Windows Analysis Report
INV_52974613.pdf

Overview

General Information

Sample name:	INV_52974613.pdf
Analysis ID:	1540338
MD5:	bff7c19ba5e43f90784799397914dda6
SHA1:	9dfbda38773ad5d9198798dba03d405e8151c9ac
SHA256:	60d722bdd0b4adc1d475def33c5656f619523091887ef7e687f9780e4c1e7446
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/27@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-23 10-59-28-259.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\INV_52974613.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1500,i,9647658906102425964,9160439233810104032,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1500,i,9647658906102425964,9160439233810104032,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: INV_52974613.pdf	Initial sample: PDF keyword /JS count = 0
Source: INV_52974613.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9lypsi_zevyj4_1xs.tmp.1.dr	Initial sample: PDF keyword /JS count = 0
Source: A9lypsi_zevyj4_1xs.tmp.1.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: INV_52974613.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1540338
Product:	CloudBasic
Start time:	16:58:26
Start date:	23.10.2024
Sample:	INV_52974613.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	bff7c19ba5e43f90784799397914dda6
SHA1:	9dfbda38773ad5d9198798dba03d405e8151c9ac
SHA256:	60d722bdd0b4adc1d475def33c5656f619523091887ef7e687f9780e4c1e7446
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	38CBDB2330B3599C190C12288932AECE	39EF9C913A272183F5CA6AEE426A2C8A3F930E0A	755B9CAA82A571FAA274B18CA032864B6E99004CF670D7908335C384CF40B9B0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	38CBDB2330B3599C190C12288932AECE	39EF9C913A272183F5CA6AEE426A2C8A3F930E0A	755B9CAA82A571FAA274B18CA032864B6E99004CF670D7908335C384CF40B9B0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	405FCD3B06D1BF8201C562E818813140	36E1D82F642E816A94C3AAC2EE415B8645425D3B	E265C149081C95B7192B892FAC206E075E2B58F43B0BE5B379ECB53DEE10B4BF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	405FCD3B06D1BF8201C562E818813140	36E1D82F642E816A94C3AAC2EE415B8645425D3B	E265C149081C95B7192B892FAC206E075E2B58F43B0BE5B379ECB53DEE10B4BF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\55c36882-304b-493a-b02d-65ea146f4cfd.tmp	JSON data	3611187F2FEE61373130B271E4438C34	58BE918E03126BA434F7D1A8906D15C33786BAD3	EDA21F4544FABDC47A907E8D9E681F0D9189EE6F4924C62C49079352B49A6587
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	3611187F2FEE61373130B271E4438C34	58BE918E03126BA434F7D1A8906D15C33786BAD3	EDA21F4544FABDC47A907E8D9E681F0D9189EE6F4924C62C49079352B49A6587
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	7CB4284703C620C8CF9100A6CB9DFF79	8B5EB1A343A09E4305EBA7D6EE620CFFD0A24DBF	26554E29EF4F9FDFCC22E75DE66F4E4DA64D9E017FF3A65310101BC120A5FE35
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	733ED71EEAE468D8BBEA82157E20C9E6	63BC57C8F173258F1B8926BBB21CA8D9FCE02552	455CEE1197EAF6DE358EECEF055279690956588B99A1BA85D8A93AA33E1EA352
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	733ED71EEAE468D8BBEA82157E20C9E6	63BC57C8F173258F1B8926BBB21CA8D9FCE02552	455CEE1197EAF6DE358EECEF055279690956588B99A1BA85D8A93AA33E1EA352
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241023145929Z-179.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	6830DA816ADBCDDA72A1704E74577E22	D247C7780725B054D4E548D8FF8237F81048F236	DC2C0543F37EAAEE07345608D17CF359F7660A7E2BEFD40E1D5B1ABAEE1744CF
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	14F31DD822FFE02438E06767E1E37E70	AA148E33A34D8FDFA8FCC56E3D71B504E1C0E637	355708E83CA92B3B1231735B7AC7850D43164C7B35ABD55DF843F11D185380E9
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	B0252E6376EFFDB5DF9FFD47B3A94026	D028C6396EFE52DBCC9A5E11C8121ADB93A1A07E	73B32CC8741F5D567E1865610F8B8303B8E70EE44261F426C60812F1CED7375F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	C82160A988F9866A36977AF9EF537118	A3DA50F286C692C7BDAFA99832634662E9ABB0C7	7061AB003CAC4FB977648AA2D5BB5D465596946753D20B9755A165E7657F7E5C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	3E83A26DBE335AB4748BC392BF10E548	1FE4257A55AE5991937A28558C6AC92C2958DD40	B349153A7FCC7E469785DFDDF8CB9F9EBF5811DBFA58C9BCEC9F62C9688003CC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	97160677ABA6F7BAE036FA918208AEE8	0D31E32253DE34EB811344A908EBC971836F1D07	A2AB1B9139889251C98E03BD22DB5A658078270B72D62C506E4BAE9C133859EA
C:\Users\user\AppData\Local\Temp\MSI121e3.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	AFBE13FAAA72D4C3EB18B1DC4A2BDE3A	6E6D84305EAE199B999222E8E82DEE0F202155CD	A3CCBCCB6280F0CB95257A2B33F6ABE80274F4010F7DE4D4366462B884B17A08
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9lypsi_zevyj4_1xs.tmp	PDF document, version 1.6, 0 pages	CB5E385A02659521B99B903CAC97758C	1E27D5562FAD16974F93D72B5866E17870EC6014	11B146C855E4A27A7B8A55881E0B9BA22A98515758C88512BF39B2F117138073
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-23 10-59-28-259.log	ASCII text, with very long lines (393)	C3FEDB046D1699616E22C50131AAF109	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	695A2DAB1474D321C7D9843C4B6AC1CF	6E626E1571BBE00BCFA7AA71CD5153D100F06C43	61F0004362AB380C2F1B6C65E31D4450D668AB191C9F5DDED22E6A394D11AA45
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	248D2C9ACE71120C029BC60A0299F04D	C72D87787B273E0781A503D4181699319305BDCD	107B81C6B939AB5D21B5F5D874D1700902DFC33F67359986219C867E07DCE94A
C:\Users\user\AppData\Local\Temp\acrocef_low\641217f4-929f-492f-9f4f-03eec5df5f82.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\744f9a8d-4321-44e1-bfb2-df5f65247b3b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\9117183d-80d4-4415-b581-6373edae10bc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\de64f24e-de8d-42e5-94fb-9cec7859084a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	95F182500FC92778102336D2D5AADCC8	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9

Windows Analysis Report
INV_52974613.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report INV_52974613.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
INV_52974613.pdf