Windows Analysis Report
Security + 701 Book.pdf

Overview

General Information

Sample name: Security + 701 Book.pdf
Analysis ID: 1431490
MD5: eca24bd2b1640581057c4a8397983636
SHA1: aaebf4b94cfdf384cf224627866247af1969d530
SHA256: 92d9336a7067668704d64697504e5318207edfbdde6592f3321bcc5771751949
Infos:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

No high impact signatures.

Classification

There are no high impact signatures.

Source: Security + 701 Book.pdf String found in binary or memory: http://calibre-ebook.com/xmp-namespace
Source: Security + 701 Book.pdf String found in binary or memory: http://calibre-ebook.com/xmp-namespace-custom-columns
Source: Security + 701 Book.pdf String found in binary or memory: http://calibre-ebook.com/xmp-namespace-series-index
Source: Security + 701 Book.pdf String found in binary or memory: http://getcertifiedgetahead.com/)
Source: Security + 701 Book.pdf String found in binary or memory: http://prismstandard.org/namespaces/basic/2.0/
Source: Security + 701 Book.pdf String found in binary or memory: https://getcertifiedgetahead.com/)
Source: Security + 701 Book.pdf String found in binary or memory: https://ics-training.inl.gov/learn/)
Source: Security + 701 Book.pdf String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf)
Source: Security + 701 Book.pdf String found in binary or memory: https://www.wireshark.org/)
Source: classification engine Classification label: clean0.winPDF@14/41@0/0
Source: Security + 701 Book.pdf Initial sample: mailto:homer@hacker.com
Source: Security + 701 Book.pdf Initial sample: mailto:attacker@gcgacert.com
Source: Security + 701 Book.pdf Initial sample: https://getcertifiedgetahead.com/
Source: Security + 701 Book.pdf Initial sample: mailto:lisa@simpsons.com
Source: Security + 701 Book.pdf Initial sample: https://www.wireshark.org/
Source: Security + 701 Book.pdf Initial sample: mailto:homer@springfield.com
Source: Security + 701 Book.pdf Initial sample: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Source: Security + 701 Book.pdf Initial sample: https://ics-training.inl.gov/learn/
Source: Security + 701 Book.pdf Initial sample: https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf
Source: Security + 701 Book.pdf Initial sample: https transport encryption
Source: Security + 701 Book.pdf Initial sample: http://getcertifiedgetahead.com/
Source: Security + 701 Book.pdf Initial sample: http headers
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5512 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 10-10-48-690.log Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Security + 701 Book.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1756,i,13787741220776474547,12914720541817298454,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1756,i,13787741220776474547,12914720541817298454,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Security + 701 Book.pdf Static file information: File size 7811522 > 6291456
Source: Security + 701 Book.pdf Initial sample: PDF keyword /JS count = 0
Source: Security + 701 Book.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: Security + 701 Book.pdf Initial sample: PDF keyword /Page count = 1083
Source: Security + 701 Book.pdf Initial sample: PDF keyword stream count = 1219
Source: Security + 701 Book.pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: Security + 701 Book.pdf Initial sample: PDF keyword endobj count = 3839
Source: Security + 701 Book.pdf Initial sample: PDF keyword endstream count = 1219
Source: Security + 701 Book.pdf Initial sample: PDF keyword obj count = 3839
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1431490 Sample: Security + 701 Book.pdf Startdate: 25/04/2024 Architecture: WINDOWS Score: 0 6 Acrobat.exe 18 65 2->6         started        process3 8 AcroCEF.exe 104 6->8         started        process4 10 AcroCEF.exe 2 8->10         started       
⊘No contacted IP infos