Windows Analysis Report
w-9 -Ethics advisory inc .pdf

Overview

General Information

Sample name: w-9 -Ethics advisory inc .pdf
Analysis ID: 1528526
MD5: 3d132b55a4a3c656b94590577df13040
SHA1: f9f8c74da30040ac6526b510c8fa5e5d3560e62f
SHA256: 207e104694eb76445b445005ed069ff7b378391ca5a3c7a5e2206e2d7a5a099b
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: x1.i.lencr.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 192.168.2.6:49810 -> 23.56.162.185:443
Source: global traffic TCP traffic: 23.56.162.185:443 -> 192.168.2.6:49810
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.56.162.185 23.56.162.185
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic DNS traffic detected: DNS query: x1.i.lencr.org
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr String found in binary or memory: http://x1.i.lencr.org/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: classification engine Classification label: clean2.winPDF@14/45@1/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6112 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 18-27-51-358.log Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\w-9 -Ethics advisory inc .pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1624,i,13021702806693179787,17668582507284460898,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1624,i,13021702806693179787,17668582507284460898,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF keyword /JS count = 0
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF keyword /JavaScript count = 0
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF keyword startxref count = 7
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF keyword stream count = 161
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF keyword /ObjStm count = 17
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF keyword endobj count = 413
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF keyword endstream count = 161
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF eof value = 7
Source: w-9 -Ethics advisory inc .pdf Initial sample: PDF keyword obj count = 413
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528526 Sample: w-9 -Ethics advisory inc .pdf Startdate: 08/10/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 7 Acrobat.exe 18 70 2->7         started        process3 process4 9 AcroCEF.exe 107 7->9         started        process5 11 AcroCEF.exe 2 9->11         started        dnsIp6 16 23.56.162.185, 443, 49810 AKAMAI-ASUS United States 11->16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.56.162.185
 unknown United States
16625 AKAMAI-ASUS false

Contacted Domains

Name IP Active
x1.i.lencr.org unknown unknown