Edit tour

Windows Analysis Report
document.pdf

Overview

General Information

Sample name:	document.pdf
Analysis ID:	1564534
MD5:	1564debc205330db6ec59839837de047
SHA1:	07fe560f2f5b66bab01b3847aa26196ae8905a02
SHA256:	ac1d3a7d60e52c4b49fb2ab1cba0257e763bd2c26a971ce1161e3ae118dbc5cd
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7312 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\document.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7780 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,5964392041809778140,4607358404255903214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443

Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744

Source: Joe Sandbox View

IP Address: 50.16.47.176 50.16.47.176

Source: global traffic

HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: document.pdf	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: document.pdf	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: document.pdf	String found in binary or memory: http://ns.useplus.org/ldf/vocab/DMI-PROHIBITED-EXCEPTSEARCHENGINEINDEXING
Source: document.pdf	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: document.pdf	String found in binary or memory: http://xmp.gettyimages.com/gift/1.0/
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com/detail/1471542553?utm_medium=organic&utm_source=google&utm_campa
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com/detail/1801741596?utm_medium=organic&utm_source=google&utm_campa
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com/detail/1889668931?utm_medium=organic&utm_source=google&utm_campa
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com/eula?utm_medium=organic&utm_source=google&utm_campaign=iptcurl
Source: document.pdf	String found in binary or memory: https://www.shutterstock.com/image-photo/1940410141?utm_source=iptc&utm_medium=googleimages&
Source: document.pdf	String found in binary or memory: https://www.shutterstock.com/image-photo/2262759289?utm_source=iptc&utm_medium=googleimages&

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\document.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,5964392041809778140,4607358404255903214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,5964392041809778140,4607358404255903214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: document.pdf	Initial sample: PDF keyword /JS count = 0
Source: document.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Exploitation for Client Execution	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.useplus.org/ldf/vocab/DMI-PROHIBITED-EXCEPTSEARCHENGINEINDEXING	document.pdf	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.1.dr	false		high
https://www.gettyimages.com	document.pdf	false		high
http://ns.useplus.org/ldf/xmp/1.0/	document.pdf	false		high
https://www.shutterstock.com/image-photo/1940410141?utm_source=iptc&utm_medium=googleimages&	document.pdf	false		high
https://www.gettyimages.com/detail/1471542553?utm_medium=organic&utm_source=google&utm_campa	document.pdf	false		high
https://www.gettyimages.com/eula?utm_medium=organic&utm_source=google&utm_campaign=iptcurl	document.pdf	false		high
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	document.pdf	false		high
http://xmp.gettyimages.com/gift/1.0/	document.pdf	false		high
https://www.gettyimages.com/detail/1889668931?utm_medium=organic&utm_source=google&utm_campa	document.pdf	false		high
https://www.gettyimages.com/detail/1801741596?utm_medium=organic&utm_source=google&utm_campa	document.pdf	false		high
http://cipa.jp/exif/1.0/	document.pdf	false		high
https://www.shutterstock.com/image-photo/2262759289?utm_source=iptc&utm_medium=googleimages&	document.pdf	false		high

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564534
Start date and time:	2024-11-28 13:57:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	document.pdf
Detection:	CLEAN
Classification:	clean2.winPDF@15/54@3/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Input	Output
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "AI Security Essentials", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: PDF document Model: Joe Sandbox AI	{ "brands": [ "Microsoft 365 Copilot" ] }
	{ "brands": [ "Microsoft 365 Copilot" ] }

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
50.16.47.176	FACTURE NON PAYEE.pdf	Get hash	malicious	Unknown	Browse
	Notice_Of_New_Remittance.pdf	Get hash	malicious	Unknown	Browse
	Settlement_Legal_Transcription.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:EU:98ca4a25-984a-4511-9eb1-b7e6c5c56a12	Get hash	malicious	HTMLPhisher	Browse
	REMITTANCE-NOTICE-For-Norriselectricxslx.pdf	Get hash	malicious	Unknown	Browse
	2855dffd-7888-4713-9478-2bbfa22fab70.eml	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002B_218.exe	Get hash	malicious	Unknown	Browse
	Scanner_SKME092878673568739809289728639802765768729809208.pdf	Get hash	malicious	Unknown	Browse
	Faraday Pharmaceuticals Mid-year Benefits.pdf	Get hash	malicious	HTMLPhisher	Browse
	Invoice #INV-97267267 is due for auto-renewals.zip	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	FVR-N2411-07396.exe	Get hash	malicious	Lokibot, PureLog Stealer	Browse	199.232.210.172
	5c13e6.msi	Get hash	malicious	AteraAgent	Browse	199.232.214.172
	FACTURE NON PAYEE.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	goHB2EXlPf.exe	Get hash	malicious	RedLine, SectopRAT	Browse	199.232.210.172
	goHB2EXlPf.exe	Get hash	malicious	RedLine, SectopRAT	Browse	199.232.210.172
	9VbeqQbgU4.exe	Get hash	malicious	RedLine, SectopRAT	Browse	199.232.210.172
	chutmarao.ps1	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	fpPn4XBjyk.exe	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	Banco Santander Totta - NOTIFICA#U00c7#U00c3O DE TRANSFER#U00caNCIA ELECTR#U00d3NICA.eml	Get hash	malicious	CredentialStealer	Browse	199.232.214.172
	invoice-1664809283.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	file.exe	Get hash	malicious	Unknown	Browse	18.213.123.165
	FACTURE NON PAYEE.pdf	Get hash	malicious	Unknown	Browse	50.16.47.176
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	18.213.123.165
	invoice_96.73.exe	Get hash	malicious	FormBook	Browse	18.208.156.248
	https://u48396839.ct.sendgrid.net/ls/click?upn=u001.6YeAQ6CJdNBv-2FudCmnBUfnGDeiTDEbkJBDYPt6L9zLs-2FLsak6B-2FHJOeuaA20CRyj4ymcnZhEANFrmmsKVXf7lykKGGim9NKe15FTuMOZuNBEFww2OP8BGALV3hzGu43iFj3whu7ElN-2FNYQWfEnFZNtXik-2Bc8xYTdlDDi-2B43g3xWfoVMN9Dsem2IaNiiX-2B-2BZ0QUoG_EefQjaPBlm3j-2F4SdpslfvAk7fHMHOXJ7LweRGvhfSEmfDfe568-2FY-2BOLHESUZOtre1SJ0b0hpgZyE9nNkk5TdPOPC4tMbl8SiWrItsarfSJPs2UVOaCUP5NH54Bsd5iepHuriwvocK8ytgM3DUdP-2FGahP9TgWP8NK8XkzPu1yHstDO59EN9oezB0Bvcj4q1reEb5SVFPJB790ukEQpDzKhgmB7njVUkFC8cDwRBiYm4JeBTEVj-2FO9L-2B-2B-2FOmACAmxhX3ZwjKn-2F44onZNgScafSE7DBg-2BaKyUPEhIs0htUoWnblk2BMfXpJIrTjI4RRPPL3aYkpTlROjrttDT-2FsPXJXV6Ht5SRUu-2B0FMc-2F6UTXOUHRIAToTaXExoh-2BhOHngBDGdH-2FjIVKS7GHuJm-2FScM7fL8YyMYHIc3ZF3zj-2FrNo1yxz6qQNvNwYKE88E7ss0Of03GH-2FJ0B8fjyNmYGjPzU42L4WTkis-2FCNDcoVJ6gJCIZpmjB42-2FzDW6h-2FUREH0NUo2OPfZ9i8VYJz7QmCHLGmxdxD04Jz41PYtN7DaspcbsjIDanjiifLEQrLEWmHGBUFW4S8xlKCRj6eGsM5ZaDHWshSLBdAzDSyuonhuBxtuYLeNVHermIaoXD85egwdLJYANewTDecNDoTikVJ8mQdl7ZtnugAlt3ha0w0KmdiGihn6nvMrhhJrSgrE-2B65pLabznZrU0JRBQYA244iDFukcakZMIzjlzqr9piWLEWATx3NZaoZsiDxjNPIcS-2BPZq07eqXM1Ulzf-2FqkjGpcDoFG-2FrwE0q08CJl0HkI1XntIga1RDU5EZi756rrs6KbGhi0n0UYyAPMzcKJ1GSCyUZR-2FjEg-2FvBTzHO-2FOloWzctFMjjbt8OJhXkQtpwpSzQ5WMHPnqPpU8mVl6-2F8VDi2j4ulsfLIYkFMQxs-2FFnpoz7jaZyont10-3D	Get hash	malicious	Unknown	Browse	54.226.114.88
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	35.172.163.142
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.20.129.235
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	34.233.54.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	18.208.8.205
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.22.218.104

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.251349803170146
Encrypted:	false
SSDEEP:	6:Ht5N+q2Pwkn2nKuAl9OmbnIFUt8YtOmZmw+YtOiVkwOwkn2nKuAl9OmbjLJ:Nz+vYfHAahFUt8SOm/+SOiV5JfHAaSJ
MD5:	9EBFFA0A3706191F1CF081E389D5D246
SHA1:	729570EB1B54A4FCB3F79210DA0CC216FDBA1027
SHA-256:	2539FCF2D7672D48A1356A8B17186D53780315FEE867E923766283A6FDE0D539
SHA-512:	FA23A11F3B64C51E1A7307FADE8052A491196055F1440DB716DFA8687A4D7A95C9418C2C1DF31D0EC6A254FACF5864AB0A2020F992C427114BDCB89CE5486150
Malicious:	false
Reputation:	low
Preview:	2024/11/28-07:58:12.952 1ddc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/28-07:58:12.954 1ddc Recovering log #3.2024/11/28-07:58:12.954 1ddc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

File type:	PDF document, version 1.7
Entropy (8bit):	7.414047851487961
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	document.pdf
File size:	3'000'337 bytes
MD5:	1564debc205330db6ec59839837de047
SHA1:	07fe560f2f5b66bab01b3847aa26196ae8905a02
SHA256:	ac1d3a7d60e52c4b49fb2ab1cba0257e763bd2c26a971ce1161e3ae118dbc5cd
SHA512:	04224f5e0131978298aba57e1fe91b3326839b59a4af34b4d217390b9ce5221ac521cf2c66fde0a1b18c91193bad5c564a5388fcc1b39bda25ac0df02b771ea8
SSDEEP:	49152:y9LAsFco7FQZhA/YRIIRK0dM5TTijxd7yOr4/nBzLHkYN:CLAmcaenA/YOWZKTy75ABTN
TLSH:	FBD5CF91B28D1D44C28943FC11BBB6142B6DF0E19BD3E2DB2A68A371B677FA1EF45101
File Content Preview:	%PDF-1.7.%......1039 0 obj.<</Linearized 1/L 2948780/O 1043/E 296086/N 14/T 2927878/H [ 878 1158]>>.endobj. ..xref..1039 28..0000000016 00000 n..0000002240 00000 n..0000002474 00000 n..0000002512 00000 n..0000002549 00000 n..0000004525 00000 n..0000

General
Header:	%PDF-1.7
Total Entropy:	7.414048
Total Bytes:	3000337
Stream Entropy:	7.406400
Stream Bytes:	2835302
Entropy outside Streams:	4.917050
Bytes outside Streams:	165035
Number of EOF found:	3
Bytes after EOF:

Name	Count
obj	349
endobj	349
stream	143
endstream	143
xref	3
trailer	3
startxref	3
/Page	28
/Encrypt	0
/ObjStm	8
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5
1058	0000000000000000	9bb57bb3adc8f26f88132ea9352d89f9
1059	000000008080c0e0	7115c92e2337a485f0302d950dc04e1d
1061	9918496d7ced793f	ec871ddca4128b3c5e92d18dff01f765
1062	b26972102a9258f0	1af62b073fa4387eb06ca83bd47f5879
1063	b26872102a9258f0	7c90c7582d27bbd2ae29e054107457ba

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 13:58:22.860780954 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:22.860829115 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:22.860958099 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:22.861136913 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:22.861150026 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.274570942 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.274857998 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:24.274876118 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.275960922 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.276036978 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:24.276046038 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.276135921 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:24.276398897 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:24.276460886 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.276647091 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:24.276659966 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.325932980 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:24.775367975 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.775389910 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.775449038 CET	443	49744	50.16.47.176	192.168.2.4
Nov 28, 2024 13:58:24.775480986 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:24.775598049 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:24.776715994 CET	49744	443	192.168.2.4	50.16.47.176
Nov 28, 2024 13:58:24.776735067 CET	443	49744	50.16.47.176	192.168.2.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 13:58:23.263371944 CET	53958	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:58:36.404736042 CET	49817	53	192.168.2.4	1.1.1.1
Nov 28, 2024 13:58:54.233349085 CET	61759	53	192.168.2.4	1.1.1.1

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 13:58:21.079267025 CET	1.1.1.1	192.168.2.4	0xc74b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:58:21.079267025 CET	1.1.1.1	192.168.2.4	0xc74b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:58:23.495650053 CET	1.1.1.1	192.168.2.4	0xd7cd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:58:36.543066025 CET	1.1.1.1	192.168.2.4	0xf855	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 13:58:54.468641996 CET	1.1.1.1	192.168.2.4	0x3e70	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report document.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6b7fa7.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a9c8cd2f-1842-4dc5-90cc-f84e45eb5b7e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f4b2bd58-bb10-434f-a4fe-092b773219dd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241128125817Z-216.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7404

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7404

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Windows Analysis Report
document.pdf

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:58:24 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37 x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-11-28 12:58:24 UTC	608	IN	HTTP/1.1 200 Server: openresty Date: Thu, 28 Nov 2024 12:58:24 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 4762 Connection: close x-request-id: xBwuQeUr4z5C6m3rACufEzMuF2sHUEPq vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-11-28 12:58:24 UTC	4762	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 47 56 34 64 43 49 36 49 6c 52 79 65 53 42 42 59 33 4a 76 59 6d 46 30 49 46 42 79 62 79 4a 39 4c 43 4a 31 61 53 49 36 65 79 4a 30 61 58 52 73 5a 56 39 7a 64 48 6c 73 61 57 35 6e 49 6a 70 37 49 6d Data Ascii: {"surfaces":{"DC_Reader_Home_LHP_Trial_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","dataType":"application/json","data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7Im

Target ID:	0
Start time:	07:58:09
Start date:	28/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\document.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	07:58:11
Start date:	28/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	07:58:13
Start date:	28/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,5964392041809778140,4607358404255903214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre