Windows Analysis Report
14 PISCINA.PDF

Overview

General Information

Sample name:	14 PISCINA.PDF
Analysis ID:	1541116
MD5:	e41f391ea667ad49e742295b5202008d
SHA1:	2c38e71d25c0913093cb1b8ef88fe3357d6071e3
SHA256:	d6b5ac538bed9d2385f18d6ff62696692e783915d77504012c8f6d49834a9348
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/26@2/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 06-58-24-369.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\14 PISCINA.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1728,i,17153010932264468926,8010953835632044136,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1728,i,17153010932264468926,8010953835632044136,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 14 PISCINA.PDF	Initial sample: PDF keyword /JS count = 0
Source: 14 PISCINA.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: 14 PISCINA.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true
x1.i.lencr.org	unknown	unknown

ID:	1541116
Product:	CloudBasic
Start time:	12:57:22
Start date:	24.10.2024
Sample:	14 PISCINA.PDF
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	e41f391ea667ad49e742295b5202008d
SHA1:	2c38e71d25c0913093cb1b8ef88fe3357d6071e3
SHA256:	d6b5ac538bed9d2385f18d6ff62696692e783915d77504012c8f6d49834a9348
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	B8C7A86D0FE7B303412E72E9ECCB6344	02F7A01741A50801C41DFC8EE4F1A6DA4C5CF3E2	0F687D4071B680E9D9DF7A8F327BB39CDF4A075BEA0031F6B17ABD35B4E45311
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	B8C7A86D0FE7B303412E72E9ECCB6344	02F7A01741A50801C41DFC8EE4F1A6DA4C5CF3E2	0F687D4071B680E9D9DF7A8F327BB39CDF4A075BEA0031F6B17ABD35B4E45311
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	48B0EF6B63D038EBC643F36093DD9DBC	4B1FD2641780F4836ED58F3CD994F2B5A6585028	9B9A24F3E9A98E3487E945A5449A325486295CD37422D086EBF20FFFD6470334
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	48B0EF6B63D038EBC643F36093DD9DBC	4B1FD2641780F4836ED58F3CD994F2B5A6585028	9B9A24F3E9A98E3487E945A5449A325486295CD37422D086EBF20FFFD6470334
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\16f4845f-d67d-44c4-b5dd-b1a1052320f8.tmp	JSON data	FE5FF47976ACD94CF026962C1E9A23F4	939EEEBBCF95B71AB344F0060E921FE86997F5A8	7C1D331D2DB05A1B5AFEF459999609F38E7F595F3E417F589973F6E2687DFAF8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	FE5FF47976ACD94CF026962C1E9A23F4	939EEEBBCF95B71AB344F0060E921FE86997F5A8	7C1D331D2DB05A1B5AFEF459999609F38E7F595F3E417F589973F6E2687DFAF8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	C1905CCE726ED5970521AFA798A01761	713E2E33041B3D911E0380F1DC5035CE87FD08F9	7E53EFDFA1810389851DE6DC0C845F54BEA243FCCA2C61096AD30974DE5FF798
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	076BEE367FC5A4C18DC143EDE755D3AB	027FE144A5A0434E7ED1A853D9ABC41B69B3F334	B4140FAB9BFAD7EED287C429CA3E5F345C36625E0C9B5A5426407D8910303924
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	076BEE367FC5A4C18DC143EDE755D3AB	027FE144A5A0434E7ED1A853D9ABC41B69B3F334	B4140FAB9BFAD7EED287C429CA3E5F345C36625E0C9B5A5426407D8910303924
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024105826Z-177.bmp	PC bitmap, Windows 3.x format, 164 x -115 x 32, cbSize 75494, bits offset 54	942F418EC48AA3B4CCED0F23D8408CAF	7A76C971B93C8CD02EE97B2B7B34EAB9C8ADD8D8	91626F3EA3440237035C4ED09F25238949C992364B8B96193B371CBF2B7CCD4D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	3F3F314A49DE147F289A7BA4296842FA	0C4E4F1A070F5205C6D6AD52C450C2119EF54D69	F33A8A306F46338707B4FB9034659113510BDDA817DB917A1AECE95661800B0B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	CB2164CD4DEF4B437AE22C4F0A2CB0F1	4DC817ED6352B13E5C9E4007D919281721F8A620	2D7E4F402350B51A69EF62D56ADBD3EB70DDEE65D7A1D9A66440E00B592830F5
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	D176500D99E40F80A0686D5063BE661D	BB1AAEBE01BA4305F1CCFF377A0E9509DE116513	69DDD4DA0FD3A7C6AA260C4558D3B58F1DE6A3F3D01755DF5E95B7BE3AD83F39
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	CC73BFAF945D3F53FE662D02236F7D5E	6220727D9BE05A22FA7E80441363E2FBB7C5C396	E6EBFABA7C48D1A316D7986F729A4B6EC44D0CC4A899C5449A1B1AC721E545A5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	68F36D37BC27186A7C125F13DBA43BFC	92F97832E8BF4FACB2EC01EB6DD5574B156458A0	31B18B3C099208F63B56E8ED9EA2080913E99C1CE434C762FA35354E5EA6C82A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	FE4071EC9FB00E74B7133AFCE29D7C21	77B57CA1BE1A7C4675FF8D7F8636F850013F196F	318E13608954A16F9C551AE63D33CDBE46359A3742C6766047300E2DBC6EA060
C:\Users\user\AppData\Local\Temp\MSI61d49.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	397C5790C47AC8F3D18E0773CDC30904	DE1FDA50894E117CA91ADFAF991ED99D7BEFE8C8	400DD9877769C05CDA8FEC482BD618128D68CFAAE9FA97B19D084B0AA5C3FEED
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 06-58-24-369.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	3F83D5CD0ECFF634E2345756C34B03B3	4234452CAA6268ABEB1BFE5F02532F5E650EB6A0	CF484FB079E45EE522DBC3966C82EF1732593B93101705574C2C3977DEE0CB1E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	DCA1B18B5DB10365E4F5F17573D3C991	0171756513D2DD0A4392C40B062D120B37A9CB3E	1A4CB0FB2D750FBC7B41979BD78626F639088074251D2BE0D84AFA2C3C5E8A70
C:\Users\user\AppData\Local\Temp\acrocef_low\8e8c006f-22ea-4b9b-a450-beef77cc2c1a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CA6B0D9F8DDC295DACE8157B69CA7CF6	6299B4A49AB28786E7BF75E1481D8011E6022AF4	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
C:\Users\user\AppData\Local\Temp\acrocef_low\b8feadb5-d2e9-412b-a7aa-3865b0fa8cd9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\c5b5009c-14fd-4256-b286-58d32e8675cc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\ce6382d2-051b-4a69-86c0-9a2946f9264e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
14 PISCINA.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report 14 PISCINA.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
14 PISCINA.PDF