Windows Analysis Report
eicarINFECTED.pdf

Overview

General Information

Sample name:	eicarINFECTED.pdf
Analysis ID:	1523485
MD5:	4a4cc83c1853f2f65aa788a772f5b504
SHA1:	a0508c6435a2011f29779050b0fa92510d5efbf2
SHA256:	dd18992d60db8f016cb7d4a328db80700a6963db7d16b3a8dfb0516dcebe5af0
Tags:	ThreatConnect file submit all 1727794606
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@15/35@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5640

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 10-57-39-502.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\eicarINFECTED.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1508,i,13454654135493957256,7452818844573980035,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1508,i,13454654135493957256,7452818844573980035,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.195.92.153	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1523485
Product:	CloudBasic
Start time:	16:56:49
Start date:	01.10.2024
Sample:	eicarINFECTED.pdf
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4a4cc83c1853f2f65aa788a772f5b504
SHA1:	a0508c6435a2011f29779050b0fa92510d5efbf2
SHA256:	dd18992d60db8f016cb7d4a328db80700a6963db7d16b3a8dfb0516dcebe5af0
Filetype:	JFIF-EXIF JPEG Bitmap (5003/1) 38.44%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	E61EF1ED1C5B136F33587C9F796AF5E6	E8BD830DBD22B878911FC299310506BBAF08D8E8	E89CCA11A6502B0BEDF0F4E58505976FBA3430212710ED99CE4A9F6229936829
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	E61EF1ED1C5B136F33587C9F796AF5E6	E8BD830DBD22B878911FC299310506BBAF08D8E8	E89CCA11A6502B0BEDF0F4E58505976FBA3430212710ED99CE4A9F6229936829
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	9064A9867EF72BC2E1225B808E025980	AD94CE896E8D2FA6F6978511AB5F8986F01B277B	96B75FC0F0CA4E4157828619720606C65E2A1A6E066FEE00B37B56E7B4D4CA1E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	9064A9867EF72BC2E1225B808E025980	AD94CE896E8D2FA6F6978511AB5F8986F01B277B	96B75FC0F0CA4E4157828619720606C65E2A1A6E066FEE00B37B56E7B4D4CA1E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3a3ba560-3ce8-4fb7-9df4-cfc45289d45f.tmp	JSON data	4A247925C505CC3B6420D77EF8C5E657	B942809E551FAF0FF68195680DD50A49F1EE24EF	A7041F9EAC2AF34EA3708B305B17D142706B4C31CE01B8FA9D1C6E10C7119CA7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	6155BA6F1D4A801724E20A308CCBE4B0	2C59EA5FD98FA56455D4CA7B70B0AC9FB5652E52	461EBC0E310A30D9C2E48C7C3A82550A806D90F8D1150348AAFABD777FB2D8F8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\TransportSecurity (copy)	JSON data	4A247925C505CC3B6420D77EF8C5E657	B942809E551FAF0FF68195680DD50A49F1EE24EF	A7041F9EAC2AF34EA3708B305B17D142706B4C31CE01B8FA9D1C6E10C7119CA7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b701e89a-44a6-408b-9484-79eb0d6e726d.tmp	JSON data	6155BA6F1D4A801724E20A308CCBE4B0	2C59EA5FD98FA56455D4CA7B70B0AC9FB5652E52	461EBC0E310A30D9C2E48C7C3A82550A806D90F8D1150348AAFABD777FB2D8F8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	BED8664AF267EB1D5F187188D1B32421	035688E80D9245988236A40ACBEECB12D45EF026	3788C241CC81D73203F6EDF334FC83A1082A1D4170A8A0776B320108031CF09A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	6BBEDF4D7A8765F50E2722C955BFDAD0	31B05B79C418FC8BBE65C67852D8EFD0D7432BB5	E7772218DACF5B28BD4D4BAF5EB70516B3ABC5EB92E7E4DB737DDA5D26EBA84C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	6BBEDF4D7A8765F50E2722C955BFDAD0	31B05B79C418FC8BBE65C67852D8EFD0D7432BB5	E7772218DACF5B28BD4D4BAF5EB70516B3ABC5EB92E7E4DB737DDA5D26EBA84C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3	218D064ED98A5FBF15B4773BE01D2931	67D4A28D26E6D3163F67AA0BD418042E6766199D	C40543C146369F261AD8AC612A72EE2D24195BB3F01DBB657A8B48A0B756143E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	8604B7B1F27436ADFBE0EE10CE988084	FA35318FCBAB5999F89F4FDCF599FB55BD6B20F5	1915A453F79E8E29C8FFDCEE374B6B2F6EFF777F687BBCACBEC0288FBD3DE4C2
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	624632DCC15BEBA82FBB73AE47480439	DAE11EAB5B115B1156740531C3E31AE71BC7C036	ACAED26113DD0E5EAFD7D4AFE4060E2452B1EC0DB89A10D92ED445D1A28BCC84
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	3F7968F41EDF6DB21A1535DD40DB6740	6ACF8A1B1DF6D610DF604F479E42143B6DF62172	85550B2588894DD48E7C56BE5A211A22B222C98DE031F20FEE15D3180C661BD6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5640	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	21161412578633660FD0896405FA55D7	46E251DF8C9E08A66D4D60AF00621C936D820BCC	0BBEF8C1FBBE8EC41D63B7BC935C699CAF2CF49F4F9904B66ACDB62212658885
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	201070E8EAF10873CBE60AFC32C508B7	9586746DF49BA5302AD5DC8738FF5423F8AE7C06	82FF68660CABB0C212EA12F7182019D37F7AB5362F3FFD5F87DE6481A7EB0FB5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	D3665876CC044C54EC2400ABEFCA801D	93C0A3D7CAB10AAF91B6A9E41E02D36456C56C82	422C92BE889E4B7A73AE5A5FBFC2C0A39D332397FDA187859042FDBFD5C527F0
C:\Users\user\AppData\Local\Temp\MSI5d3bf.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	4198CDC1EDB8C645617C07613C468A14	A2433EC6201D6E765E83EC1D1E28702D09D31B14	1639B1593F8F1FA02299BA05DFDF55E1A2EA02ECD306C688AD224512EEAEE00E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91jbjgvz_1rzhak4_4co.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 10-57-39-502.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	316E4086884BB0B451A35E24AB7F50A6	6312E806C417F7885DF6F9A1B9473CCBCC641D42	7EE92B6018521B562BBE02B87F43E4984D5734518642A57E8ED5579BC2CABE95
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	F9F5795DE107536054CE1B3FCD9BC0E6	6B39719ADD6CF6942CE7925B205554B8565F4BEC	2A4EB084B9D3BAACED1AB41FE72362834104375703E30172353F2BFDBDCFD887
C:\Users\user\AppData\Local\Temp\acrocef_low\2f706d81-aff0-4bc8-9bb2-b40a600ba1a9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\3f6a4b65-4ef2-4f09-85d4-4a07a0baa332.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\51797a72-bb05-481b-b0fa-d80ad9b27b93.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	95F182500FC92778102336D2D5AADCC8	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
C:\Users\user\AppData\Local\Temp\acrocef_low\9044a862-97be-4767-a5f4-f121832d69c4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360	6F807A51DB70F4B3BC1728FD8116B3C0	79C153EEB44A5E54BED5F6136FD30249A8B5C2B8	B037F6B153C7D0DD32DF947EF56A6E9AC280EE99DC816A056BA443FAC0C8CE0A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators	32FCA302C8B872738373D7CCB1E75FD4	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6

Windows Analysis Report
eicarINFECTED.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report eicarINFECTED.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
eicarINFECTED.pdf