Windows Analysis Report
5173893RI_1518138.pdf

Overview

General Information

Sample name: 5173893RI_1518138.pdf
Analysis ID: 1544791
MD5: 92f0367f486b9f25b0f887bb2378cb97
SHA1: 7c8877f7507631bd777088137069f4fbea7a9329
SHA256: 06f8d24ca56e2e8c671baefdf76cbdb756031ade1cd37dffd08e4fb04170f56e

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)

Classification

Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: x1.i.lencr.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 192.168.2.17:49711 -> 96.7.168.138:443
Source: global traffic TCP traffic: 96.7.168.138:443 -> 192.168.2.17:49711
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: x1.i.lencr.org
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: classification engine Classification label: clean1.winPDF@20/52@1/65
Source: 5173893RI_1518138.pdf Initial sample: mailto:arcusto@compugen.com
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5480
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 13-51-02-606.log
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\5173893RI_1518138.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2060 --field-trial-handle=1592,i,4056437335574955262,12825995236133553984,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 2C2F77C6663B5C0EF06CF7D24CC411D1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2060 --field-trial-handle=1592,i,4056437335574955262,12825995236133553984,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: 5173893RI_1518138.pdf Initial sample: PDF keyword /JS count = 0
Source: 5173893RI_1518138.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: 5173893RI_1518138.pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information queried: ProcessInformation
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.159.61.3
 unknown United States
13335 CLOUDFLARENETUS false
2.23.197.184
 unknown European Union
1273 CWVodafoneGroupPLCEU false
23.218.232.159
 unknown United States
24835 RAYA-ASEG false
184.28.88.176
 unknown United States
16625 AKAMAI-ASUS false
96.7.168.138
 unknown United States
262589 INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR false
18.207.85.246
 unknown United States
14618 AMAZON-AESUS false
199.232.210.172
 bg.microsoft.map.fastly.net United States
54113 FASTLYUS false

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
x1.i.lencr.org unknown unknown