Windows Analysis Report
ATT0394382.pdf

Overview

General Information

Sample name: ATT0394382.pdf
Analysis ID: 1467827
MD5: 23b58def11b45727d3351702515f86af
SHA1: 099600a10a944114aac406d136b625fb416dd779
SHA256: 6c179f21e6f62b629055d8ab40f454ed02e48b68563913473b857d3638e23b28
Infos:

Detection

Score: 0
Range: 0 - 100
Whitelisted: true
Confidence: 100%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 23.47.168.24:443
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.47.168.24 23.47.168.24
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: classification engine Classification label: clean2.winPDF@14/43@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5860 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-04 14-43-54-787.log Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ATT0394382.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1756,i,7081531118072016957,9515641889187517562,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1756,i,7081531118072016957,9515641889187517562,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information queried: ProcessInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1467827 Sample: ATT0394382.pdf Startdate: 04/07/2024 Architecture: WINDOWS Score: 0 6 Acrobat.exe 62 2->6         started        process3 8 AcroCEF.exe 106 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.47.168.24, 443, 49716 AKAMAI-ASUS United States 10->13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.47.168.24
 unknown United States
16625 AKAMAI-ASUS false