Windows Analysis Report
privacy_cieb_hipaa_authorization.pdf

Overview

General Information

Sample name:	privacy_cieb_hipaa_authorization.pdf
Analysis ID:	1542131
MD5:	71fdbd1f71a05334d91d5faeef704c37
SHA1:	c57b4ca78af0c4c546c653d480d38a889c467e85
SHA256:	bc422583a4ee5158e05add18f2673b09aa451023fdc5c78562565ffd2e50fea3
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/31@2/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A94azkde_1msciff_5oo.tmp

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\privacy_cieb_hipaa_authorization.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1536,i,9421411581824083625,169098937294326978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1536,i,9421411581824083625,169098937294326978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: privacy_cieb_hipaa_authorization.pdf	Initial sample: PDF keyword /JS count = 0
Source: privacy_cieb_hipaa_authorization.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A94azkde_1msciff_5oo.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A94azkde_1msciff_5oo.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: A94znwnv_1mscifg_5oo.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A94znwnv_1mscifg_5oo.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: A9yuz94x_1mscifi_5oo.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9yuz94x_1mscifi_5oo.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: privacy_cieb_hipaa_authorization.pdf

Initial sample: PDF keyword stream count = 68

Source: A94azkde_1msciff_5oo.tmp.0.dr

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: privacy_cieb_hipaa_authorization.pdf

Initial sample: PDF keyword /ObjStm count = 8

Source: privacy_cieb_hipaa_authorization.pdf

Initial sample: PDF keyword obj count = 72

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1542131
Product:	CloudBasic
Start time:	15:27:44
Start date:	25.10.2024
Sample:	privacy_cieb_hipaa_authorization.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	71fdbd1f71a05334d91d5faeef704c37
SHA1:	c57b4ca78af0c4c546c653d480d38a889c467e85
SHA256:	bc422583a4ee5158e05add18f2673b09aa451023fdc5c78562565ffd2e50fea3
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	2E30563F6C0F1840B4E25B3CF08FA58E	8405CE42A13E3D88710DB60D621839703852B9D6	32DA22CCFC5387AF3892FF1B9889E3FE07DC9C3395C5801A844EF87916A932A3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	2E30563F6C0F1840B4E25B3CF08FA58E	8405CE42A13E3D88710DB60D621839703852B9D6	32DA22CCFC5387AF3892FF1B9889E3FE07DC9C3395C5801A844EF87916A932A3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	9E3DB608A6115B3B6F39B3D79C876F99	090FFF96D815F77CEF90845C0F114173DDC63340	4D7A5D7E208726C5346D3687E96404C63AA76150D28157F3DDF57E650AF4761A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	9E3DB608A6115B3B6F39B3D79C876F99	090FFF96D815F77CEF90845C0F114173DDC63340	4D7A5D7E208726C5346D3687E96404C63AA76150D28157F3DDF57E650AF4761A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	98CE4E9500370604FCE7F6B73E76E7A7	6EEC34AC67D98CC960EA0F2D72E09542FA82B674	C6B7CF23067E0689F64135423B53D5152809A54BE22FC1F5D383B40CC887CD24
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\acbda0eb-034a-46bb-a618-f8c2fcfca926.tmp	JSON data	98CE4E9500370604FCE7F6B73E76E7A7	6EEC34AC67D98CC960EA0F2D72E09542FA82B674	C6B7CF23067E0689F64135423B53D5152809A54BE22FC1F5D383B40CC887CD24
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	9B889B75C0CB8186E4E0162F1A10B981	BF32F73836C0591B65FAA93D0CDDAE7EBAE14B1B	F602DA4F4A9B0977B4EA8DC79DA955D2A6FE87E689DD3D3C4EB9231C3313B6FB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	86FF8553F52B81A77E1AA8E8A88E0B55	6CFE7A9F40BA4F210874AC28EF536484E84B4C1C	57687DB63BB69A0316C76E5FEE94E4AF81486CB01C1E7FE817AFA4D5E0EFDED5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	86FF8553F52B81A77E1AA8E8A88E0B55	6CFE7A9F40BA4F210874AC28EF536484E84B4C1C	57687DB63BB69A0316C76E5FEE94E4AF81486CB01C1E7FE817AFA4D5E0EFDED5
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241025132851Z-237.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	A88CB0171DBAF8CA842A58A52508206F	AF6CE77565194369CBB6F4E6717E93076E4674E6	C377CF559C14AC5C49D8701D8EDB2B76720C3D5908FFA4A19D48FF88497A9387
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	F28FCDCEEACE94CD80484977EC19E747	35FEBDF9F67E4C51D874E1C89CCAFC2914965515	6EE1E94FCBBBFDA7838C34D4C8E1A206F6536E37C43A925C825647A8B7A0717A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	F7A78110BEAFAC71843A3F848473A54A	8DCF98D96DB7AE4C5A52C9E1C8ABAE8489C67936	2F62CD6F318BD7420398AE3699437EB649E70978B250F2428F20848D14699090
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	BE329E070B3C61ECA90A24130F0C8EC9	4E235DC785B1A311263EAE6636282A80CC53483C	343A970167E5D3470DD24EFE589E32A2B10369F39E56E3A7519B5E5EB0350AE9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	9E2DA398BEFA97EA9F624E655B3078E5	58D598F01EDFB3157EEA4F2547AB1C14005C0EAB	F8FAC384F8EDFE303D640B08F64A9E99E570B2C9369DC206814120F7050A2394
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	43FDD7AA5D387392B0B31BE4E1726754	4CED7323895A365E812406CBB54EBB3EE75F0C3D	9A26925147617D50B554B212A08C232A76E7440B057E67B6B4825646949D89E6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	DAC447B6AE6FB08D6496B7A235F1CC74	0C1CB97BEFEBC800E01DEF92DBBCB06F9436AFC3	70D59D73A9FFF2CEF05CCC16F4C839C6F7D1E1CCE35EC7EC81327561F95ADD07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	FA6561587723133371AC645AC574E8DB	034766F980AE09760E1A7C7B098D3D3382F38FAE	D55E1CE94DAF5239388D8A11F992BA6FC81DC309E405E2D7253BFA15C53B2CE0
C:\Users\user\AppData\Local\Temp\MSI6c213.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	CC53983790D98A7C4CEE3BCE5E789D9A	40A6F31F9C9DECEDB392A7CB9DBC650BF1D7385F	5C1B39CD219612DB739EA79C2A2C94E568DB6745B55D7FF4237A5229A8DCCDD3
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A94azkde_1msciff_5oo.tmp	PDF document, version 1.6, 0 pages	7AAF250AB08C0E21465E1F7616A7084B	1DAD0600874A3C0F797EA96FF035E65FD6CE8D3B	5DB63CCCA3BCBFDFFC6561414D03126F69618C8684DF42AF3C3BAF3EB80C2CFB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A94znwnv_1mscifg_5oo.tmp	PDF document, version 1.6, 0 pages	49F32DD8DDC3F9A83998177D00C4A7BE	99E26B74CB637F9D18C92586FFCD0DF6EBBB84D0	65B62FE223AD45291E0C6E3E933BEAE4B75E600DAD399ADA793CC6008E3E17AB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9yuz94x_1mscifi_5oo.tmp	PDF document, version 1.6, 0 pages	E519252F806051FECBF6872235A30767	8F734015D0905B5B1D7750A1DF2937807ACB2441	BCB83C280878F7E100735FAFC805C9BC81738367A548B4EAD8D5853C906D8BAF
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-25 09-28-49-938.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	0990C347698022B606896DDEB124AF3F	F53F9494DC00358BD3964F43E10EB7D9B035932A	8B98407BC9F4BC72C60EC0209FA1D6D527A5F65127FDB3F6041E919C38BC32E9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	FF1DC031294A2F0D8896630148922BF8	8650709DFD0A6A778C48444C4A57FA9E171A7904	DEC3E66CDAB17F9B84E7ACD1D146FD44B39214F713459F23D5626CB644CDBC64
C:\Users\user\AppData\Local\Temp\acrocef_low\0caf8e4f-e05e-47b5-91c4-ff758d96002e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	02DBFDF24AE567A62D6DA6D004CD5B4D	ACF7A08EB89233C8628C94C7AE5554499C51875C	46800AC00989EA7873C91716CE5CDFE7CEC821C74DA0BDF233A3CB16B0E789CE
C:\Users\user\AppData\Local\Temp\acrocef_low\10be57fd-368c-45c4-b703-267dd06e2e01.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\7bab0a0c-0a7d-4b5b-83d5-1a794fce1a28.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\fc287385-a5d0-4d3a-b446-ef882fb3543c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486

Windows Analysis Report
privacy_cieb_hipaa_authorization.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report privacy_cieb_hipaa_authorization.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
privacy_cieb_hipaa_authorization.pdf