Windows Analysis Report
2014-10-14 Title Abstract-Jamestown Plat 11 Lots 10-12.pdf

Overview

General Information

Sample name:	2014-10-14 Title Abstract-Jamestown Plat 11 Lots 10-12.pdf
Analysis ID:	1544733
MD5:	57d994cfccf66e4059dc1317cbd894f3
SHA1:	748572f9674629d6079cb3ccf928a497e525111c
SHA256:	a4c35d272391d639e83aa6cbe6fa34993c7262d0c4bf2ef6b244742af0827d99
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/29@3/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6660

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 12-02-27-615.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\2014-10-14 Title Abstract-Jamestown Plat 11 Lots 10-12.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1520,i,360025319057947509,15248815432717213400,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1520,i,360025319057947509,15248815432717213400,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 2014-10-14 Title Abstract-Jamestown Plat 11 Lots 10-12.pdf

Static file information: File size 14483399 > 6291456

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1544733
Product:	CloudBasic
Start time:	17:01:16
Start date:	29.10.2024
Sample:	2014-10-14 Title Abstract-Jamestown Plat 11 Lots 10-12.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	57d994cfccf66e4059dc1317cbd894f3
SHA1:	748572f9674629d6079cb3ccf928a497e525111c
SHA256:	a4c35d272391d639e83aa6cbe6fa34993c7262d0c4bf2ef6b244742af0827d99
Filetype:	Adobe Portable Document Format (5005/1) 62.52%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	BA8951A14E26AD8B0E5C02DE2F005E58	5BAEB7D95BE5EA48E9DA4A016F1D2E55B025F094	7929A5234BF79A48B836705BC7B459BFFC67554B0EDFAA2CD40041EB0D8A9931
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	BA8951A14E26AD8B0E5C02DE2F005E58	5BAEB7D95BE5EA48E9DA4A016F1D2E55B025F094	7929A5234BF79A48B836705BC7B459BFFC67554B0EDFAA2CD40041EB0D8A9931
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	C06CE7CFFE2BBFE08F7C8DDC2A413A40	556059E705FAC5F3B93E7DC4879ED0FACD8B1839	600C8F80E8D47A405357EC97BE3F618EF16406E3EE04661F1836C7FA9EB85E7A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	C06CE7CFFE2BBFE08F7C8DDC2A413A40	556059E705FAC5F3B93E7DC4879ED0FACD8B1839	600C8F80E8D47A405357EC97BE3F618EF16406E3EE04661F1836C7FA9EB85E7A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\092a9bdc-2265-4873-872b-907c3496e9a7.tmp	JSON data	C5B9150FDAB5DEAD5546668B14C0F926	907226674366E212FF39E909ABFB247B90816E0F	B4FF6A074729A4F8FB5064AF2BDAE2F6223A12556DA4DC3EEA774C4FAA8D1E0E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	C5B9150FDAB5DEAD5546668B14C0F926	907226674366E212FF39E909ABFB247B90816E0F	B4FF6A074729A4F8FB5064AF2BDAE2F6223A12556DA4DC3EEA774C4FAA8D1E0E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	F1EDF39DE530FEAF96630AF7CDFBA189	377CF67406CB5993576199528AADF130B1180251	4D8BB70D9B28089A239BFF452307A74EFDADE9B828A52632EC57D967271F6B42
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	930AC3AB9DA4DA8F95D677E32A2BA9EB	F6AE5CC45432FA4DA82EC8700DFB956420DE0277	8EFA60F07606132962ED94CF4147B13CE42FDE71B8A7E018C5DE664EED388334
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	930AC3AB9DA4DA8F95D677E32A2BA9EB	F6AE5CC45432FA4DA82EC8700DFB956420DE0277	8EFA60F07606132962ED94CF4147B13CE42FDE71B8A7E018C5DE664EED388334
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241029160230Z-182.bmp	PC bitmap, Windows 3.x format, 116 x -152 x 32, cbSize 70582, bits offset 54	6F7F9085C6D611A1A38FAEF58A5810D5	314D61722FF60DD38AB181B3DDD16A775B72F635	BA57CDC161CCD9A110FA819C021FDCBDEA42F913A0A1FD259C3D67FBB28374BA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	7228ACF67E68DBC367AB9DE2577F8071	82AD648DB79FBDF77B599D9E41C1AD4F7C703EF7	B8C9E8B3EFCF78BE583C3299474AB5E4A9F75CDFF791C16466D2CC87612440CA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	C04A70CD0C84791D24D4325FA0C78D33	3E7AACB944C796E1F9B324481EE6011424FC0A7A	E19B5F50D32FD546756EB607B375CA44DBB204E22F11EAEA5DD052FCE5602E1B
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	66B094F0BAD09CCEE29B98818C9B2113	49989387A355278087E0009184F99674F9FBE7D4	53DFC321BD9444359538217D891651402651412D8386FAB345884C20F02D06CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6660	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	8CC239E3BD1C4867028CBF5FC1212949	5056B080777B149F760B2CBA35781022DF06F07F	ED2F0D7989C9743B41C69298366DA4824E88D741C3D3D07EA71A85C7EB902227
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	2B13071D89853259FF22F34FF83E79EE	DB500D32EB69651D64BF3C25865E6A8476CD4C00	0776C5BF7B7890CDA510DA31D91CBB2FE89B63392702D20DCD09CD646D0D6E65
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	96296A7D36495DB84779BAEFD1441C0D	9699531EA679C37E04D13B47454DA62B074D66C7	C43411D2B0D437D05BAAF0942B4B847DD46501F1223AD1D6275A9E8DF930BBA1
C:\Users\user\AppData\Local\Temp\MSI793a0.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	3CCD94ACFFC7C738A9AB57DDB049297A	9D6D1FC316D86D0DAFD489E7A8B218CDFA16F2E6	1FE0733A79DD67EF65BD4CD741DC4CCE71AB91B36A8CF68006788DC44E6504FB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 12-02-27-615.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	3707E00589EEBABB3A04811DD8137391	28999EBB2BFC63306717CC7D7E60ADE6EE269FF9	E8453B26A1C6698E26951BC4361C22CCB3317366129916CB4E0FE463D1E9CF65
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	AAC5EEBFD493EE098EC4F52EE10DF9A5	A8F149D1F41ADFE911A9C66D0BA761E5EE977976	4F509C5B1035A3E054A9C08AF23D9D1FB35AC5D9DF983BBDD64A1704FC06FB68
C:\Users\user\AppData\Local\Temp\acrocef_low\1e5a2689-ac70-4ce4-ae71-9520e347366b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\3edb0984-d0e6-423a-8522-46cfb46f544d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\879412ba-faf9-4d29-a729-716f9ad31f1b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\e571147f-b8f5-4ec5-a4ec-ae5a0c62c549.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
2014-10-14 Title Abstract-Jamestown Plat 11 Lots 10-12.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report 2014-10-14 Title Abstract-Jamestown Plat 11 Lots 10-12.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
2014-10-14 Title Abstract-Jamestown Plat 11 Lots 10-12.pdf