Edit tour

Windows Analysis Report
SIGNED!.pdf

Overview

General Information

Sample name:	SIGNED!.pdf
Analysis ID:	1596695
MD5:	1082f5091a4547b47af5508e998f54c6
SHA1:	8d1ea39b043b6f51d8e9514e087db380fb04abb1
SHA256:	859a3ba09d1fd884fb23fb18c0ddd3ca94a4f9177a917dc8399ca6fd00f43ed2
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suspicious PDF detected (based on various text indicators)

Detected non-DNS traffic on DNS port

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7316 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SIGNED!.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7536 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7728 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1668,i,12082452304793903470,8295887645304676423,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 6828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://plumberdenison.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVJrVm1jWGc9JnVpZD1VU0VSMTYwMTIwMjVVMzkwMTE2NTU" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2024,i,13734563391823083010,5420562679766661642,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SIGNED!.pdf

Virustotal: Detection: 8%

Perma Link

Phishing

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: SharePoint DOWNLOAD DOCUMENT HERE C) Microsoft 2025

Source: global traffic	TCP traffic: 192.168.2.7:63970 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:64408 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 23.209.209.135 23.209.209.135
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 20.101.57.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /o/?c3Y9bzM2NV8xX25vbSZyYW5kPVJrVm1jWGc9JnVpZD1VU0VSMTYwMTIwMjVVMzkwMTE2NTU HTTP/1.1Host: plumberdenison.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: plumberdenison.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://plumberdenison.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVJrVm1jWGc9JnVpZD1VU0VSMTYwMTIwMjVVMzkwMTE2NTUAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: plumberdenison.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: plumberdenison.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: 77EC63BDA74BD0D0E0426DC8F80085060.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.3.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.1.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443

Source: classification engine

Classification label: mal52.phis.winPDF@40/54@7/7

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-22 05-18-55-478.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: ReaderMessages-journal.1.dr

Binary or memory string: CREATE TABLE GlobalState (LastSuccessfulSync DATE, HTTPModifiedDate DATE, FileLastModifiedDate DATE, TestPopulation VARCHAR(30), TestSegment VARCHAR(30), ProductName VARCHAR(30), ProductMajorVersion INTEGER, ProductMinorVersion INTEGER, LicenseState VARCHAR(15), Language VARCHAR(15), OEM VARCHAR(15), Channel VARCHAR(15) );

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SIGNED!.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1668,i,12082452304793903470,8295887645304676423,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://plumberdenison.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVJrVm1jWGc9JnVpZD1VU0VSMTYwMTIwMjVVMzkwMTE2NTU"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2024,i,13734563391823083010,5420562679766661642,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1668,i,12082452304793903470,8295887645304676423,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2024,i,13734563391823083010,5420562679766661642,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: SIGNED!.pdf	Initial sample: PDF keyword /JS count = 0
Source: SIGNED!.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
e8652.dscx.akamaiedge.net	23.209.209.135	true	false	high
www.google.com	142.250.185.228	true	false	high
plumberdenison.com	72.167.140.51	true	false	unknown
x1.i.lencr.org	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://plumberdenison.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://plumberdenison.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVJrVm1jWGc9JnVpZD1VU0VSMTYwMTIwMjVVMzkwMTE2NTU	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.3.dr	false		high
https://www.adobe.co	ReaderMessages.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
72.167.140.51	plumberdenison.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
23.209.209.135	e8652.dscx.akamaiedge.net	United States	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596695
Start date and time:	2025-01-22 11:17:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SIGNED!.pdf
Detection:	MAL
Classification:	mal52.phis.winPDF@40/54@7/7
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown
URL: https://plumberdenison.com Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'plumberdenison.com' does not appear to be attempting to spoof any known brand. It seems to be a straightforward domain name likely related to plumbing services in Denison, a city or region. There are no visual character substitutions or structural changes that suggest typosquatting. The domain name is descriptive and contextually appropriate for a local service provider, indicating a legitimate purpose unrelated to any well-known brand."}
URL: https://plumberdenison.com

IP
192.168.2.7
192.168.2.4
192.168.2.6

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.209.209.135	331438022043626947.js	Get hash	malicious	Strela Downloader	Browse	x1.i.lencr.org/
	https://na2.docusign.net/Signing/EmailStart.aspx?a=952db75a-b95d-4990-bad7-b8ca09b525c0&etti=24&acct=a5d48cc1-19dc-46b1-9d58-6ea237bb99fc&er=7ab9da16-aa14-42d2-a3ce-ce370796dec4	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	https://comms.cushwakedigital.com/collect/click.aspx?u=cWMxQVMxbjBMeVBFV29obXRTVTlhb0R2RS9pcDNhbnZmMEYyb1MzaWlDQmlIMnBhL0Q5ZThSdkVHRytETXJ5bW8vbFVHSyt2WkJHT0RZVVBXS1hLRkZsNmJnNktCaUZ6&rh=ff00de2d21471cd4df91b51f4c468245cab5fc53	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	Brewin-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	x1.i.lencr.org/
	Kodiak Hub Procurement Ltd Project portfolio 2025_2.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	82368468305205033.js	Get hash	malicious	Strela Downloader	Browse	x1.i.lencr.org/
	https://cdn.btmessage.com	Get hash	malicious	HTMLPhisher	Browse	x1.c.lencr.org/
	73451533787796517.js	Get hash	malicious	Strela Downloader	Browse	x1.i.lencr.org/
	2303023591829519869.js	Get hash	malicious	Strela Downloader	Browse	x1.i.lencr.org/
	7820319161178010558.js	Get hash	malicious	Strela Downloader	Browse	x1.i.lencr.org/
239.255.255.250	https://norpor.shop/riiw2-1.mp4	Get hash	malicious	Unknown	Browse
	http://md-pass.com	Get hash	malicious	Unknown	Browse
	https://dnl.hb-fein.de/	Get hash	malicious	Unknown	Browse
	20252201_pdf.html	Get hash	malicious	Unknown	Browse
	http://www.nhtfxq.blogspot.ie/	Get hash	malicious	Phisher	Browse
	http://narod.ru//disk/10290564001/sm010%20.pdf.htm	Get hash	malicious	HTMLPhisher	Browse
	http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=	Get hash	malicious	HTMLPhisher	Browse
	https://duskrise.shop/	Get hash	malicious	Unknown	Browse
	test.hta	Get hash	malicious	Vidar	Browse
	tgeh_1.svg	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
e8652.dscx.akamaiedge.net	331438022043626947.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	https://www.zeffy.com/en-US/ticketing/9792a5cc-964b-451c-a97d-176fd6d24206	Get hash	malicious	HTMLPhisher	Browse	2.23.197.184
	Brewin-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	23.209.209.135
	Kodiak Hub Procurement Ltd Project portfolio 2025_2.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	82368468305205033.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	KINXXR6XUW.pdf	Get hash	malicious	HTMLPhisher	Browse	2.23.197.184
	73451533787796517.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	2303023591829519869.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	7820319161178010558.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	26817284322623526.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
bg.microsoft.map.fastly.net	MSystem32.exe	Get hash	malicious	Nanocore	Browse	199.232.210.172
	Client.exe	Get hash	malicious	AsyncRAT	Browse	199.232.214.172
	using python exe.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	using python exe.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.zeffy.com/en-US/ticketing/9792a5cc-964b-451c-a97d-176fd6d24206	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	Or#U00e7amento.msi	Get hash	malicious	AteraAgent	Browse	199.232.210.172
	https://axa365.sharepoint.com/:u:/r/sites/AGO1/SBX590743/Midtermshare/CapGemini/ResQ%20x64.msi?csf=1&web=1&e=FgDuBX	Get hash	malicious	Unknown	Browse	199.232.210.172
	Setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	wse1951.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	wse1951.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	http://drfloresdental.com	Get hash	malicious	Unknown	Browse	198.12.239.219
	https://circle.innovativecsportal.com/cL2QAwuf82oUn6oxR4S8IQKfqiEV2v1uB8rjaBTT+WEfz+dkUsA=	Get hash	malicious	Unknown	Browse	198.12.239.219
	codes.js	Get hash	malicious	AgentTesla	Browse	68.178.135.68
	https://sjsenersol.ae/clone/house	Get hash	malicious	Unknown	Browse	208.109.224.243
	http://donnavanvleck.com/dist/index.html	Get hash	malicious	HTMLPhisher	Browse	132.148.176.204
	file.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	chrome.exe	Get hash	malicious	Unknown	Browse	166.62.28.147
	chrome.exe	Get hash	malicious	Unknown	Browse	166.62.28.147
	https://142.132.167.72.host.secureserver.net	Get hash	malicious	Unknown	Browse	72.167.132.142
	January-16-Reminder-2025.js	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	331438022043626947.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	Brewin-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	23.209.209.135
	Kodiak Hub Procurement Ltd Project portfolio 2025_2.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	82368468305205033.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	73451533787796517.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	154.213.189.141-arm-2025-01-21T03_19_06.elf	Get hash	malicious	Mirai, Moobot	Browse	182.7.150.151
	2303023591829519869.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	7820319161178010558.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	26817284322623526.js	Get hash	malicious	Strela Downloader	Browse	23.209.209.135
	Ccapetillo-Bonus Disbursment Sheet.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.20541490814627
Encrypted:	false
SSDEEP:	6:iOa+EqM+q2PcNwi2nKuAl9OmbnIFUtkMSZmwGM9MVkwOcNwi2nKuAl9OmbjLJ:7a+EqM+vLZHAahFUtkMS/GM9MV54ZHAR
MD5:	7A1C34127C81102E84BEF76A69D011DE
SHA1:	D55833874C35B238ED501CE17B237B9DC55ABD56
SHA-256:	68353440D47B0F0BE505FFF3A65268A3486832970D490B1FCCB5C1F624907D01
SHA-512:	4D93581F94551EA2791ACA170AE4F396F1C9ACC4E43D9601859F43394E46652D0E906057B6537870B205C9621C36C064F648A28BA1C879FE9F6303F5217B29B9
Malicious:	false
Reputation:	low
Preview:	2025/01/22-05:18:53.141 1d8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/22-05:18:53.143 1d8c Recovering log #3.2025/01/22-05:18:53.143 1d8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
URL:	https://plumberdenison.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVJrVm1jWGc9JnVpZD1VU0VSMTYwMTIwMjVVMzkwMTE2NTU
Preview:	.

File type:	PDF document, version 1.7
Entropy (8bit):	7.920365324961788
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	SIGNED!.pdf
File size:	49'343 bytes
MD5:	1082f5091a4547b47af5508e998f54c6
SHA1:	8d1ea39b043b6f51d8e9514e087db380fb04abb1
SHA256:	859a3ba09d1fd884fb23fb18c0ddd3ca94a4f9177a917dc8399ca6fd00f43ed2
SHA512:	aa762c4cc0d9cfcf2dddb8355522606ce728934ac46665db3aa867f7dd795b25039fa564dce9a5adbbb6c57db25653629b7905dbb5462d51d0ffbf0615b570e9
SSDEEP:	1536:wZioqmIcvAEtPSfjmtp+VgE43hGzvzDUPVxDXq:6iOIMY7mtkgEMKvzDyDXq
TLSH:	2B23F1BC5B48587EEDA9F975BCA30374ABB291B1F97C5D18AF34070A0A04E91C35067B
File Content Preview:	%PDF-1.7.%.....2 0 obj.<<./Type /Catalog./Pages 4 0 R./Lang (en)./StructTreeRoot 5 0 R./MarkInfo 6 0 R./Metadata 7 0 R./ViewerPreferences 8 0 R./AcroForm 9 0 R.>>.endobj.7 0 obj.<<./Type /Metadata./Subtype /XML./Filter /FlateDecode./Length 487.>>.stream..

General
Header:	%PDF-1.7
Total Entropy:	7.920365
Total Bytes:	49343
Stream Entropy:	7.919199
Stream Bytes:	48353
Entropy outside Streams:	5.246696
Bytes outside Streams:	990
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	8
endobj	8
stream	6
endstream	6
xref	0
trailer	0
startxref	1
/Page	0
/Encrypt	0
/ObjStm	1
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 11:18:48.436834097 CET	49677	443	192.168.2.7	20.50.201.200
Jan 22, 2025 11:18:48.817694902 CET	49677	443	192.168.2.7	20.50.201.200
Jan 22, 2025 11:18:49.146009922 CET	49671	443	192.168.2.7	204.79.197.203
Jan 22, 2025 11:18:49.567672014 CET	49677	443	192.168.2.7	20.50.201.200
Jan 22, 2025 11:18:51.067786932 CET	49677	443	192.168.2.7	20.50.201.200
Jan 22, 2025 11:18:53.693161964 CET	49672	443	192.168.2.7	104.98.116.138
Jan 22, 2025 11:18:54.052030087 CET	49677	443	192.168.2.7	20.50.201.200
Jan 22, 2025 11:18:56.111435890 CET	443	49698	104.98.116.138	192.168.2.7
Jan 22, 2025 11:18:56.111560106 CET	49698	443	192.168.2.7	104.98.116.138
Jan 22, 2025 11:18:58.792824984 CET	49671	443	192.168.2.7	204.79.197.203
Jan 22, 2025 11:19:00.016017914 CET	49677	443	192.168.2.7	20.50.201.200
Jan 22, 2025 11:19:01.659724951 CET	49739	80	192.168.2.7	23.209.209.135
Jan 22, 2025 11:19:01.664522886 CET	80	49739	23.209.209.135	192.168.2.7
Jan 22, 2025 11:19:01.664597034 CET	49739	80	192.168.2.7	23.209.209.135
Jan 22, 2025 11:19:01.664747953 CET	49739	80	192.168.2.7	23.209.209.135
Jan 22, 2025 11:19:01.669521093 CET	80	49739	23.209.209.135	192.168.2.7
Jan 22, 2025 11:19:02.300072908 CET	80	49739	23.209.209.135	192.168.2.7
Jan 22, 2025 11:19:02.300090075 CET	80	49739	23.209.209.135	192.168.2.7
Jan 22, 2025 11:19:02.300179958 CET	49739	80	192.168.2.7	23.209.209.135
Jan 22, 2025 11:19:11.928141117 CET	49677	443	192.168.2.7	20.50.201.200
Jan 22, 2025 11:19:22.681473017 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:22.681512117 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:22.681591988 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:22.681885958 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:22.681900978 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.310870886 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.311115026 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.311151028 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.312221050 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.312279940 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.313385010 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.313467026 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.313575983 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.313592911 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.356609106 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.538477898 CET	49739	80	192.168.2.7	23.209.209.135
Jan 22, 2025 11:19:23.790379047 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.790465117 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.790513992 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.792203903 CET	49887	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.792228937 CET	443	49887	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.839876890 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.839930058 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:23.839998007 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.840248108 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:23.840264082 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:24.447717905 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:24.487339973 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:24.487370968 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:24.487848997 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:24.507642031 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:24.507792950 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:24.507796049 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:24.553226948 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:24.553240061 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:24.692555904 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:24.692722082 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:24.692790031 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:24.693223953 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:24.693243027 CET	443	49895	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:24.693253994 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:24.693285942 CET	49895	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.000139952 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.000191927 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:25.000253916 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.000489950 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.000508070 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:25.599164963 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:25.599529982 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.599555969 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:25.601027966 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:25.601105928 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.601424932 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.601505041 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:25.601567984 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.601576090 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:25.646986008 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.840684891 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:25.840770006 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:25.840821981 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.841231108 CET	49902	443	192.168.2.7	72.167.140.51
Jan 22, 2025 11:19:25.841253042 CET	443	49902	72.167.140.51	192.168.2.7
Jan 22, 2025 11:19:26.702730894 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:26.702801943 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:19:26.702872992 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:26.703098059 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:26.703133106 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:19:27.342905998 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:19:27.343307972 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:27.343389988 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:19:27.344470024 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:19:27.344589949 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:27.345993996 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:27.346272945 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:19:27.397082090 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:27.397160053 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:19:27.443869114 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:37.250689030 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:19:37.250773907 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:19:37.250837088 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:37.916364908 CET	49915	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:19:37.916454077 CET	443	49915	142.250.185.228	192.168.2.7
Jan 22, 2025 11:20:26.756529093 CET	49999	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:20:26.756588936 CET	443	49999	142.250.185.228	192.168.2.7
Jan 22, 2025 11:20:26.756679058 CET	49999	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:20:26.756917000 CET	49999	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:20:26.756943941 CET	443	49999	142.250.185.228	192.168.2.7
Jan 22, 2025 11:20:27.409348965 CET	443	49999	142.250.185.228	192.168.2.7
Jan 22, 2025 11:20:27.409699917 CET	49999	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:20:27.409713984 CET	443	49999	142.250.185.228	192.168.2.7
Jan 22, 2025 11:20:27.410024881 CET	443	49999	142.250.185.228	192.168.2.7
Jan 22, 2025 11:20:27.410387039 CET	49999	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:20:27.410435915 CET	443	49999	142.250.185.228	192.168.2.7
Jan 22, 2025 11:20:27.458477974 CET	49999	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:20:37.327627897 CET	443	49999	142.250.185.228	192.168.2.7
Jan 22, 2025 11:20:37.327718019 CET	443	49999	142.250.185.228	192.168.2.7
Jan 22, 2025 11:20:37.327814102 CET	49999	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:20:38.545464993 CET	49999	443	192.168.2.7	142.250.185.228
Jan 22, 2025 11:20:38.545507908 CET	443	49999	142.250.185.228	192.168.2.7
Jan 22, 2025 11:21:43.811157942 CET	64408	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:21:43.816047907 CET	53	64408	1.1.1.1	192.168.2.7
Jan 22, 2025 11:21:43.816135883 CET	64408	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:21:43.816214085 CET	64408	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:21:43.821049929 CET	53	64408	1.1.1.1	192.168.2.7
Jan 22, 2025 11:21:44.260468006 CET	53	64408	1.1.1.1	192.168.2.7
Jan 22, 2025 11:21:44.261363029 CET	64408	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:21:44.266515970 CET	53	64408	1.1.1.1	192.168.2.7
Jan 22, 2025 11:21:44.266673088 CET	64408	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:22:08.139255047 CET	63970	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:22:08.144227982 CET	53	63970	1.1.1.1	192.168.2.7
Jan 22, 2025 11:22:08.144304037 CET	63970	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:22:08.149245024 CET	53	63970	1.1.1.1	192.168.2.7
Jan 22, 2025 11:22:08.589584112 CET	63970	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:22:08.594836950 CET	53	63970	1.1.1.1	192.168.2.7
Jan 22, 2025 11:22:08.595012903 CET	63970	53	192.168.2.7	1.1.1.1

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 11:18:54.660676956 CET	123	123	192.168.2.7	20.101.57.9
Jan 22, 2025 11:18:55.206237078 CET	123	123	20.101.57.9	192.168.2.7
Jan 22, 2025 11:19:01.647990942 CET	52557	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:19:01.655442953 CET	53	52557	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:22.171133995 CET	53	62978	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:22.317152023 CET	59877	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:19:22.317297935 CET	57388	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:19:22.324513912 CET	53	53009	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:22.617639065 CET	53	59877	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:22.768404007 CET	53	57388	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:23.344779968 CET	53	59562	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:24.697571993 CET	52887	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:19:24.697710037 CET	60310	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:19:24.999098063 CET	53	60310	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:24.999675989 CET	53	52887	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:26.694766045 CET	53150	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:19:26.694766045 CET	58782	53	192.168.2.7	1.1.1.1
Jan 22, 2025 11:19:26.701572895 CET	53	58782	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:26.701771975 CET	53	53150	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:35.091531992 CET	53	52827	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:40.263380051 CET	53	54675	1.1.1.1	192.168.2.7
Jan 22, 2025 11:19:48.839601994 CET	138	138	192.168.2.7	192.168.2.255
Jan 22, 2025 11:19:59.170192003 CET	53	54024	1.1.1.1	192.168.2.7
Jan 22, 2025 11:20:22.157124996 CET	53	54585	1.1.1.1	192.168.2.7
Jan 22, 2025 11:20:22.374780893 CET	53	54706	1.1.1.1	192.168.2.7
Jan 22, 2025 11:20:52.604361057 CET	53	56703	1.1.1.1	192.168.2.7
Jan 22, 2025 11:21:38.733350992 CET	53	64863	1.1.1.1	192.168.2.7
Jan 22, 2025 11:21:43.810726881 CET	53	57138	1.1.1.1	192.168.2.7
Jan 22, 2025 11:22:08.138798952 CET	53	53511	1.1.1.1	192.168.2.7

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 11:19:01.664747953 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Jan 22, 2025 11:19:02.300072908 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=38110 Expires: Wed, 22 Jan 2025 20:54:12 GMT Date: Wed, 22 Jan 2025 10:19:02 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUX
Jan 22, 2025 11:19:02.300090075 CET	509	IN	Data Raw: a9 bc b2 a8 50 d0 0c b1 d8 1a 69 20 27 29 08 ac 61 75 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 Data Ascii: Pi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj

Timestamp	Bytes transferred	Direction	Data
2025-01-22 10:19:23 UTC	735	OUT	GET /o/?c3Y9bzM2NV8xX25vbSZyYW5kPVJrVm1jWGc9JnVpZD1VU0VSMTYwMTIwMjVVMzkwMTE2NTU HTTP/1.1 Host: plumberdenison.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 10:19:23 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 Jan 2025 10:19:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2025-01-22 10:19:23 UTC	11	IN	Data Raw: 31 0d 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 10

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SIGNED!.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\51826126-f3ee-46af-8b8f-04c07d4259fe.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF39e375.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aa684cbd-39ab-45e2-88f8-71ee1454dab1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250122101857Z-169.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7372

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7372

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Windows Analysis Report
SIGNED!.pdf

Timestamp	Bytes transferred	Direction	Data
2025-01-22 10:19:24 UTC	666	OUT	GET /favicon.ico HTTP/1.1 Host: plumberdenison.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://plumberdenison.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVJrVm1jWGc9JnVpZD1VU0VSMTYwMTIwMjVVMzkwMTE2NTU Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 10:19:24 UTC	172	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 Jan 2025 10:19:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-01-22 10:19:25 UTC	353	OUT	GET /favicon.ico HTTP/1.1 Host: plumberdenison.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-22 10:19:25 UTC	172	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 Jan 2025 10:19:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Vary: Accept-Encoding

Target ID:	1
Start time:	05:18:52
Start date:	22/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SIGNED!.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	05:18:53
Start date:	22/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1668,i,12082452304793903470,8295887645304676423,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	06:19:54
Start date:	22/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://plumberdenison.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVJrVm1jWGc9JnVpZD1VU0VSMTYwMTIwMjVVMzkwMTE2NTU"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	06:19:56
Start date:	22/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2024,i,13734563391823083010,5420562679766661642,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre