Windows Analysis Report
2025 Ecommerce Supply Chain 2025 - Concept note.pdf

Overview

General Information

Sample name: 2025 Ecommerce Supply Chain 2025 - Concept note.pdf
Analysis ID: 1571428
MD5: a0e9481f276979baf75614a5787e6851
SHA1: 7e49efc87e86d97f90388e5ee19902c756951028
SHA256: 396fae2c1ac09ab0be0a297b7a91ca5ab26da37d794d6162bbfbd9fb2776b2d8
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

IP address seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: x1.i.lencr.org
Source: global traffic DNS query: name: x1.i.lencr.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.47.168.24 23.47.168.24
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic DNS traffic detected: DNS query: x1.i.lencr.org
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr String found in binary or memory: http://x1.i.lencr.org/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: classification engine Classification label: clean2.winPDF@14/46@2/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-09 05-12-00-185.log Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\2025 Ecommerce Supply Chain 2025 - Concept note.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,17689240199072959443,17993278990504629327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,17689240199072959443,17993278990504629327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: 2025 Ecommerce Supply Chain 2025 - Concept note.pdf Initial sample: PDF keyword /JS count = 0
Source: 2025 Ecommerce Supply Chain 2025 - Concept note.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: 2025 Ecommerce Supply Chain 2025 - Concept note.pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: 2025 Ecommerce Supply Chain 2025 - Concept note.pdf Initial sample: PDF keyword obj count = 51
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1571428 Sample: 2025 Ecommerce Supply Chain... Startdate: 09/12/2024 Architecture: WINDOWS Score: 2 14 x1.i.lencr.org 2->14 7 Acrobat.exe 17 60 2->7         started        process3 process4 9 AcroCEF.exe 106 7->9         started        process5 11 AcroCEF.exe 4 9->11         started        dnsIp6 16 23.47.168.24, 443, 49721 AKAMAI-ASUS United States 11->16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.47.168.24
 unknown United States
16625 AKAMAI-ASUS false

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
x1.i.lencr.org unknown unknown