Windows Analysis Report
2103.03530.pdf

Overview

General Information

Sample name: 2103.03530.pdf
Analysis ID: 1532105
MD5: 3da6fc38f72ce9f6596fce1c967d0460
SHA1: 7a4ef43e8deb10b958b922c403cf7bd4d73ddaba
SHA256: c47a2e761bd82ed897165081ba24b752d87ca640c51a133cbb27981d0ee63902
Tags: pdfuser-xayeshasulx
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

IP address seen in connection with other malware
PDF has an OpenAction (likely to launch a dropper script)

Classification

IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.46.224.162 23.46.224.162
Source: 2103.03530.pdf String found in binary or memory: http://www.openioc.org/resources/An_Introduction_to_OpenIOC.pdf)
Source: 2D85F72862B55C4EADD9E66E06947F3D0.3.dr String found in binary or memory: http://x1.i.lencr.org/
Source: 2103.03530.pdf String found in binary or memory: https://attack.mitre.org/)
Source: 2103.03530.pdf String found in binary or memory: https://capec.mitre.org/)
Source: 2103.03530.pdf String found in binary or memory: https://cpe.mitre.org/specification/)
Source: 2103.03530.pdf String found in binary or memory: https://cve.mitre.org)
Source: 2103.03530.pdf String found in binary or memory: https://cwe.mitre.org)
Source: 2103.03530.pdf String found in binary or memory: https://cwe.mitre.org/cwss/cwss_v1.0.1.html)
Source: 2103.03530.pdf String found in binary or memory: https://github.com/ucoProject/uco)
Source: 2103.03530.pdf String found in binary or memory: https://maec.mitre.org)
Source: 2103.03530.pdf String found in binary or memory: https://nvd.nist.gov/)
Source: 2103.03530.pdf String found in binary or memory: https://nvd.nist.gov/vuln-metrics/cvss)
Source: 2103.03530.pdf String found in binary or memory: https://oasis-open.github.io/cti-documentation/)
Source: 2103.03530.pdf String found in binary or memory: https://www.juniperresearch.com/press/press-releases/cybercrime-cost-businesses-over-2trillion)
Source: 2103.03530.pdf String found in binary or memory: https://www.pwc.com/gx/en/services/advisory/forensics/economic-crime-survey/cybercrime.html)
Source: classification engine Classification label: clean1.winPDF@14/53@0/1
Source: 2103.03530.pdf Initial sample: https://cve.mitre.org
Source: 2103.03530.pdf Initial sample: https://oasis-open.github.io/cti-documentation/
Source: 2103.03530.pdf Initial sample: https://github.com/ucoproject/uco
Source: 2103.03530.pdf Initial sample: https://www.juniperresearch.com/press/press-releases/cybercrime-cost-businesses-over-2trillion
Source: 2103.03530.pdf Initial sample: https://cpe.mitre.org/specification/
Source: 2103.03530.pdf Initial sample: https://nvd.nist.gov/vuln-metrics/cvss
Source: 2103.03530.pdf Initial sample: https://capec.mitre.org/
Source: 2103.03530.pdf Initial sample: http://www.openioc.org/resources/an_introduction_to_openioc.pdf
Source: 2103.03530.pdf Initial sample: https://attack.mitre.org/
Source: 2103.03530.pdf Initial sample: https://maec.mitre.org
Source: 2103.03530.pdf Initial sample: https://cwe.mitre.org
Source: 2103.03530.pdf Initial sample: https://www.pwc.com/gx/en/services/advisory/forensics/economic-crime-survey/cybercrime.html
Source: 2103.03530.pdf Initial sample: https://cwe.mitre.org/cwss/cwss_v1.0.1.html
Source: 2103.03530.pdf Initial sample: https://github.com/ucoProject/uco
Source: 2103.03530.pdf Initial sample: http://www.openioc.org/resources/An_Introduction_to_OpenIOC.pdf
Source: 2103.03530.pdf Initial sample: https://nvd.nist.gov/
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4544 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-12 05-17-25-863.log Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\2103.03530.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1736,i,11847260277344383352,9453903226599460595,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1736,i,11847260277344383352,9453903226599460595,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: 2103.03530.pdf Initial sample: PDF keyword /JS count = 0
Source: 2103.03530.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: A916wfshm_zp8a5f_3i8.tmp.0.dr Initial sample: PDF keyword /JS count = 0
Source: A916wfshm_zp8a5f_3i8.tmp.0.dr Initial sample: PDF keyword /JavaScript count = 0
Source: 2103.03530.pdf Initial sample: PDF keyword stream count = 23
Source: 2103.03530.pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: 2103.03530.pdf Initial sample: PDF keyword endobj count = 298
Source: 2103.03530.pdf Initial sample: PDF keyword obj count = 298
PDF has an OpenAction (likely to launch a dropper script)
Source: 2103.03530.pdf Initial sample: PDF keyword /OpenAction
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1532105 Sample: 2103.03530.pdf Startdate: 12/10/2024 Architecture: WINDOWS Score: 1 6 Acrobat.exe 18 76 2->6         started        process3 8 AcroCEF.exe 107 6->8         started        process4 10 AcroCEF.exe 4 8->10         started        dnsIp5 13 23.46.224.162 AKAMAI-ASUS United States 10->13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.46.224.162
 unknown United States
16625 AKAMAI-ASUS false