Windows Analysis Report
Candace McCalmant . lnv#00148765.pdf

Overview

General Information

Sample name:	Candace McCalmant . lnv#00148765.pdf
Analysis ID:	1544772
MD5:	1d6b7716f501c0ee9a431bdb06ede968
SHA1:	9799dc619eaffc466cce69cba432ee675ac40f79
SHA256:	3c41c8207368411283050b0667c4c2f728f30b554b9a21fefa058031cb13b040
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected landing page (webpage, office document or email)

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: sus20.winPDF@14/26@3/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 13-21-46-181.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Candace McCalmant . lnv#00148765.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1652,i,2167151873984966525,17673108332368890896,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1652,i,2167151873984966525,17673108332368890896,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Candace McCalmant . lnv#00148765.pdf	Initial sample: PDF keyword /JS count = 0
Source: Candace McCalmant . lnv#00148765.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Candace McCalmant . lnv#00148765.pdf

Initial sample: PDF keyword stream count = 154

Source: Candace McCalmant . lnv#00148765.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Candace McCalmant . lnv#00148765.pdf

Initial sample: PDF keyword endstream count = 154

Source: Candace McCalmant . lnv#00148765.pdf

Initial sample: PDF keyword obj count = 157

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: PDF document

LLM: PDF document contains prominent button: 'click here to view document'

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1544772
Product:	CloudBasic
Start time:	18:20:46
Start date:	29.10.2024
Sample:	Candace McCalmant . lnv#00148765.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	1d6b7716f501c0ee9a431bdb06ede968
SHA1:	9799dc619eaffc466cce69cba432ee675ac40f79
SHA256:	3c41c8207368411283050b0667c4c2f728f30b554b9a21fefa058031cb13b040
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	84BA012A7EEA53B44F90404AAECDB9E0	8C4F76DC722FED8D2A5AE45D53CFCC344DED7F6B	9115158ABDB81C386011F90629FBF88557B18A85A80F5D91883DFF4E0DE023AD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	84BA012A7EEA53B44F90404AAECDB9E0	8C4F76DC722FED8D2A5AE45D53CFCC344DED7F6B	9115158ABDB81C386011F90629FBF88557B18A85A80F5D91883DFF4E0DE023AD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	D395C3E93843AC310A46C029C5988E8E	193E5509574ACB288D7EBB74404477AEA8C03F3D	B1290A61F37A6653E9137CDB58D7CD5C7AB7B96AEA600913512D317502B5478F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	D395C3E93843AC310A46C029C5988E8E	193E5509574ACB288D7EBB74404477AEA8C03F3D	B1290A61F37A6653E9137CDB58D7CD5C7AB7B96AEA600913512D317502B5478F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\02d53571-baac-439b-a0be-fd24487fd436.tmp	JSON data	D99A5AE63139AB490FEFFC74B27D8855	3CC0BF084F22BB8BB1FF209DCC34F1922E8C2274	CD7BA9975A862B0F0525805C155D35AB333894F0A03875CBC27E216EF02E725F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	D99A5AE63139AB490FEFFC74B27D8855	3CC0BF084F22BB8BB1FF209DCC34F1922E8C2274	CD7BA9975A862B0F0525805C155D35AB333894F0A03875CBC27E216EF02E725F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	73EF7E4101CE48B035E8958B0F3F0758	09DB8F537A76314AC040E86F3DEF1D7947311F8F	CA72DC86E62EE1C393EE7872492D8BC3BE9ED6891DAAC561F6C53713D578F809
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	7BB8025EE3A2732F290A4BC0D58FDD3C	7338287071248878A50F85974792EE8E37F2AD98	01EDBF89B2E93E30992E8950EDDBA1D91467FE14B53DE2646D61D42179CED73D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	7BB8025EE3A2732F290A4BC0D58FDD3C	7338287071248878A50F85974792EE8E37F2AD98	01EDBF89B2E93E30992E8950EDDBA1D91467FE14B53DE2646D61D42179CED73D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241029172148Z-165.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	0E69F2C4A1778350E716635DCD8C8434	EAEFF1088F319321546F70B72C2248D48449A217	DE2758DF16550F8575A65A205B1E920856C55CA8B99C7734D71CB2F4A179C2AE
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	BFDAF9E445D8C48C8A3C890913781305	23BAF146A0A5E7CF6F560880B9E613618C73BC37	B481311BBB1E5E6C3EDECF61AA8EDCC10CD3CEC33B760F2B6E33C0EA4E41014F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F57F4B74CF6153E8953768C92037B27D	14DAE180638BF6B2EE4363C18B9DC40B96A24AC6	A12D92E3C2E8CE78400E7346A44F8811AF51B5CD48FC95CB76862E4C40E88A81
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 20, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 20	61A591FD4C904D0E0BAB567019A97687	E2493C16547953C820BFF8212813BA49B7AF887B	8EDB4B0A75F05EB998EB1C728A96476E70D3CB100F87EF1DDF141FB5824EB673
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	8DFFC283C20825759E6D7C7F1EF52845	12204F5C689A6927846D166349B7E745C0487545	93A96384028BFF204A864155B429D7ACAB8DD36883A73A78D2BF3FB15034349D
C:\Users\user\AppData\Local\Temp\MSI47efb.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	713B7C8033AE91482703C99B7A25523E	FE4F67D12793CA222E5257F0FCD9A374B1E5BD1C	0D26CFEEE4260698EB65357E3419B7FE83A6B9E771102EBA8B7B930578403385
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 13-21-46-181.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	BD9CDE741B1C7A600DAB2DDEF1F911A0	DE977502AEFBE1D01674ED854BE881370C181815	F1134E25D8395B7B6B5A05D9502E1516D2D491B528093BCAC8514B45270F28EB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	5AD0660D7796A890815B0077D695B26E	F29F2B7DED874F2783F195BD794F6E4BEAB763F7	7635108AB512311165B8DD9D159CE84D31CBE4261B766AA939910B9ED96A4BD0
C:\Users\user\AppData\Local\Temp\acrocef_low\62f12ec8-c1df-4f27-8fa7-e2a3b0fb82b5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	C3A57AA9E02183A6BC1FCB2B997DE0D9	58F66A73A3E47C5157157F4621112385943E85DC	21ADBA452494525090175E5424FDF2F19F5360B8281E05F2E316ACAF6FF0905C
C:\Users\user\AppData\Local\Temp\acrocef_low\859bc19c-b3a5-47a9-867c-21de7ed0f398.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	E787F9888A1628BE8234F19E8EE26D68	44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5	3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
C:\Users\user\AppData\Local\Temp\acrocef_low\c52bdf62-ff22-41b7-ad9d-76bc1d32d5a1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\fb9b1500-bc91-48a5-816e-2e9130beffb7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486

Windows Analysis Report
Candace McCalmant . lnv#00148765.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Candace McCalmant . lnv#00148765.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Candace McCalmant . lnv#00148765.pdf