Windows Analysis Report
$DS_122189.pdf

Overview

General Information

Sample name: $DS_122189.pdf
Analysis ID: 1430204
MD5: cad17bf73508e70f9b340a734d60f4b5
SHA1: cd2968de952f8af931938a0e1b31a86988fa8276
SHA256: fa4c0ad480121283cfa6a970fc3e9314eb03538f91163612e31547bb3359ba90

Detection

Score: 22
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Monitors registry run keys for changes
Contains capabilities to detect virtual machines
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device

Classification

Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 192.168.2.16:49707 -> 104.72.156.136:443
Source: global traffic TCP traffic: 104.72.156.136:443 -> 192.168.2.16:49707
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown TCP traffic detected without corresponding DNS query: 104.72.156.136
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: classification engine Classification label: sus22.winPDF@19/37@0/36
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6200
Source: C:\Windows\System32\Taskmgr.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\TM.750ce7b0-e5fd-454f-9fad-2f66513dfa1b
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 10-13-10-560.log
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\$DS_122189.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1848 --field-trial-handle=1556,i,4073988743436467059,12195474869354941781,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding D5C028F5C7F721BEBEA8911F8E426BFC
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown Process created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /4
Source: unknown Process created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /4
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1848 --field-trial-handle=1556,i,4073988743436467059,12195474869354941781,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Windows\System32\Taskmgr.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09c5dd34-009d-40fa-bcb9-0165ad0c15d4}\InProcServer32
Source: C:\Windows\System32\Taskmgr.exe Window found: window name: SysTabControl32
Source: Window Recorder Window detected: More than 3 window changes detected
Source: $DS_122189.pdf Initial sample: PDF keyword /JS count = 0
Source: $DS_122189.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: $DS_122189.pdf Initial sample: PDF keyword /EmbeddedFile count = 0

Boot Survival
barindex
Monitors registry run keys for changes
Source: C:\Windows\System32\Taskmgr.exe Registry key monitored: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\System32\Taskmgr.exe Registry key monitored: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\System32\Taskmgr.exe Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Contains capabilities to detect virtual machines
Source: C:\Windows\System32\Taskmgr.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information queried: ProcessInformation
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\ProgramData\Microsoft\User Account Pictures\user.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\System32\RuntimeBroker.exe VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\System32\RuntimeBroker.exe VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\System32\RuntimeBroker.exe VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-256.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exe Queries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.72.156.136
 unknown United States
3257 GTT-BACKBONEGTTDE false
162.159.61.3
 unknown United States
13335 CLOUDFLARENETUS false
23.221.240.182
 unknown United States
8612 TISCALI-IT false
107.22.247.231
 unknown United States
14618 AMAZON-AESUS false