-open "/tmp/Contract Invoice Approval.pdf"
    • exo-open New Fork (PID: 5519, Parent: 5515)
    • dbus-launch (PID: 5519, Parent: 5515, MD5: 0b22a45154a51c6121bb1d208d8ab203) Arguments: dbus-launch --autolaunch=ee49dfd4fa47433baee88884e2d7de7c --binary-syntax --close-stderr
    • exo-open New Fork (PID: 5521, Parent: 5515)
      • exo-open New Fork (PID: 5522, Parent: 5521)
      • sh (PID: 5522, Parent: 2955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh evince "/tmp/Contract Invoice Approval.pdf"
      • evince (PID: 5522, Parent: 2955, MD5: 3b2e161f515da97cbd986ec82e935859) Arguments: evince "/tmp/Contract Invoice Approval.pdf"
        • evince New Fork (PID: 5525, Parent: 5522)
        • dbus-launch (PID: 5525, Parent: 5522, MD5: 0b22a45154a51c6121bb1d208d8ab203) Arguments: dbus-launch --autolaunch=ee49dfd4fa47433baee88884e2d7de7c --binary-syntax --close-stderr
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Persistence and Installation Behavior
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Contract Invoice Approval.pdfAvira: detected
Source: Contract Invoice Approval.pdfVirustotal: Detection: 32%Perma Link
Source: Contract Invoice Approval.pdfReversingLabs: Detection: 40%
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: recently-used.xbel.1BWM32.41.drString found in binary or memory: http://freedesktop.org
Source: recently-used.xbel.1BWM32.41.drString found in binary or memory: http://www.freedesktop.org/standards/desktop-bookmarks
Source: recently-used.xbel.1BWM32.41.drString found in binary or memory: http://www.freedesktop.org/standards/shared-mime-info
Source: Contract Invoice Approval.pdfString found in binary or memory: https://vleducationdemo.com/cllascio.php?342d3638373437343730373333613266326635613539333737613265363
Source: recently-used.xbel.1BWM32.41.drOLE indicator, VBA macros: true
Source: recently-used.xbel.1BWM32.41.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: classification engineClassification label: mal56.linPDF@0/2@2/0
Source: /usr/bin/exo-open (PID: 5515)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/bin/exo-open (PID: 5515)Directory: /home/saturnino/.cacheJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/local/share/fonts/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /home/saturnino/.fonts/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/X11/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/type1/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
Source: /usr/bin/evince (PID: 5522)Directory: /home/saturnino/.cacheJump to behavior
Source: /usr/bin/exo-open (PID: 5515)Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/dbus-launch (PID: 5519)Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/evince (PID: 5522)Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/dbus-launch (PID: 5525)Queries kernel information via 'uname': Jump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception1
Hidden Files and Directories		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local System1
Non-Application Layer Protocol		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644933 Sample: Contract Invoice Approval.pdf Startdate: 21/03/2025 Architecture: LINUX Score: 56 19 daisy.ubuntu.com 2->19 21 Antivirus / Scanner detection for submitted sample 2->21 23 Multi AV Scanner detection for submitted file 2->23 9 exo-open 2->9         started        signatures3 process4 process5 11 exo-open 9->11         started        13 exo-open dbus-launch 9->13         started        process6 15 exo-open sh evince 11->15         started        process7 17 evince dbus-launch 15->17         started       

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Contract Invoice Approval.pdf33%VirustotalBrowse
Contract Invoice Approval.pdf41%ReversingLabsDocument-PDF.Trojan.Heuristic
Contract Invoice Approval.pdf100%AviraTR/AVI.PhishingX.eqxeg

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.freedesktop.org/standards/shared-mime-info0%Avira URL Cloudsafe
http://freedesktop.org0%Avira URL Cloudsafe
https://vleducationdemo.com/cllascio.php?342d3638373437343730373333613266326635613539333737613265363100%Avira URL Cloudphishing

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    		high
    NameSourceMaliciousAntivirus DetectionReputation
    http://www.freedesktop.org/standards/desktop-bookmarksrecently-used.xbel.1BWM32.41.drfalse
      		high
      https://vleducationdemo.com/cllascio.php?342d3638373437343730373333613266326635613539333737613265363Contract Invoice Approval.pdffalse
      • Avira URL Cloud: phishing
      		unknown
      http://www.freedesktop.org/standards/shared-mime-inforecently-used.xbel.1BWM32.41.drfalse
      • Avira URL Cloud: safe
      		unknown
      http://freedesktop.orgrecently-used.xbel.1BWM32.41.drfalse
      • Avira URL Cloud: safe
      		unknown

      World Map of Contacted IPs

      ⊘No contacted IP infos

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      daisy.ubuntu.comsshd.elfGet hashmaliciousUnknownBrowse
      • 162.213.35.25
      resgod.m68k.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.24
      resgod.sh4.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.25
      resgod.x86.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.25
      resgod.ppc.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.24
      resgod.arm.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.25
      resgod.arc.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.25
      resgod.mpsl.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.24
      arm7.elfGet hashmaliciousMiraiBrowse
      • 162.213.35.24
      mpsl.elfGet hashmaliciousUnknownBrowse
      • 162.213.35.24

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      Process:/usr/bin/evince
      File Type:very short file (no magic)
      Category:dropped
      Size (bytes):1
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:3::
      MD5:93B885ADFE0DA089CDF634904FD59F71
      SHA1:5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
      SHA-256:6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
      SHA-512:B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
      Malicious:false
      Reputation:high, very likely benign file
      Preview:.
      Process:/usr/bin/evince
      File Type:XML 1.0 document, ASCII text
      Category:dropped
      Size (bytes):722
      Entropy (8bit):5.094946728421738
      Encrypted:false
      SSDEEP:12:TMHdE2J9kLS3ROBQkLSjE7RnLCWr0LpmJtnLRVHZlEweKwxh9XyB/0xzwR+we7xb:2dEm3RJVj6LCGbJtVV5Kh9CB/PEdZb
      MD5:F0629E515B525C290A8A7E80BC5435D1
      SHA1:B6AD20790956E25F160D5FC74A048B434807A4C4
      SHA-256:8BBE31ED0A0DDAD1B1E687B6F84AA3D529F541200E880477D1556838D3C3AC57
      SHA-512:11011637BEBE0839A27D7B9C5C11A012D9DFB15D2DB0497F7FB4E3C6604E44832F38305CE81647163162D7678FE5C3DA6B9C2321ED1E471E26D4419AC2C369EA
      Malicious:false
      Reputation:low
      Preview:<?xml version="1.0" encoding="UTF-8"?>.<xbel version="1.0". xmlns:bookmark="http://www.freedesktop.org/standards/desktop-bookmarks". xmlns:mime="http://www.freedesktop.org/standards/shared-mime-info".>. <bookmark href="file:///tmp/Contract%20Invoice%20Approval.pdf" added="2025-03-21T06:22:51Z" modified="2025-03-21T06:22:51Z" visited="1969-12-31T23:59:59Z">. <info>. <metadata owner="http://freedesktop.org">. <mime:mime-type type="application/pdf"/>. <bookmark:applications>. <bookmark:application name="Document Viewer" exec="&apos;evince %u&apos;" modified="2025-03-21T06:22:51Z" count="1"/>. </bookmark:applications>. </metadata>. </info>. </bookmark>.</xbel>

      Static File Info

      General

      File type:PDF document, version 1.7, 0 pages
      Entropy (8bit):7.271110313948017
      TrID:
      • Adobe Portable Document Format (5005/1) 100.00%
      File name:Contract Invoice Approval.pdf
      File size:5'363 bytes
      MD5:efb7afc23b2cc667f0205e3df6b70161
      SHA1:4dbe6fd3870b16f1b61ee2aa1022ae2182ebde68
      SHA256:5aebca6ebf77f7611fad29e2ce958e3c933d7ad088457c9fb82e5645bc830034
      SHA512:d31ab9fa045bfd5cb9510d9df9de5b286423efc0cb91beb95ed8fcd32936df43ff4a46d7282ab2737f5a63ea670eead89b2f5d4b02e2425bbb42502f8b6bcdd1
      SSDEEP:96:Bvma0krAL28ZEYhlPYIxs2QK4nH0Bi+FPN8okojJ2:ObiwYsyIFPZ0
      TLSH:C6B11BB9D9A8688CFC83DA30D16B358E40AC717357DC7CD204281F97E454D54EA16AF7
      File Content Preview:%PDF-1.7.1 0 obj.<< /Type /Catalog./Outlines 2 0 R./Pages 3 0 R >>.endobj.2 0 obj.<< /Type /Outlines /Count 0 >>.endobj.3 0 obj.<< /Type /Pages./Kids [6 0 R.]./Count 1./Resources <<./ProcSet 4 0 R./Font << ./F1 8 0 R./F2 9 0 R.>>./XObject << ./I1 10 0 R.>

      Static PDF Info

      General

      Header:%PDF-1.7
      Total Entropy:7.271110
      Total Bytes:5363
      Stream Entropy:7.869440
      Stream Bytes:3015
      Entropy outside Streams:5.096095
      Bytes outside Streams:2348
      Number of EOF found:1
      Bytes after EOF:
      NameCount
      obj18
      endobj18
      stream3
      endstream3
      xref1
      trailer1
      startxref1
      /Page1
      /Encrypt0
      /ObjStm0
      /URI2
      /JS0
      /JavaScript0
      /AA0
      /OpenAction0
      /AcroForm0
      /JBIG2Decode0
      /RichMedia0
      /Launch0
      /EmbeddedFile0

      Network Behavior

      Download Network PCAP: filtered – full

      TimestampSource PortDest PortSource IPDest IP
      Mar 21, 2025 07:25:28.897382975 CET6067753192.168.2.141.1.1.1
      Mar 21, 2025 07:25:28.897383928 CET4661653192.168.2.141.1.1.1
      Mar 21, 2025 07:25:29.002351046 CET53466161.1.1.1192.168.2.14
      Mar 21, 2025 07:25:29.002728939 CET53606771.1.1.1192.168.2.14

      DNS Queries

      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
      Mar 21, 2025 07:25:28.897382975 CET192.168.2.141.1.1.10x680fStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
      Mar 21, 2025 07:25:28.897383928 CET192.168.2.141.1.1.10xc785Standard query (0)daisy.ubuntu.com28IN (0x0001)false

      DNS Answers

      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
      Mar 21, 2025 07:25:29.002728939 CET1.1.1.1192.168.2.140x680fNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
      Mar 21, 2025 07:25:29.002728939 CET1.1.1.1192.168.2.140x680fNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

      System Behavior

      General

      Start time (UTC):06:22:46
      Start date (UTC):21/03/2025
      Path:/usr/bin/exo-open
      Arguments:exo-open "/tmp/Contract Invoice Approval.pdf"
      File size:27264 bytes
      MD5 hash:60a307a6a6325e2034eb5cc56bff1abd

      File Activities

      Process Activities

      System Activities

      Network Activities


      General

      Start time (UTC):06:22:46
      Start date (UTC):21/03/2025
      Path:/usr/bin/exo-open
      Arguments:-
      File size:27264 bytes
      MD5 hash:60a307a6a6325e2034eb5cc56bff1abd

      File Activities

      Process Activities


      General

      Start time (UTC):06:22:46
      Start date (UTC):21/03/2025
      Path:/usr/bin/dbus-launch
      Arguments:dbus-launch --autolaunch=ee49dfd4fa47433baee88884e2d7de7c --binary-syntax --close-stderr
      File size:34960 bytes
      MD5 hash:0b22a45154a51c6121bb1d208d8ab203

      File Activities

      System Activities

      Network Activities


      General

      Start time (UTC):06:22:46
      Start date (UTC):21/03/2025
      Path:/usr/bin/exo-open
      Arguments:-
      File size:27264 bytes
      MD5 hash:60a307a6a6325e2034eb5cc56bff1abd

      Process Activities


      General

      Start time (UTC):06:22:46
      Start date (UTC):21/03/2025
      Path:/usr/bin/exo-open
      Arguments:-
      File size:27264 bytes
      MD5 hash:60a307a6a6325e2034eb5cc56bff1abd

      File Activities

      Process Activities


      General

      Start time (UTC):06:22:46
      Start date (UTC):21/03/2025
      Path:/bin/sh
      Arguments:/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh evince "/tmp/Contract Invoice Approval.pdf"
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      File Activities

      Process Activities


      General

      Start time (UTC):06:22:46
      Start date (UTC):21/03/2025
      Path:/usr/bin/evince
      Arguments:evince "/tmp/Contract Invoice Approval.pdf"
      File size:482984 bytes
      MD5 hash:3b2e161f515da97cbd986ec82e935859

      File Activities

      Process Activities

      System Activities

      Network Activities


      General

      Start time (UTC):06:22:48
      Start date (UTC):21/03/2025
      Path:/usr/bin/evince
      Arguments:-
      File size:482984 bytes
      MD5 hash:3b2e161f515da97cbd986ec82e935859

      File Activities

      Process Activities


      General

      Start time (UTC):06:22:48
      Start date (UTC):21/03/2025
      Path:/usr/bin/dbus-launch
      Arguments:dbus-launch --autolaunch=ee49dfd4fa47433baee88884e2d7de7c --binary-syntax --close-stderr
      File size:34960 bytes
      MD5 hash:0b22a45154a51c6121bb1d208d8ab203

      File Activities

      System Activities

      Network Activities