Login

u/HappyConstruction387

r/computerviruses r/cybersecurityindia
▲ 1 r/computerviruses

Need help interpreting Process Monitor events for a PDF

Hi everyone,

I'm trying to understand whether some Process Monitor events related to a PDF are normal or indicate unusual behavior.

About 10 days ago, this PDF was flagged by one antivirus engine on VirusTotal. The detection has since disappeared, and the current report shows 0 detections.

VirusTotal report: [cole o link aqui]

The PDF was downloaded from Mercado Livre, where it was generated as a shipment authorization document.

I'm investigating it because of the previous VirusTotal detection and would like to understand whether the recorded Process Monitor events are normal.

Unfortunately, I couldn't attach the Procmon screenshot because my posts are currently being filtered.

The main events are:

  • FAST IO DISALLOWED
  • BUFFER OVERFLOW
  • NAME NOT FOUND
  • INVALID PARAMETER
  • FILE LOCKED WITH ONLY READERS

Are these expected for a normal PDF, or is there anything that deserves further investigation?

reddit.com
u/HappyConstruction387 — 2 days ago
▲ 2 r/cybersecurityindia+1 crossposts

Do these Process Monitor events look normal for a PDF file?

I'm investigating a PDF that was flagged as a Trojan by a single antivirus engine on VirusTotal about 10 days ago. The detection has since disappeared, and the file currently has 0 detections.

To better understand the file's behavior, I captured its activity with Process Monitor while performing the following actions:

  • Open the PDF in Microsoft Edge
  • Close it
  • Rename it
  • Rename it back to its original name
  • Delete it

The attached link contains a Process Monitor screenshot showing only the events related to this PDF.

My question is:

Do these Procmon events look like normal Windows behavior for a regular PDF, or is there anything that stands out as suspicious?

I'm particularly interested in the meaning of events such as:

  • FAST IO DISALLOWED
  • BUFFER OVERFLOW
  • NAME NOT FOUND
  • INVALID PARAMETER
  • FILE LOCKED WITH ONLY READERS

I'm not looking for conclusions based solely on VirusTotal. I'm mainly interested in a technical interpretation of the Process Monitor events from people experienced with Windows internals and Procmon.

u/HappyConstruction387 — 2 days ago