Windows Analysis Report
$DS_122189.pdf

Overview

General Information

Sample name: $DS_122189.pdf
Analysis ID: 1430202
MD5: cfa36c0f6cacc9c47dd1e30ea80e7701
SHA1: 8932c26ac38a4537767ae0cbd6fcde32e16eac2c
SHA256: 8b464491752c8edb5a64c1891c0ca07845e02648d27045356272ba2d0f7b701c

Detection

Score: 22
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Monitors registry run keys for changes
Contains capabilities to detect virtual machines
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device

Classification

Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: classification engine Classification label: sus22.winPDF@19/30@0/40
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6152
Source: C:\Windows\System32\Taskmgr.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\TM.750ce7b0-e5fd-454f-9fad-2f66513dfa1b
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 10-06-48-305.log
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\$DS_122189.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1568 --field-trial-handle=1584,i,18260329016989833633,5086747654802384951,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 03180FA3939529E9953500632E0DE73C
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1568 --field-trial-handle=1584,i,18260329016989833633,5086747654802384951,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: unknown Process created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /4
Source: unknown Process created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /4
Source: C:\Windows\System32\Taskmgr.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09c5dd34-009d-40fa-bcb9-0165ad0c15d4}\InProcServer32
Source: C:\Windows\System32\Taskmgr.exe Window found: window name: SysTabControl32
Source: Window Recorder Window detected: More than 3 window changes detected
Source: $DS_122189.pdf Initial sample: PDF keyword /JS count = 0
Source: $DS_122189.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: $DS_122189.pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: $DS_122189.pdf Initial sample: PDF keyword obj count = 109

Boot Survival
barindex
Monitors registry run keys for changes
Source: C:\Windows\System32\Taskmgr.exe Registry key monitored: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\System32\Taskmgr.exe Registry key monitored: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\System32\Taskmgr.exe Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Contains capabilities to detect virtual machines
Source: C:\Windows\System32\Taskmgr.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information queried: ProcessInformation
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\System32\RuntimeBroker.exe VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.159.61.3
 unknown United States
13335 CLOUDFLARENETUS false
23.221.240.182
 unknown United States
8612 TISCALI-IT false
54.227.187.23
 unknown United States
14618 AMAZON-AESUS false
23.45.148.189
 unknown United States
9498 BBIL-APBHARTIAirtelLtdIN false