Windows Analysis Report
Certificate of Insurance (5).pdf

Overview

General Information

Sample name:	Certificate of Insurance (5).pdf
Analysis ID:	1537106
MD5:	8c076b5bf5f8f6183ee7896e8dcf30db
SHA1:	8f9bdbebcb24637c6d88e69576f0f343859d593f
SHA256:	919a3f484ac525845930707a0c0595986e1e66bd632e8de46fa016e3f46844b4
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: classification engine

Classification label: clean0.winPDF@14/28@2/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-18 09-13-42-804.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Certificate of Insurance (5).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1244,i,8890678840112915992,8546427508451947814,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1244,i,8890678840112915992,8546427508451947814,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Certificate of Insurance (5).pdf	Initial sample: PDF keyword /JS count = 0
Source: Certificate of Insurance (5).pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Certificate of Insurance (5).pdf

Initial sample: PDF keyword stream count = 132

Source: Certificate of Insurance (5).pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Certificate of Insurance (5).pdf

Initial sample: PDF keyword endstream count = 132

Source: Certificate of Insurance (5).pdf

Initial sample: PDF keyword obj count = 143

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1537106
Product:	CloudBasic
Start time:	15:12:32
Start date:	18.10.2024
Sample:	Certificate of Insurance (5).pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	8c076b5bf5f8f6183ee7896e8dcf30db
SHA1:	8f9bdbebcb24637c6d88e69576f0f343859d593f
SHA256:	919a3f484ac525845930707a0c0595986e1e66bd632e8de46fa016e3f46844b4
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	B0B558D823536B233E03493E167D6A0D	E6B894D8ABB19FDF6AAD601979D8290702F69547	348CE0A4C422A7F287F9D228789FED856C016312A05670FE330195F76FE290D3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	B0B558D823536B233E03493E167D6A0D	E6B894D8ABB19FDF6AAD601979D8290702F69547	348CE0A4C422A7F287F9D228789FED856C016312A05670FE330195F76FE290D3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	F721E133CB92213BED8BC35B8E54F13B	A3F583E96B77248EE09303F47FF47572A3711FA2	46DF9F479A416FAEB05FC9D3F968859DFF8BBB468332367066CA5A7612AEA918
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	F721E133CB92213BED8BC35B8E54F13B	A3F583E96B77248EE09303F47FF47572A3711FA2	46DF9F479A416FAEB05FC9D3F968859DFF8BBB468332367066CA5A7612AEA918
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	7673374D3AFB990FDE42EA8B5723D6D6	0C08EC604846D4C1CD02FBE7114BF37C2A60101C	A043947CFC5FAC1A5052788176F37D835680AC53E7CDA0A7093FC5BC12242588
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bebefcf5-13dd-43f0-a3ce-19f66c2e1369.tmp	JSON data	7673374D3AFB990FDE42EA8B5723D6D6	0C08EC604846D4C1CD02FBE7114BF37C2A60101C	A043947CFC5FAC1A5052788176F37D835680AC53E7CDA0A7093FC5BC12242588
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	87DBA11A291304A66DE697F78E6889D0	39C24AC22CB55FC16035D7FFEDCD0C1CE63F7E7F	2C2EB010326A3D72705D51F64D994B542BA35FC8BD7386FFF25E45FE41CE6624
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	EBA4CE3DE4A46120205AE913A9E1A417	AAC924B934CAECA541C07AFA1461848ABEE71D01	1C8DC150FC19BD2B8280ED8457D6FBFB67D3C332F36F261DD708AC584D94984A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	EBA4CE3DE4A46120205AE913A9E1A417	AAC924B934CAECA541C07AFA1461848ABEE71D01	1C8DC150FC19BD2B8280ED8457D6FBFB67D3C332F36F261DD708AC584D94984A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241018131346Z-207.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	A8DD62860C383F6F48483C25D8633DB6	B0CBCBA8E4476F042F37A41967D71CA4E68A5AE3	FE993C514A9690036E25A44FE6BE927E69B3C9ECC66693D2F2CF746ACFECDB5B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	EF34FE299EF6B74145978698991CE769	1C5BC5342139A780B772EB9CF21BDF66328DD772	34937D560C2B7082DC0AEC85661F918E6FC4C8A268E76C901DBBA275ED0E3416
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	200640CCCA601D2DFAE56C2870E7F00C	1CBD10011EB3AC1A2B54B742C227EC5F7ABAD054	40E8D5B28AD32FA18D14600A42E110DBC137E9F6E6C576FD45C772098CFDDECF
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	8E12ACCB0F8028980007BC2018D6C30E	9023BBCAAFB91D8501D9A8E74DDFB84FC6B993B0	4A0BDD7EB9E606CBFCF243AE3577D6F4B50FD51342B9F45317AF60C01126459E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	37C31A91F36B38EBBA438C57B048E01C	517BC8D605B16BA585F3B2408AE2F05E8C3D3C9C	BA8C85D941B301083D119A29093AC1ABE4A26BF7BB496B0EA0AFCE5969CBCFDC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	B4FAAEB19BB4BCB4005023D4AF204474	C3EFF5B0F9B3D9CBEE46B0527DB1F68087BB1AF7	0FA835026CAE5D66321E0511EF37E5B33B9AE4EEA7C97E1110AF9BC12F8025CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26	5762D2976CF14E85DAD54C848D88E646	5DBF4C813ADBEC1AC34EACBBF68EAEEC0191EC5E	F6480A2E1C9812C9FEC7AB52C2B37EB3132C14EFFA1206B2B1788F9F5CF43050
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	52050F6C0363C414BAB840D25090FD4C	3CD106F32A1BAF9F84C5F36461D0F5A6152D599C	11D5CA602BD6AB2A21F99F5B2CAEE888457D07FF90A6DB47FCE06AC4C50A75A1
C:\Users\user\AppData\Local\Temp\MSI84627.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	43EFB73DE58414B1F217B09D1F71A11F	26B3F3D86E8D82BD834763C94B74E76BBE86A863	99DBF566FBC55614102D99736349664388FA959A2E8C75E705BDAACF415414E4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-18 09-13-42-804.log	ASCII text, with very long lines (393)	5BC0A308794F062FEC40F3016568DF9F	14149448191AB45E99011CBBEF39F2A9A03A0D15	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	9F8337DFD945E7CEBA135B815FC9032F	3940D63AB606792289C7957C02BE21D10394AC25	022F9CDA3053864483CED986A2F07DD694E73106B9224296FB13EFE06A9199C5
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	DE2C39CB8DE94C10239B68F0EBE38BD8	E3C491176656374F120A34B0ABB614DBF97B267E	29246C8F646FF4B88835C088E443A28E3FFD2F84AD0767607078E2812806EDC6
C:\Users\user\AppData\Local\Temp\acrocef_low\05d96309-2072-40db-85e4-6aae16b9744d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\1631d5a9-ac4b-4cbf-b0b7-08e51ad734cd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	1F3D69524A9D7E17BD2363C81D130F1A	C2A4A08839CBA47BEE2B601975F7C4F0CC191091	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
C:\Users\user\AppData\Local\Temp\acrocef_low\3ecbda71-d514-490d-b003-f98b5a143f7e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360	F5279DA3659F1FDF155BE793A409106A	B389FCDB8832ABD4BC4A06CB7E97107FC5E139EA	4926C6879266E3E2301A1823FE1FF8772B1FA7A33163224B1B5C2695A0E372CA
C:\Users\user\AppData\Local\Temp\acrocef_low\5b4f8375-124e-454f-9c88-180674b950a0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
Certificate of Insurance (5).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Certificate of Insurance (5).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Certificate of Insurance (5).pdf