This is an interesting find. PDF exploits are rare and this one looks to be very targeted. Also "yummy_adobe_exploit_uwu.pdf" is a malware naming convention that reminds me why I love this community.
I’m struggling to come up with some good detections for this one though. I was hoping for the process tree behavior but this seems very common with acrobat.exe:
```
Acrobat.exe (PID:6416) “manual.pdf”
├── AdobeCollabSync.exe -c (PID:3520)
├── AdobeCollabSync.exe -c (PID:5424) [stealth_timeout]
├── AdobeCollabSync.exe -c (PID:1376)
├── AdobeCollabSync.exe -c (PID:1428)
├── Adobe Crash Processor.exe (PID:5784) [reads remote process memory]
└── CRWindowsClientService.exe (PID:2956)
├── CRLogTransport.exe (PID:5384)
└── CRLogTransport.exe (PID:5148)
```
I don’t really do any API hooking in my detections (unless my EDR writes a log entry for that, rare), but I was considering some module load events for these:
| File Path | Purpose |
|---|---|
/c/windows/system32/ntdll.dll |
Extract exact OS version via PE header parsing |
/c/Windows/System32/bootsvc.dll |
Detect specific Windows editions |
/c/Windows/ADFS |
Detect Windows Server / feature presence |
but I’m not sure if I’ve got that telemetry either.
If anyone can get me a copy with their fancy VirusTotal enterprise license I would be grateful 