Edit tour
Linux
Analysis Report
eicarINFECTED.pdf
Overview
General Information
Detection
Score: | 52 |
Range: | 0 - 100 |
Whitelisted: | false |
Signatures
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Creates hidden files and/or directories
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Uses the "uname" system call to query kernel version information (possible evasion)
Classification
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1524440 |
Start date and time: | 2024-10-02 19:56:33 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 7m 24s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultlinuxfilecookbook.jbs |
Analysis system description: | Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171) |
Analysis Mode: | default |
Sample name: | eicarINFECTED.pdf |
Detection: | MAL |
Classification: | mal52.linPDF@0/2@0/0 |
Cookbook Comments: |
|
- VT rate limit hit for: eicarINFECTED.pdf
Command: | sudo -u james xdg-open "/tmp/eicarINFECTED.pdf" |
PID: | 4724 |
Exit Code: | 0 |
Exit Code Info: | |
Killed: | False |
Standard Output: | |
Standard Error: | ** (evince:4817): WARNING **: Unimplemented action: POPPLER_ACTION_JAVASCRIPT, please post a bug report in Evince bugzilla (http://bugzilla.gnome.org) with a testcase. |
⊘No yara matches
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | ReversingLabs: |
Source: | Joe Sandbox ML: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | OLE indicator, VBA macros: |
Source: | OLE stream indicators for Word, Excel, PowerPoint, and Visio: |
Source: | Classification label: |
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior |
Source: | Stderr: ** (evince:4817): WARNING **: Unimplemented action: POPPLER_ACTION_JAVASCRIPT, please post a bug report in Evince bugzilla (http://bugzilla.gnome.org) with a testcase.: |
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | 1 Scripting | Valid Accounts | Windows Management Instrumentation | 1 Scripting | Path Interception | 1 Hidden Files and Directories | OS Credential Dumping | 1 Security Software Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
⊘No configs have been found
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
83% | ReversingLabs | Document-PDF.Malware.EICAR | ||
100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No contacted domains info
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | unknown | |||
false | unknown | |||
false | unknown |
⊘No contacted IP infos
Process: | /usr/bin/evince |
File Type: | |
Category: | dropped |
Size (bytes): | 1 |
Entropy (8bit): | 0.0 |
Encrypted: | false |
SSDEEP: | 3:: |
MD5: | 93B885ADFE0DA089CDF634904FD59F71 |
SHA1: | 5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F |
SHA-256: | 6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D |
SHA-512: | B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE |
Malicious: | false |
Reputation: | high, very likely benign file |
Preview: |
Process: | /usr/bin/evince |
File Type: | |
Category: | dropped |
Size (bytes): | 713 |
Entropy (8bit): | 5.124224800515847 |
Encrypted: | false |
SSDEEP: | 12:TMHdE2J9kLS3ROBQkLSjE7GlAsq8nTJtnLRVHZlEweKwxh9XyB/qCwR+we7x+0Zb:2dEm3RJVjllhXJtVV5Kh9CB/QEdZb |
MD5: | 7C94B94FB7D4135047F19BB9EBA7975E |
SHA1: | 8D4C22571DB07F74144074F4914D49AB2B9907D9 |
SHA-256: | 9B25B90F532FEEA779D50476F71D9568B60664DD05627E2B05BE39B58CD44F89 |
SHA-512: | 792F61A658579D183BED782963D48C91E8E0DCC801B3148BAD153EEE666426AFA819A191B3B026843CB9BCEAF9326224A1652731C97AEF4CACF08AD8D60F5E5B |
Malicious: | false |
Reputation: | low |
Preview: |
File type: | |
Entropy (8bit): | 4.984533980743053 |
TrID: |
|
File name: | eicarINFECTED.pdf |
File size: | 2'061 bytes |
MD5: | 911dd1610034027a924387d42f56bdf0 |
SHA1: | 6ce8d59428b6a646ac5eb440b540e8984ece5b08 |
SHA256: | 4daf4edbb04383b93094e89636f303bb11ab687636a4d40813e930c213c3b513 |
SHA512: | 8bf9551c4f1c81e7c36f66cb3e04aa3fbfb5f5ce3796f5685dc83719899a46f7380e37256424a37049a9bfa8e77f045c1e0483387873fa2e6baa277d616a8f6b |
SSDEEP: | 48:ull2naNCsOB2l8ggv1KToW7RO2MJXbRTd2l6vRzToMxZmdKor:uz2naNCsO68yToUYJXbRTd0qToMnoJr |
TLSH: | DB41F02AFC5B5DCCD4704F425B18F89AA83CF19235C844C2347CA7036A0CF4E6E8295E |
File Content Preview: | %PDF-1.1....1 0 obj..<<.. /Type /Catalog.. /Outlines 2 0 R.. /Pages 3 0 R.. /Names << /EmbeddedFiles << /Names [(EICAR.txt) 9 0 R] >> >>..>>..endobj....2 0 obj..<<.. /Type /Outlines.. /Count 0..>>..endobj....3 0 obj..<<.. /Type /Pages.. /Kids [4 0 R].. /C |
General | |
---|---|
Header: | %PDF-1.1 |
Total Entropy: | 4.984534 |
Total Bytes: | 2061 |
Stream Entropy: | 4.412538 |
Stream Bytes: | 644 |
Entropy outside Streams: | 4.901738 |
Bytes outside Streams: | 1417 |
Number of EOF found: | 1 |
Bytes after EOF: |
Name | Count |
---|---|
obj | 10 |
endobj | 10 |
stream | 2 |
endstream | 2 |
xref | 1 |
trailer | 1 |
startxref | 1 |
/Page | 1 |
/Encrypt | 0 |
/ObjStm | 0 |
/URI | 0 |
/JS | 1 |
/JavaScript | 1 |
/AA | 0 |
/OpenAction | 0 |
/AcroForm | 0 |
/JBIG2Decode | 0 |
/RichMedia | 0 |
/Launch | 0 |
/EmbeddedFile | 1 |
⊘No network behavior found
System Behavior
Start time (UTC): | 17:57:13 |
Start date (UTC): | 02/10/2024 |
Path: | /usr/bin/exo-open |
Arguments: | exo-open /tmp/eicarINFECTED.pdf |
File size: | 22856 bytes |
MD5 hash: | 39c5fa78f1cb3d950b9944f784018d3a |
Start time (UTC): | 17:57:13 |
Start date (UTC): | 02/10/2024 |
Path: | /usr/bin/exo-open |
Arguments: | - |
File size: | 22856 bytes |
MD5 hash: | 39c5fa78f1cb3d950b9944f784018d3a |
Start time (UTC): | 17:57:13 |
Start date (UTC): | 02/10/2024 |
Path: | /usr/bin/dbus-launch |
Arguments: | dbus-launch --autolaunch=11ced2f07072c6ae389b731c5cc84014 --binary-syntax --close-stderr |
File size: | 26616 bytes |
MD5 hash: | e4a469f27d130d783c21ce9c1c4456c3 |
Start time (UTC): | 17:57:13 |
Start date (UTC): | 02/10/2024 |
Path: | /usr/bin/exo-open |
Arguments: | - |
File size: | 22856 bytes |
MD5 hash: | 39c5fa78f1cb3d950b9944f784018d3a |
Start time (UTC): | 17:57:13 |
Start date (UTC): | 02/10/2024 |
Path: | /usr/bin/exo-open |
Arguments: | - |
File size: | 22856 bytes |
MD5 hash: | 39c5fa78f1cb3d950b9944f784018d3a |
Start time (UTC): | 17:57:13 |
Start date (UTC): | 02/10/2024 |
Path: | /usr/bin/evince |
Arguments: | evince /tmp/eicarINFECTED.pdf |
File size: | 416912 bytes |
MD5 hash: | 2e95d2551823570fd40ffe589f9208f1 |
Start time (UTC): | 17:57:14 |
Start date (UTC): | 02/10/2024 |
Path: | /usr/bin/evince |
Arguments: | - |
File size: | 416912 bytes |
MD5 hash: | 2e95d2551823570fd40ffe589f9208f1 |
Start time (UTC): | 17:57:14 |
Start date (UTC): | 02/10/2024 |
Path: | /usr/bin/dbus-launch |
Arguments: | dbus-launch --autolaunch=11ced2f07072c6ae389b731c5cc84014 --binary-syntax --close-stderr |
File size: | 26616 bytes |
MD5 hash: | e4a469f27d130d783c21ce9c1c4456c3 |