Windows Analysis Report
S6EYDMM5FRYSUFUO.pdf

Overview

General Information

Sample name: S6EYDMM5FRYSUFUO.pdf
Analysis ID: 1391069
MD5: a46406310ca63339723f1e6b33bdc7d5
SHA1: 0e9a10c5489a0368e3d886b5c0cb95f65228d773
SHA256: 7e0dfbfcb7a7c2a65d9160b7750836d8b8d71a24c5dea559abf003efef0f36a0
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 23.63.158.36:443
Source: global traffic TCP traffic: 23.63.158.36:443 -> 192.168.2.5:49714
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.158.36
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: classification engine Classification label: clean1.winPDF@14/45@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-02-12 20-15-14-551.log Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\S6EYDMM5FRYSUFUO.pdf
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1584,i,9385300954617959697,6178255293535161296,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1584,i,9385300954617959697,6178255293535161296,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: S6EYDMM5FRYSUFUO.pdf Initial sample: PDF keyword /JS count = 0
Source: S6EYDMM5FRYSUFUO.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: S6EYDMM5FRYSUFUO.pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior