Edit tour

Windows Analysis Report
2025 Ecommerce Supply Chain 2025 - Concept note.pdf

Overview

General Information

Sample name:	2025 Ecommerce Supply Chain 2025 - Concept note.pdf
Analysis ID:	1571428
MD5:	a0e9481f276979baf75614a5787e6851
SHA1:	7e49efc87e86d97f90388e5ee19902c756951028
SHA256:	396fae2c1ac09ab0be0a297b7a91ca5ab26da37d794d6162bbfbd9fb2776b2d8
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 2804 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\2025 Ecommerce Supply Chain 2025 - Concept note.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2876 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,17689240199072959443,17993278990504629327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443

Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49721

Source: Joe Sandbox View

IP Address: 23.47.168.24 23.47.168.24

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\2025 Ecommerce Supply Chain 2025 - Concept note.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,17689240199072959443,17993278990504629327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,17689240199072959443,17993278990504629327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: 2025 Ecommerce Supply Chain 2025 - Concept note.pdf	Initial sample: PDF keyword /JS count = 0
Source: 2025 Ecommerce Supply Chain 2025 - Concept note.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Exploitation for Client Execution	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571428
Start date and time:	2024-12-09 11:11:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2025 Ecommerce Supply Chain 2025 - Concept note.pdf
Detection:	CLEAN
Classification:	clean2.winPDF@14/46@2/1
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Input	Output
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Try Before You Buy: benefits and challenges.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: PDF document Model: Joe Sandbox AI	{ "brands": [ "CII Institute of Logistics", "CII" ] }
	{ "brands": [ "CII Institute of Logistics", "CII" ] }

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.47.168.24	Msig Insurance Europe.pdf	Get hash	malicious	Unknown	Browse
	zZeXr4mg0S.exe	Get hash	malicious	Lokibot	Browse
	BACS190027-01.pdf	Get hash	malicious	Unknown	Browse
	letter_olivia.law_mercerhole.co.uk.pdf	Get hash	malicious	HTMLPhisher	Browse
	Contract Proposal Documents.pdf	Get hash	malicious	Unknown	Browse
	invoice-6483728493.pdf	Get hash	malicious	Unknown	Browse
	Scan_6090402.pdf	Get hash	malicious	Unknown	Browse
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse
	FACTURE NON PAYEE.pdf	Get hash	malicious	Unknown	Browse
	Scan_6090402.pdf	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	f5ATZ1i5CU.exe	Get hash	malicious	RedLine, XWorm	Browse	199.232.214.172
	https://www.drvhub.net	Get hash	malicious	Unknown	Browse	199.232.210.172
	NhoqAfkhHL.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	199.232.210.172
	file.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	file.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	file.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	file.exe	Get hash	malicious	AveMaria, StormKitty, VenomRAT	Browse	199.232.210.172
	Q6OOwHYZzH.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	Owari.ppc.elf	Get hash	malicious	Unknown	Browse	104.82.208.161
	Owari.arm7.elf	Get hash	malicious	Mirai	Browse	72.247.212.137
	contents.exe	Get hash	malicious	Unknown	Browse	88.221.168.226
	Msig Insurance Europe.pdf	Get hash	malicious	Unknown	Browse	23.47.168.24
	cllmxIZWcQ.lnk	Get hash	malicious	Unknown	Browse	104.126.112.182
	Y5kEUsYDFr.exe	Get hash	malicious	Unknown	Browse	69.192.108.223
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	84.53.135.142
	sora.mips.elf	Get hash	malicious	Mirai	Browse	104.84.160.234
	zZeXr4mg0S.exe	Get hash	malicious	Lokibot	Browse	23.47.168.24
	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	104.116.11.255

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.143357293132808
Encrypted:	false
SSDEEP:	6:L+q2P92nKuAl9OmbnIFUt8s0WZmw+sDVkwO92nKuAl9OmbjLJ:L+v4HAahFUt8s0W/+sDV5LHAaSJ
MD5:	F3D46A5984C8102C023A3A4E60974C05
SHA1:	1C3A5A4725D88B68BB897F88C95EE8530C41B836
SHA-256:	18B69D5930DC7111BE5B022C3A171FC376A757D81DFBEF58BCC605A418875781
SHA-512:	A2B822659B261CA05C9F1E6C8584563B422FBA9679DCF060BCB87B68A6D1D9B11DE75E6FC3C4F283C79340B39D1C4CBD5860AE06453D89C3356A8D8419CC5CBD
Malicious:	false
Reputation:	low
Preview:	2024/12/09-05:11:58.000 15c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/09-05:11:58.002 15c Recovering log #3.2024/12/09-05:11:58.002 15c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

File type:	PDF document, version 1.7, 2 pages
Entropy (8bit):	7.930351356203657
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	2025 Ecommerce Supply Chain 2025 - Concept note.pdf
File size:	142'502 bytes
MD5:	a0e9481f276979baf75614a5787e6851
SHA1:	7e49efc87e86d97f90388e5ee19902c756951028
SHA256:	396fae2c1ac09ab0be0a297b7a91ca5ab26da37d794d6162bbfbd9fb2776b2d8
SHA512:	a00749c8d70b741d22a6758b1ad9e04ce279dd2c21e6347f89c6a0c394443b37956d0537387597654d1c9e22927fc77a6b1b6bacd7802d9ce5bbebaba2a2a6f9
SSDEEP:	3072:zqSR5ldvJpaF87wuECrem59C9ifHkEOr73cJahFrx0:zxDJJs87wuKm57xOrbni
TLSH:	92D3E1039D0869CEE2A697D57F0B3D0C7B1DB614E6C525E6313DDF86AB90E0A4C6A10A
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 32 0 R/MarkInfo<</Marked true>>/Metadata 131 0 R/ViewerPreferences 132 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 29 0 R] >>..endobj..3 0 obj..<</Type/Page/Paren

General
Header:	%PDF-1.7
Total Entropy:	7.930351
Total Bytes:	142502
Stream Entropy:	7.968668
Stream Bytes:	132554
Entropy outside Streams:	5.107473
Bytes outside Streams:	9948
Number of EOF found:	2
Bytes after EOF:

Name	Count
obj	51
endobj	51
stream	13
endstream	13
xref	2
trailer	2
startxref	2
/Page	2
/Encrypt	0
/ObjStm	1
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 11:12:11.214436054 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:11.214461088 CET	443	49721	23.47.168.24	192.168.2.5
Dec 9, 2024 11:12:11.214907885 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:11.215049982 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:11.215063095 CET	443	49721	23.47.168.24	192.168.2.5
Dec 9, 2024 11:12:12.425107002 CET	443	49721	23.47.168.24	192.168.2.5
Dec 9, 2024 11:12:12.425479889 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:12.425509930 CET	443	49721	23.47.168.24	192.168.2.5
Dec 9, 2024 11:12:12.426507950 CET	443	49721	23.47.168.24	192.168.2.5
Dec 9, 2024 11:12:12.426569939 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:12.460690022 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:12.460772991 CET	443	49721	23.47.168.24	192.168.2.5
Dec 9, 2024 11:12:12.460915089 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:12.460928917 CET	443	49721	23.47.168.24	192.168.2.5
Dec 9, 2024 11:12:12.506813049 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:13.046331882 CET	443	49721	23.47.168.24	192.168.2.5
Dec 9, 2024 11:12:13.046407938 CET	443	49721	23.47.168.24	192.168.2.5
Dec 9, 2024 11:12:13.046463013 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:13.047019005 CET	49721	443	192.168.2.5	23.47.168.24
Dec 9, 2024 11:12:13.047034025 CET	443	49721	23.47.168.24	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 11:12:11.589107037 CET	60107	53	192.168.2.5	1.1.1.1
Dec 9, 2024 11:12:25.080883980 CET	52830	53	192.168.2.5	1.1.1.1

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 11:12:08.980541945 CET	1.1.1.1	192.168.2.5	0x72f1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 9, 2024 11:12:08.980541945 CET	1.1.1.1	192.168.2.5	0x72f1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 9, 2024 11:12:11.919087887 CET	1.1.1.1	192.168.2.5	0x736c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 11:12:25.218698025 CET	1.1.1.1	192.168.2.5	0x17cd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-09 10:12:12 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-12-09 10:12:13 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Mon, 09 Dec 2024 10:12:12 GMT Connection: close

Target ID:	0
Start time:	05:11:56
Start date:	09/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\2025 Ecommerce Supply Chain 2025 - Concept note.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	05:11:57
Start date:	09/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	05:11:58
Start date:	09/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,17689240199072959443,17993278990504629327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2025 Ecommerce Supply Chain 2025 - Concept note.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\11b8a05c-60cf-4e7b-970a-08ba68e346ef.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5f95ba.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cd787cb4-fe70-4490-8cda-65ef79a6c514.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241209101202Z-166.bmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Windows Analysis Report
2025 Ecommerce Supply Chain 2025 - Concept note.pdf

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre