Windows Analysis Report
Paychex Direct Deposit Form (02 2024)..pdf

Overview

General Information

Sample name: Paychex Direct Deposit Form (02 2024)..pdf
Analysis ID: 1523645
MD5: 08eadc77f3722a16ef5fd1b74f1836ba
SHA1: aa5b360b614821872f0aecc3dda6d3f40ccf1ffb
SHA256: 3e8b33ffbd977c14bca8e21f80cc46ab0820da8209a529fd95ab7eeaf2d5235e
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: x1.i.lencr.org
Source: global traffic DNS query: name: x1.i.lencr.org
Source: global traffic DNS query: name: x1.i.lencr.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 192.168.2.16:49712 -> 23.195.76.153:443
Source: global traffic TCP traffic: 23.195.76.153:443 -> 192.168.2.16:49712
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.195.76.153 23.195.76.153
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic DNS traffic detected: DNS query: x1.i.lencr.org
Source: 77EC63BDA74BD0D0E0426DC8F80085060.3.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.3.dr String found in binary or memory: http://x1.i.lencr.org/
Source: a94c4a4e-cc78-4f50-a0fa-53ed2510b9b5.tmp.4.dr, 103f993c-462e-4330-9d03-98934c66b985.tmp.4.dr String found in binary or memory: https://chrome.cloudflare-dns.com
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: classification engine Classification label: clean2.winPDF@15/48@3/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6744 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 15-54-07-077.log Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Paychex Direct Deposit Form (02 2024)..pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1548,i,771568016486475644,2400619360177338759,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1548,i,771568016486475644,2400619360177338759,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Paychex Direct Deposit Form (02 2024)..pdf Initial sample: PDF keyword /JS count = 0
Source: Paychex Direct Deposit Form (02 2024)..pdf Initial sample: PDF keyword /JavaScript count = 0
Source: Paychex Direct Deposit Form (02 2024)..pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information queried: ProcessInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523645 Sample: Paychex Direct Deposit Form... Startdate: 01/10/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 7 Acrobat.exe 20 66 2->7         started        process3 process4 9 AcroCEF.exe 108 7->9         started        process5 11 AcroCEF.exe 6 9->11         started        dnsIp6 16 23.195.76.153, 443, 49712 NTT-COMMUNICATIONS-2914US United States 11->16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.195.76.153
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true
x1.i.lencr.org unknown unknown