Windows Analysis Report
Paul Smart - Invoice Bill.pdf

Overview

General Information

Sample name:	Paul Smart - Invoice Bill.pdf
Analysis ID:	1467113
MD5:	39858a2a0079fbe41ce2f07a492b4ab5
SHA1:	90f80d1fdb50561acc5d4767df4ed3f1f8306655
SHA256:	4cfd3f5038d9688b5c14385693f672c74c1f8d3470f6362aaa3789537c3d6aad
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49718
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 23.41.168.139:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.41.168.139 23.41.168.139

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139

Source: global traffic

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: classification engine

Classification label: clean2.winPDF@15/44@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 11-46-18-181.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Paul Smart - Invoice Bill.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1548,i,3961840508981448788,13254356319118314033,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1548,i,3961840508981448788,13254356319118314033,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Paul Smart - Invoice Bill.pdf	Initial sample: PDF keyword /JS count = 0
Source: Paul Smart - Invoice Bill.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Paul Smart - Invoice Bill.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.41.168.139	unknown	United States		6461	ZAYO-6461US	false

ID:	1467113
Product:	CloudBasic
Start time:	17:45:23
Start date:	03.07.2024
Sample:	Paul Smart - Invoice Bill.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	39858a2a0079fbe41ce2f07a492b4ab5
SHA1:	90f80d1fdb50561acc5d4767df4ed3f1f8306655
SHA256:	4cfd3f5038d9688b5c14385693f672c74c1f8d3470f6362aaa3789537c3d6aad
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	6C8F08D552EF8584DC433708BB5AAA5D	10A1684F47C8527CFA62CA900CD0AF5538ED4B3D	7E09E3ED724638BDAB5C0D0F1809B8A9AAEC7895C280AE24FEDAEC3BF7453E3E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	6C8F08D552EF8584DC433708BB5AAA5D	10A1684F47C8527CFA62CA900CD0AF5538ED4B3D	7E09E3ED724638BDAB5C0D0F1809B8A9AAEC7895C280AE24FEDAEC3BF7453E3E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	F79ED14996BB16BEFDC4FC57EA7E8DA7	E60F79BBE1D62050089B7688E84D9B811C8F5806	A8EE9409BCE3B752550EF596F0386CFF2D3A09274EFBEF4B63A33E949BCD1E81
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	F79ED14996BB16BEFDC4FC57EA7E8DA7	E60F79BBE1D62050089B7688E84D9B811C8F5806	A8EE9409BCE3B752550EF596F0386CFF2D3A09274EFBEF4B63A33E949BCD1E81
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	9E8D4BE8DD03F1DC7365242C3B830D72	2D644D05169E382298CE766799FE7B0965CFC2C5	9F76A33C80F10D0EF7ECA9E6C5AEA35E97A12D06D4B7D699619497D2AA13B367
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fddfdc3e-b1a3-40fd-8d01-cfd6fe27bc02.tmp	JSON data	9E8D4BE8DD03F1DC7365242C3B830D72	2D644D05169E382298CE766799FE7B0965CFC2C5	9F76A33C80F10D0EF7ECA9E6C5AEA35E97A12D06D4B7D699619497D2AA13B367
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	329DF43731DEF29B5D3BC7F2D7F933DC	814C7050592D8C1A101394B8270652534F1FD22F	718E2469ED91F7B94C1FA0F721CF7AC8419E7E615E61046007887D2FA313425A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	C1ADF8A6CD5A7D6AF8A3DE7F34FD2B4B	4A55738C19AE3DEE96CC8FC41AFE22C20B888CF8	491A01EE402BBB7282DDCB2570932E9162EC974EBE5EDBC1A4C37CB8251E5B4A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	C1ADF8A6CD5A7D6AF8A3DE7F34FD2B4B	4A55738C19AE3DEE96CC8FC41AFE22C20B888CF8	491A01EE402BBB7282DDCB2570932E9162EC974EBE5EDBC1A4C37CB8251E5B4A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240703154620Z-161.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	B6EFC6DB09AA9D38525BC25FC6404EAD	AF5E5F6A7506B557B78480AB349745F9A7F0F675	CB7BF509180DB052D5394D804AEA64C599866E4172C55D9B573FE72DF77D4AEF
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	2F1D53C64FE45C6211B8687298200016	7CF0EBAA209B14A22A5B031384AC388E81E639D4	BDFE78C91EB99EAA9FBDFF577C0254091942C18596C3A524FCF50D9051A1A2A6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	4E688BADE7B1964ED1D9F29C89C86391	E942051E43A2BFEA04C87D85DF238D47955CD978	760A40EC1D47302F8F59FDC0431FBA4CA5200F90CDACAF85A5E2366FCE2B7D0F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.892	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	98FEB1551C78D5B242BBA18A9500486F	B7E81F042E3372827E9D144BFB6288DD2C31A083	8724388812FBF05BF57C79F346F8687A78E717018C264714C2E1E9A5730191BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	46DACE715886F6020B1B35DE88D14520	84512E99B71FD45314A11FF54ACA506D1ECF20B1	F1537DD16DE2FA4BC493454CB8A8F2AF85CB67943E8304D15013D43F4ADBAD83
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	54BA59FA10A6747557865A953F3E62E4	59AF20E881A95776A6BC713B2DCC5DBBC6599005	715B30C5B3A64EA25EB12BB47B7D0222214E705867D5C56FFAC9C01C7CDDD09F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	5590380CB4649888BAAD37AFF91CAFC1	B751F1E823A38DB6B1F401225038505E9DF67ADF	AC38C6797DDB56245874A5ACB0E39B8ACE95DED4F0659EB66A7D2FE2694C0A76
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	1CFB27B296530E7FE4F2D2DB66AE24D7	29F8E457C26E4D1D5CE37E63082D9B14EFA259D3	B01E6386FBACB8367C18A1B25919A62C8A3DA31E8954D1D471CBC3853BE542ED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	B5B6FFF5395D8B4C50FFC2B75734A1DB	58B887C68E054D4857AF380670AAFF99111C03C6	553950E0562D2D2CFBCBEA0999E8EA1168BADDF6046943ACE53EE63D905D1C9E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	6BBFE7BFE99F117F5C4C6F71BFF99D08	2FE22B7A9B0CAE1FBFBAE2ACAF3FD3B597D52597	E1D6AE439292D0ED24C334DDCBDFD2AF591D31041FE66CFDCC91CB8490CCE43A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	100E290DE5A02275D0F4BA74920F95BE	523ED350F5D3B86DBA3154D5D199A2B63FC6DA16	559D1EA94AF11EB7CBD228CF2402B0BB994261419A13D9AB9304960EA917232E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	CE7F1A16B791FE5F02C3B7A80E74F5DE	EC432981D0F55078E6211BB4B5AEB2C67F718B34	0738C9F73D2640D04D44C25FE319CD31959AA7C55D444942F2B85AB705855698
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	7DDBA0A2ED584EA21E2C3711D19753A2	189063399A7A470FE9F4877396BEA2E5A98A5C7A	9C87089A6353319820292DD7E666D57DFC81027806CF4610EF09E4F1F664EF07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	FC84B43D77D3630137542FBF5B388997	1F314987B3B5D90F1FAA107F5B7BB979B47AA031	5CE94DFF189CD88F823D92AEEA5675B8898EF8D0A3053D36E01D96CDA4EC2D33
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	4C2826D677EE16166748AAC1D0805C99	F3C6DA075A8C6311FBD7FBE9E7178889E64EDF11	AF841A1CB36B0DD16BAB1570CB88A6E9C24143546DB9B654FFF51C92376CBFD8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	BDD77924A93E379F22E584BEDA7AE56E	E7FB2D0FD5C22BC71BAF5F60F461B34008273EE8	9D106F4DC8B919BBB70DC2430E5D082A80AF405C925A46EDE2C058D65852EF30
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	927117C2B02EF833353EB8B6AE5D59C8	38D8EDA14BA1E8126E3C62C2E645F86FB3E92AB3	136705EAE9011719EFCFDC20EFCEC49B6C9CBE8CD0D97F25DB7A8426A291A825
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	39D438F23D52E772741504E3D870395C	529BC3F14FC8F84E1CBA297B18A65AB9825170EA	A588AD7B97D706492AFD5A8454B9A0D1CCDD6C9C8853CBF6B65DABCBBD347BFB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	1D42AD8D00F4D636313E4300C1E169AF	8926BECB386F7FA9571292FB6469ECCBF992188F	E593404573FF80FEB38716062688441673308E6CE96335859EFB8F81E31EB28F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	330DCE470DB1B3B225EFCD6FD86994B3	5ADAB1C7784EE5C3333743B504EF6A0F82B8C68E	EB48F0AEA886939DF51DF99E524B6246A744EB9AA3925BE7DA500BB7A0F83461
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	8DEE467C0EB117234DF836E4866CEB19	33019E5583963E3FA8481EB0B63D9AC17D36F8DF	4F980D0047C91A7E074E526B5464AFA7DE115BBDB75A36A5E7AF2E04742BF039
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	DDEEB263896CF8CABCF1E80D9184607A	96A22717CB4FC4C618D70AB5A125098251BA0691	2C897E76D5CA80EEF97D503653CC306B1189A128AEA6D19A9DDF1EEBE0AF0C76
C:\Users\user\AppData\Local\Temp\MSI83f8f.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	C2BAB7B847B0AD5404FA38C001003C80	8138E76340503E4D4AEE1589D91922AFE7202877	29DB9E48892989F37C273DBC1306155ECF26C36E8BA8F63443617B5405E24515
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 11-46-18-181.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	3780AC52AD1B35B0ED2FBA7A6C49BD57	E8E2606FF91589F9A8AE963FA451FB760C6C22CF	DF22E5333BCF99D1F8A0657476BF4D3B1AA461DDFAE0CDC1C0E50B89C7050787
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	0364BC7C4F7B28ECF7AE7E73298216A9	A60B051D6152EAE5D116F71DC86F516965957294	DAC7CF68BE5A6DEA5CCC3528981EB8E975D52BBE20693E49229450203C3442D6
C:\Users\user\AppData\Local\Temp\acrocef_low\256d3eef-647f-4cbf-af8c-b08c17d6a216.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\56dc2a90-c2fa-457c-823b-ac7d0a34e5d5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\a8b1bd4e-8c5a-4ef5-81fe-26e96d4f3432.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	1F3D69524A9D7E17BD2363C81D130F1A	C2A4A08839CBA47BEE2B601975F7C4F0CC191091	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
C:\Users\user\AppData\Local\Temp\acrocef_low\d4229332-12cf-41fd-98a1-2f97b0ae5276.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
Paul Smart - Invoice Bill.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report Paul Smart - Invoice Bill.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Paul Smart - Invoice Bill.pdf