IOC Report
Vertex Business Services_SKM_C950633210_650106.pdf

loading gif

Files

File Path
Type
Category
Malicious
Vertex Business Services_SKM_C950633210_650106.pdf
PDF document, version 1.7, 1 pages
initial sample
malicious
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\231c092f-fc37-4f7c-b261-9a4691a6ef0b.tmp
JSON data
modified
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
JSON data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240703142129Z-176.bmp
PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
modified
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7512
PostScript document text
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)
PostScript document text
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\Local\Temp\MSI2b537.LOG
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 10-21-27-713.log
ASCII text, with very long lines (393)
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
ASCII text, with very long lines (393), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\202815bd-39eb-4b51-bf15-6a8f4cbe44ec.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 468454
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\2ccf1f19-1c54-48c6-9b85-73fde0b156e5.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\8369b581-cd9a-4c5a-ab72-68518a0e10f0.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\b639d8da-adbe-4d15-9e82-4833dd91a50c.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
dropped
Chrome Cache Entry: 200
ASCII text, with very long lines (65447)
downloaded
Chrome Cache Entry: 201
PNG image data, 19 x 62, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 202
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 203
PNG image data, 27 x 74, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 204
PNG image data, 19 x 62, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 205
HTML document, ASCII text, with very long lines (477), with CRLF line terminators
dropped
Chrome Cache Entry: 206
PNG image data, 27 x 74, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 207
ASCII text, with very long lines (47992), with no line terminators
downloaded
Chrome Cache Entry: 208
HTML document, ASCII text, with CRLF, LF line terminators
downloaded
Chrome Cache Entry: 209
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 210
ASCII text, with very long lines (42690)
downloaded
There are 49 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Vertex Business Services_SKM_C950633210_650106.pdf"
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1508,i,12120855588788199113,17922120396274843957,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://r%2eg%2eb%69ng%2ecom/bam/ac?!&&u=a1aHR0cHM6Ly9zbWFydGNhcnQuY29tLnJ1L05xamNBLw==#RbWFya2V0aW5nQHdhdGVyc21hcnQuY29t"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,12594523878438319021,7890477079520366463,262144 /prefetch:8

URLs

Name
IP
Malicious
https://smartcart.com.ru/NqjcA/,
104.21.71.69
malicious
https://smartcart.com.ru/favicon.ico
104.21.71.69
malicious
https://smartcart.com.ru/NqjcA/#RbWFya2V0aW5nQHdhdGVyc21hcnQuY29t
malicious
https://smartcart.com.ru/NqjcA/
104.21.71.69
malicious
https://cdn.jsdelivr.net/npm/
unknown
https://cdn.jsdelivr.net/npm/bootstrap
unknown
https://code.jquery.com/jquery-3.6.0.min.js
151.101.194.137
https://code.jquery.com/jquery-3.5.1.slim.min.js
unknown
https://www.topgear.com/sites/default/files/2021/12/18.%20Koenigsegg%20Jesko.jpeg
unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js
unknown
https://challenges.cloudflare.com/turnstile/v0/api.js
104.17.3.184
https://korrespondenzanwalt.msk.ru/#privacy
unknown
https://korrespondenzanwalt.msk.ru/#
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/89d7896ddbcf41e9/1720016644190/b827cdac8873e1fd53b1ae41f3f681856307741a9b26c7bdec38a086f18ce7e3/zDYEhy7E3og3zmG
104.17.2.184
https://challenges.cloudflare.com/turnstile/v0/g/d2a97f6b6ec9/api.js
104.17.3.184
https://korrespondenzanwalt.msk.ru///4067.php
104.21.49.92
https://www.carlogos.org/uploads/2023/most-bought-super-cars-in-illinois-huracan.jpg
unknown
https://www.topgear.com/sites/default/files/2024/02/ioniq5n.jpeg
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=89d7896ddbcf41e9
104.17.2.184
https://korrespondenzanwalt.msk.ru/#modern-supercars
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=89d786589a36422b
104.17.2.184
https://korrespondenzanwalt.msk.ru/#terms
unknown
https://a.nel.cloudflare.com/report/v4?s=bcGUJh5FE1UOjggcsB6dfG1fVqDsUymwmfUUQZrk%2Fhni97ebRqErqQgnoYWZH%2Fg%2Fa8bBUJ0CFi%2B%2FVq6B0Kllc6IxenGSuHvbRKw5etA714LfQDUFftrax8nAf5ECrkuxeXwy
35.190.80.1
https://korrespondenzanwalt.msk.ru/#contact
unknown
https://korrespondenzanwalt.msk.ru/#faq
unknown
https://korrespondenzanwalt.msk.ru/#classic-cars
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hj099/0x4AAAAAAAeMifHbAAodRcAd/auto/normal
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
104.17.2.184
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/767211665:1720012542:UJm5YzHmj9cuuDszlMGBLVcD4U0ICVMJy3cqQFL5po8/89d786589a36422b/62e61516ddb07b4
104.17.2.184
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1652223767:1720012280:jpt2xJOuqh3Yxs0ZPjNUWuCmil57JX1IIJjPp5L34mE/89d7896ddbcf41e9/dba20c165b8c3c9
104.17.2.184
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/89d786589a36422b/1720016517594/SQAG7FH5FNKplEC
104.17.2.184
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/89d7896ddbcf41e9/1720016644189/u1VDXhBiv2-2_Ew
104.17.2.184
https://a.nel.cloudflare.com/report/v4?s=7Z%2B2mqucgiqISdthkfK4ykkg%2F431UyRBvwTXQ8Z8kHmYNNwaN8vsSXx8yveYmCfPjGRrdAe10CEjizOhlqyyiwwk9jd9OZQa9zbWBoImGx18xYMVFmqHGHIIrvcqqMobJzgp
35.190.80.1
https://korrespondenzanwalt.msk.ru//
104.21.49.92
https://korrespondenzanwalt.msk.ru/#electric-vehicles
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/89d786589a36422b/1720016517596/6a820e37863bba0c78d5852765ec22fa344624eef4de8561413100798b3ddbac/EyOLZfsS1q-4hb7
104.17.2.184
https://korrespondenzanwalt.msk.ru/#services
unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
104.17.24.14
https://korrespondenzanwalt.msk.ru/#about
unknown
https://korrespondenzanwalt.msk.ru/#learn-more
unknown
There are 30 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
smartcart.com.ru
104.21.71.69
malicious
a.nel.cloudflare.com
35.190.80.1
code.jquery.com
151.101.194.137
cdnjs.cloudflare.com
104.17.24.14
challenges.cloudflare.com
104.17.3.184
www.google.com
142.250.185.164
korrespondenzanwalt.msk.ru
104.21.49.92

IPs

IP
Domain
Country
Malicious
104.21.71.69
smartcart.com.ru
United States
malicious
192.168.2.16
unknown
unknown
192.168.2.4
unknown
unknown
104.17.3.184
challenges.cloudflare.com
United States
142.250.185.164
www.google.com
United States
104.21.49.92
korrespondenzanwalt.msk.ru
United States
35.190.80.1
a.nel.cloudflare.com
United States
151.101.194.137
code.jquery.com
United States
104.17.24.14
cdnjs.cloudflare.com
United States
239.255.255.250
unknown
Reserved
104.17.2.184
unknown
United States
There are 1 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileSource
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sFileAncestors
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uFileSize
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uPageCount
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sAssetId
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
bisSharedFile
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sFileAncestors
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
uFileSize
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
uPageCount
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
bisSharedFile
There are 10 hidden registries, click here to show them.

DOM / HTML

URL
Malicious
https://smartcart.com.ru/NqjcA/#RbWFya2V0aW5nQHdhdGVyc21hcnQuY29t
malicious
https://smartcart.com.ru/NqjcA/#RbWFya2V0aW5nQHdhdGVyc21hcnQuY29t
malicious
https://smartcart.com.ru/NqjcA/#RbWFya2V0aW5nQHdhdGVyc21hcnQuY29t
https://smartcart.com.ru/NqjcA/#RbWFya2V0aW5nQHdhdGVyc21hcnQuY29t
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hj099/0x4AAAAAAAeMifHbAAodRcAd/auto/normal
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hj099/0x4AAAAAAAeMifHbAAodRcAd/auto/normal
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hj099/0x4AAAAAAAeMifHbAAodRcAd/auto/normal
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hj099/0x4AAAAAAAeMifHbAAodRcAd/auto/normal