Edit tour

Windows Analysis Report
FIR-069114.pdf

Overview

Sample name:	FIR-069114.pdf
Analysis ID:	1528939
MD5:	efd4fd4aa538e7f0ff2f067c43f9ec38
SHA1:	6d7b8977db4399facfa7b79f3435dd228b844d26
SHA256:	a13c4107db0fceb9314a426a37ba69e178a9958dd584bd6c0dde740629fdb108
Infos:

HTMLPhisher

Antivirus detection for URL or domain

Yara detected HtmlPhish70

AI detected landing page (webpage, office document or email)

HTML page contains suspicious javascript code

Phishing site detected (based on logo match)

Suspicious PDF detected (based on various text indicators)

Detected non-DNS traffic on DNS port

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Uses insecure TLS / SSL version for HTTPS connection

Acrobat.exe (PID: 1848 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FIR-069114.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6552 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4760 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,14502371201210557477,18297061268439937656,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 6548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://ui83ir9eoifdeoi.s3.ap-northeast-2.amazonaws.com/Y8683YUIEF9URORUH9S0IPT40EGG8YTI43RGJ0EPEFWORE8IUGRJEMMPR.html#Jalastair.campbell@charlestaylor.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1996,i,14496368495748628264,14070614855839226263,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Source	Rule	Description	Author	Strings
dropped/chromecache_194	JoeSecurity_HtmlPhish_70	Yara detected HtmlPhish_70	Joe Security

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_70	Yara detected HtmlPhish_70	Joe Security

Click to jump to signature section

Show All Signature Results

AV Detection