Windows Analysis Report
Scan_Petitgas_ Cedric_20240419-150426_1960_001.pdf

Overview

General Information

Sample name: Scan_Petitgas_ Cedric_20240419-150426_1960_001.pdf
Analysis ID: 1428824
MD5: f822e1eabebf3298c74a09e4364f83e8
SHA1: cc7052d8f56d831283b9b3aee050a3711ea58606
SHA256: cbaad6f2eb60317c35354884d864da1e2a44061230bfcb3c6bfff103e46544c5

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)

Classification

Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.54.200.159:443
Source: global traffic TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49710
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: classification engine Classification label: clean1.winPDF@17/23@0/31
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7124
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 17-07-30-827.log
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Scan_Petitgas_ Cedric_20240419-150426_1960_001.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1340,i,10303452255966805130,6292522562581380179,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 8DE63AD4B3A829CFC893BEF54EE362FE
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1340,i,10303452255966805130,6292522562581380179,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Scan_Petitgas_ Cedric_20240419-150426_1960_001.pdf Initial sample: PDF keyword /JS count = 0
Source: Scan_Petitgas_ Cedric_20240419-150426_1960_001.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: Scan_Petitgas_ Cedric_20240419-150426_1960_001.pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs