Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:EU:d940c2ff-debb-48d2-b87d-f7b409a4774e

Overview

General Information

Sample URL: https://acrobat.adobe.com/id/urn:aaid:sc:EU:d940c2ff-debb-48d2-b87d-f7b409a4774e
Analysis ID: 1541131
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

HTML body contains low number of good links
HTML body contains password input but no form action
Program does not show much activity (idle)

Classification

Source: chromecache_246.2.dr Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_c71df650-5
HTML body contains low number of good links
Source: https://auth.services.adobe.com/en_US/index.html?callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2Fdc-prod-virgoweb%2FAdobeID%2Ftoken%3Fredirect_uri%3Dhttps%253A%252F%252Facrobat.adobe.com%252Flink%252Fhome%252F%2523old_hash%253D%2526from_ims%253Dtrue%253Fclient_id%253Ddc-prod-virgoweb%2526api%253Dauthorize%2526scope%253DAdobeID%252Copenid%252CDCAPI%252Cadditional_info.account_type%252Cadditional_info.optionalAgreements%252Cagreement_sign%252Cagreement_send%252Csign_library_write%252Csign_user_read%252Csign_user_write%252Cagreement_read%252Cagreement_write%252Cwidget_read%252Cwidget_write%252Cworkflow_read%252Cworkflow_write%252Csign_library_read%252Csign_user_login%252Csao.ACOM_ESIGN_TRIAL%252Cee.dcweb%252Ctk_platform%252Ctk_platform_sync%252Cab.manage%252Cadditional_info.incomplete%252Cadditional_info.creation_source%252Cadditional_info.roles%252Cpps.read%252Cupdate_profile.first_name%252Cupdate_profile.last_name%26state%3D%257B%2522ac%2522%253A%2522adobe.com_acrobatweb_login%2522%252C%2522jsl... HTTP Parser: Number of links: 0
HTML body contains password input but no form action
Source: https://auth.services.adobe.com/en_US/index.html?callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2Fdc-prod-virgoweb%2FAdobeID%2Ftoken%3Fredirect_uri%3Dhttps%253A%252F%252Facrobat.adobe.com%252Flink%252Fhome%252F%2523old_hash%253D%2526from_ims%253Dtrue%253Fclient_id%253Ddc-prod-virgoweb%2526api%253Dauthorize%2526scope%253DAdobeID%252Copenid%252CDCAPI%252Cadditional_info.account_type%252Cadditional_info.optionalAgreements%252Cagreement_sign%252Cagreement_send%252Csign_library_write%252Csign_user_read%252Csign_user_write%252Cagreement_read%252Cagreement_write%252Cwidget_read%252Cwidget_write%252Cworkflow_read%252Cworkflow_write%252Csign_library_read%252Csign_user_login%252Csao.ACOM_ESIGN_TRIAL%252Cee.dcweb%252Ctk_platform%252Ctk_platform_sync%252Cab.manage%252Cadditional_info.incomplete%252Cadditional_info.creation_source%252Cadditional_info.roles%252Cpps.read%252Cupdate_profile.first_name%252Cupdate_profile.last_name%26state%3D%257B%2522ac%2522%253A%2522adobe.com_acrobatweb_login%2522%252C%2522jsl... HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://auth.services.adobe.com/en_US/index.html?callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2Fdc-prod-virgoweb%2FAdobeID%2Ftoken%3Fredirect_uri%3Dhttps%253A%252F%252Facrobat.adobe.com%252Flink%252Fhome%252F%2523old_hash%253D%2526from_ims%253Dtrue%253Fclient_id%253Ddc-prod-virgoweb%2526api%253Dauthorize%2526scope%253DAdobeID%252Copenid%252CDCAPI%252Cadditional_info.account_type%252Cadditional_info.optionalAgreements%252Cagreement_sign%252Cagreement_send%252Csign_library_write%252Csign_user_read%252Csign_user_write%252Cagreement_read%252Cagreement_write%252Cwidget_read%252Cwidget_write%252Cworkflow_read%252Cworkflow_write%252Csign_library_read%252Csign_user_login%252Csao.ACOM_ESIGN_TRIAL%252Cee.dcweb%252Ctk_platform%252Ctk_platform_sync%252Cab.manage%252Cadditional_info.incomplete%252Cadditional_info.creation_source%252Cadditional_info.roles%252Cpps.read%252Cupdate_profile.first_name%252Cupdate_profile.last_name%26state%3D%257B%2522ac%2522%253A%2522adobe.com_acrobatweb_login%2522%252C%2522jsl... HTTP Parser: <input type="password" .../> found
Source: https://auth.services.adobe.com/en_US/index.html?callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2Fdc-prod-virgoweb%2FAdobeID%2Ftoken%3Fredirect_uri%3Dhttps%253A%252F%252Facrobat.adobe.com%252Flink%252Fhome%252F%2523old_hash%253D%2526from_ims%253Dtrue%253Fclient_id%253Ddc-prod-virgoweb%2526api%253Dauthorize%2526scope%253DAdobeID%252Copenid%252CDCAPI%252Cadditional_info.account_type%252Cadditional_info.optionalAgreements%252Cagreement_sign%252Cagreement_send%252Csign_library_write%252Csign_user_read%252Csign_user_write%252Cagreement_read%252Cagreement_write%252Cwidget_read%252Cwidget_write%252Cworkflow_read%252Cworkflow_write%252Csign_library_read%252Csign_user_login%252Csao.ACOM_ESIGN_TRIAL%252Cee.dcweb%252Ctk_platform%252Ctk_platform_sync%252Cab.manage%252Cadditional_info.incomplete%252Cadditional_info.creation_source%252Cadditional_info.roles%252Cpps.read%252Cupdate_profile.first_name%252Cupdate_profile.last_name%26state%3D%257B%2522ac%2522%253A%2522adobe.com_acrobatweb_login%2522%252C%2522jsl HTTP Parser: No <meta name="author".. found
Source: https://auth.services.adobe.com/en_US/index.html?callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2Fdc-prod-virgoweb%2FAdobeID%2Ftoken%3Fredirect_uri%3Dhttps%253A%252F%252Facrobat.adobe.com%252Flink%252Fhome%252F%2523old_hash%253D%2526from_ims%253Dtrue%253Fclient_id%253Ddc-prod-virgoweb%2526api%253Dauthorize%2526scope%253DAdobeID%252Copenid%252CDCAPI%252Cadditional_info.account_type%252Cadditional_info.optionalAgreements%252Cagreement_sign%252Cagreement_send%252Csign_library_write%252Csign_user_read%252Csign_user_write%252Cagreement_read%252Cagreement_write%252Cwidget_read%252Cwidget_write%252Cworkflow_read%252Cworkflow_write%252Csign_library_read%252Csign_user_login%252Csao.ACOM_ESIGN_TRIAL%252Cee.dcweb%252Ctk_platform%252Ctk_platform_sync%252Cab.manage%252Cadditional_info.incomplete%252Cadditional_info.creation_source%252Cadditional_info.roles%252Cpps.read%252Cupdate_profile.first_name%252Cupdate_profile.last_name%26state%3D%257B%2522ac%2522%253A%2522adobe.com_acrobatweb_login%2522%252C%2522jsl... HTTP Parser: No <meta name="copyright".. found
Source: chromecache_246.2.dr, chromecache_202.2.dr String found in binary or memory: http://iso.org/pdf/ssn
Source: chromecache_246.2.dr, chromecache_202.2.dr String found in binary or memory: http://iso.org/pdf2/ssn
Source: chromecache_147.2.dr, chromecache_264.2.dr, chromecache_258.2.dr, chromecache_194.2.dr String found in binary or memory: http://typekit.com/eulas/0000000000000000000176ff
Source: chromecache_147.2.dr, chromecache_264.2.dr, chromecache_258.2.dr, chromecache_194.2.dr String found in binary or memory: http://typekit.com/eulas/000000000000000000017701
Source: chromecache_147.2.dr, chromecache_258.2.dr String found in binary or memory: http://typekit.com/eulas/000000000000000000017702
Source: chromecache_147.2.dr, chromecache_264.2.dr, chromecache_258.2.dr, chromecache_194.2.dr String found in binary or memory: http://typekit.com/eulas/000000000000000000017703
Source: chromecache_147.2.dr, chromecache_258.2.dr String found in binary or memory: http://typekit.com/eulas/000000000000000000017704
Source: chromecache_147.2.dr, chromecache_258.2.dr String found in binary or memory: http://typekit.com/eulas/000000000000000000017706
Source: chromecache_146.2.dr, chromecache_236.2.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_186.2.dr String found in binary or memory: https://github.com/WebReflection/url-search-params/blob/master/README.md#ios-10--other-platforms-bug
Source: chromecache_220.2.dr String found in binary or memory: https://ims-na1.adobelogin.com/
Source: chromecache_147.2.dr, chromecache_264.2.dr, chromecache_258.2.dr, chromecache_194.2.dr String found in binary or memory: https://p.typekit.net/p.gif
Source: chromecache_171.2.dr, chromecache_160.2.dr String found in binary or memory: https://sso.behance.net/ims
Source: chromecache_147.2.dr, chromecache_264.2.dr, chromecache_258.2.dr, chromecache_194.2.dr String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/
Source: chromecache_147.2.dr, chromecache_258.2.dr String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/
Source: chromecache_147.2.dr, chromecache_258.2.dr String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/
Source: chromecache_147.2.dr, chromecache_258.2.dr String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/
Source: chromecache_147.2.dr, chromecache_264.2.dr, chromecache_258.2.dr, chromecache_194.2.dr String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/
Source: chromecache_147.2.dr, chromecache_264.2.dr, chromecache_258.2.dr, chromecache_194.2.dr String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/
Source: classification engine Classification label: clean1.win@17/216@0/43
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1760,i,9693317289183372214,3806923182761325238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://acrobat.adobe.com/id/urn:aaid:sc:EU:d940c2ff-debb-48d2-b87d-f7b409a4774e"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1760,i,9693317289183372214,3806923182761325238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1541131 URL: https://acrobat.adobe.com/i... Startdate: 24/10/2024 Architecture: WINDOWS Score: 1 5 chrome.exe 1 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.4 unknown unknown 5->13 15 239.255.255.250 unknown Reserved 5->15 10 chrome.exe 5->10         started        process4 dnsIp5 17 63.140.62.17 OMNITUREUS United States 10->17 19 63.140.62.222 OMNITUREUS United States 10->19 21 39 other IPs or domains 10->21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.186.68
 unknown United States
15169 GOOGLEUS false
3.236.206.93
 unknown United States
14618 AMAZON-AESUS false
3.161.82.76
 unknown United States
16509 AMAZON-02US false
52.215.98.41
 unknown United States
16509 AMAZON-02US false
54.146.88.98
 unknown United States
14618 AMAZON-AESUS false
52.209.185.35
 unknown United States
16509 AMAZON-02US false
151.101.1.138
 unknown United States
54113 FASTLYUS false
2.16.164.83
 unknown European Union
20940 AKAMAI-ASN1EU false
13.224.189.18
 unknown United States
16509 AMAZON-02US false
18.235.168.50
 unknown United States
14618 AMAZON-AESUS false
184.28.89.29
 unknown United States
16625 AKAMAI-ASUS false
54.227.187.23
 unknown United States
14618 AMAZON-AESUS false
52.207.40.124
 unknown United States
14618 AMAZON-AESUS false
104.18.32.195
 unknown United States
13335 CLOUDFLARENETUS false
172.64.155.61
 unknown United States
13335 CLOUDFLARENETUS false
142.250.185.202
 unknown United States
15169 GOOGLEUS false
63.140.62.222
 unknown United States
15224 OMNITUREUS false
3.227.75.142
 unknown United States
14618 AMAZON-AESUS false
23.22.254.206
 unknown United States
14618 AMAZON-AESUS false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
151.101.129.138
 unknown United States
54113 FASTLYUS false
13.32.27.44
 unknown United States
7018 ATT-INTERNET4US false
142.250.186.163
 unknown United States
15169 GOOGLEUS false
2.18.64.31
 unknown European Union
6057 AdministracionNacionaldeTelecomunicacionesUY false
172.64.155.179
 unknown United States
13335 CLOUDFLARENETUS false
162.159.140.165
 unknown United States
13335 CLOUDFLARENETUS false
2.16.164.57
 unknown European Union
20940 AKAMAI-ASN1EU false
54.195.71.107
 unknown United States
16509 AMAZON-02US false
63.140.62.17
 unknown United States
15224 OMNITUREUS false
54.77.72.255
 unknown United States
16509 AMAZON-02US false
2.19.126.211
 unknown European Union
16625 AKAMAI-ASUS false
64.233.167.84
 unknown United States
15169 GOOGLEUS false
2.19.126.198
 unknown European Union
16625 AKAMAI-ASUS false
142.250.185.174
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
172.66.0.163
 unknown United States
13335 CLOUDFLARENETUS false
44.196.228.180
 unknown United States
14618 AMAZON-AESUS false
52.5.13.197
 unknown United States
14618 AMAZON-AESUS false
54.216.81.134
 unknown United States
16509 AMAZON-02US false
52.48.129.25
 unknown United States
16509 AMAZON-02US false
66.235.152.156
 unknown United States
15224 OMNITUREUS false
34.120.195.249
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.4