Windows Analysis Report
REGISTERED NY LIEN JUDGMENT 3 FILED.pdf

Overview

General Information

Sample name:	REGISTERED NY LIEN JUDGMENT 3 FILED.pdf
Analysis ID:	1467207
MD5:	3d1421e74c45d30d1861983288f509d6
SHA1:	ae031b7c4a69f2b338b70df155c31133f48e1272
SHA256:	f7ae91286f594920119d821e62cfae146e942f8a22495ee18777ce945d0af8c0
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: 171.39.242.20.in-addr.arpa

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 23.47.168.24 23.47.168.24
Source: Joe Sandbox View	IP Address: 52.6.155.20 52.6.155.20

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 1f3fa221-8ac6-43de-8455-1f83ca5a15c8x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 1f3fa221-8ac6-43de-8455-1f83ca5a15c8x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic

DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	String found in binary or memory: http://www.sos.arkansas.gott
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	String found in binary or memory: http://www.sos.arkansas.gov
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	String found in binary or memory: http://www.sos.arkansas.gov(s01)
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	String found in binary or memory: http://www.wealth4freednm.com/l

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	Binary or memory string: nB.VBp@
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	Binary or memory string: .sLn+

Source: classification engine

Classification label: clean2.winPDF@16/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4008

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-08-46-785.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\REGISTERED NY LIEN JUDGMENT 3 FILED.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1580,i,13178085396687229074,4243365313787994588,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1580,i,13178085396687229074,4243365313787994588,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf

Static file information: File size 83103267 > 6291456

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false
52.6.155.20	unknown	United States		14618	AMAZON-AESUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
171.39.242.20.in-addr.arpa	unknown	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F1214095391F59B07302F03FFB91E867	C0F5372F46A92CF8704A155039F3DB7A7A1A5E1E	C55555C73D6A86AE08527CABE945B1DD8B4CD92D14659C0C32184B71CEF4CFB0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	F1214095391F59B07302F03FFB91E867	C0F5372F46A92CF8704A155039F3DB7A7A1A5E1E	C55555C73D6A86AE08527CABE945B1DD8B4CD92D14659C0C32184B71CEF4CFB0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	345B0A9BE02FC75AC99AE1881BE9870A	9BF9DA67E31F19C767B048389DB0DE8EABBAC092	EA4901FEFF6B701D0716DED1CC73204E443730D09C7C6660D99AD15333D1EC53
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	345B0A9BE02FC75AC99AE1881BE9870A	9BF9DA67E31F19C767B048389DB0DE8EABBAC092	EA4901FEFF6B701D0716DED1CC73204E443730D09C7C6660D99AD15333D1EC53
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	BBFFABCBFCCF8D0768D314FB28B0F8D6	FC35B6B48C9997E42A7F094B765A37A3AC031C72	CD378BE71FE74AC3344F2CE976F1B8BBF80FA9C1E4FFF28EA80FC60069A32E9B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fbe6c672-8240-4893-981a-414a27204b52.tmp	JSON data	BBFFABCBFCCF8D0768D314FB28B0F8D6	FC35B6B48C9997E42A7F094B765A37A3AC031C72	CD378BE71FE74AC3344F2CE976F1B8BBF80FA9C1E4FFF28EA80FC60069A32E9B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	3DA7368D01140B7B9A1EB9AE0D422AA1	367642A9AEF29F8FAA6841121D4F9DAD00DF9C3F	DF2930C53A0EE5566B678CD9D9B14A908440B94714F6382E946782573AB047F1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	CE63CA5BD54D051480CDABA127ACFAAB	F6BCFF0F9B071447243B2FE51419F15493C302EB	C71FB171B3650FF2FC949BE25B488E5A182E7B736A8551BEC3B4DE80E01E1DA9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	CE63CA5BD54D051480CDABA127ACFAAB	F6BCFF0F9B071447243B2FE51419F15493C302EB	C71FB171B3650FF2FC949BE25B488E5A182E7B736A8551BEC3B4DE80E01E1DA9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log	data	500A7231DF678BE00BF7BD9E19759B22	065BAEFD0C8832A87821DC7B95C778706754806E	54BC9ABDAC791BB99323175D9B45787A1B076E8A7F64E4797272A485C1F9E4B9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG	ASCII text	E0773E8EFDA4D54CE495A6481553843D	D0447FD3E5ABDBC59E172FD2D535437A153828C6	2AD5A044C74DFE56AA85A410E99268CEAE7C2A8670C28F0FAF7D1311C321CDDF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log	data	A05963DD9E2C7C3F13C18A9245AD5934	15A87493591860C6C22499DF3A705ACB3CB466BD	F40B7EF0FE0B676871403B8DD21CE42AF8E482DC8B81F09D93CB2C48CCD112B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG	ASCII text	ADF409835A8F2F72C3F997215D333DD0	EEF3CC6E07971194C12C0D9580694578A228F297	187D695E8E9A818B6FF48709D3273376A6FD7E4194C63354B114A89F8DF0A7CA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240703190847Z-246.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	D41CC13956E189B0381DF3E3E595F550	6909372332C0C779A274BF29E43F358448D9C5E8	23529DEFE1A7DA911FC013195CFF8A0B8BDECCF602B8255D3F6254F91ACCD0FF
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	ED8E9CAA6C322C94A2058BBAEFFAC344	0F939BF3932DA5C2AC223F34651FF089D0E7AD31	2919BEEC467C57F525655F3AA0DBD0ADA48687A406686B9B7E65000FEBC78E63
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	D95F960DB18BD637FC7EAD10E26D8361	810A1700262CC719E5236B0AC1C7EFEE1212EA0E	7C85CC24D7B68267835F5F44CE0DF8246EE228CDD6D870B35CEFD2F70BF04763
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	97366CFA55357B4AA6A18A20B7CA05CE	8C93F4EDD4198CCE78AE2984A033606D3C316654	C90084E0CA19B12B6B39DCEC5F506AE9C1ECBA81C790046EF648D2C585400A42
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	6ED2E4851B4C10EED664F9006ADD0903	39D311F1AF043599D5B4305181CC111A3E4155D2	AF5C789DC37F48895E61B8CAE0649E5F80BBF6FCCF707F5069BDB4926E16480D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4008	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	95EEE892BD13E1ADFA2FC407D3908201	2B4AFE1EA904ED29C84C7674BD955C552CF3677A	B7F1407B686948163630324A0E9C0FA763EC92717963379941ED03C98C39A790
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	6B07FA7F1F5ED38CBC9847D364974A68	AE667EA874AA83699E672911B28336E0F441164D	1494B0DC2A658ADC659A7DFAF6A9390FF60980D34734335FF38708768210176F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	F1C92082A5E44E10D726979C069CF824	5822C79601A3AC32DDF918E8D84C7F3FE2F65C19	8D719982DFBA8994851612245F0DCBF938B531F06FDA734F65417FF7C7B33A15
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	7F7C971C7516B330C68E543E2831F1A3	C3F22D21E6B35BF6EDCE8FD1AFAB3B13CF68E1E8	3316881B222B60B1FB43A716AD8E410762D90A34CC445592F011254E18DF40FA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	D68F243708AB9D263D3CF15A0F63A0C7	A304386BDED772679033A7CF1BADD0F3892205DC	A6323BF5C59EBA52472A4EACCC7A73E92D185A25818C86D6D181C8794B1FE48D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	2C5EBD3C873B4614B1FD208C9C5D752E	4FF631EBD240DC15DB1495C9A327060D4CCA4DC8	9DE18D0113FC817706EEC9F3FEC6902C561451ACCEE78AB1D722F88094C7493B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	01A9D2E9474FEAEE530CE0B5B5458E64	61FE1635192E23E479A01F8CF450B5115DEE9AA1	9BCB64FD83DDF8DE172C8239CD674DAD1F8D0A0CA8912A458F1110A4FA280904
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	82D52CDC3A9140D255D9CCA26E36B305	5EF71F638DBF0448A97BCF93B47B324D9642A009	AB9571AB94DFE4B1189F07353E8F93895C3C76888DD7C7777B801BBB3E2EAB63
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	36D1CF4831AD5AC7B25FF4C331B878FF	00706E7E3E559A420E157A30C9630A12AA8F40E2	B751DE6AE66B096D92D612313542D8EC533409FEFD42CB7A2FDACD1C271F512B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	4574C665E56ED3554D5211C0972CC6C5	32C04D0EDA695E1C2911469B950A4E8D7D56960D	5C9CA4185C1172FB4140317B122CB1CB07C3F886BC8369C450070D5E405FFC90
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	DE392F682A0980741B8FA51145FFEB63	0B1878FAD601B244B4B80AE39CAC52B1C6D266D7	815581352BD4137E09A91725C1BEA477FBF59458730E439585E655A206A3B676
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	D0BC260DE4A3FD407E57D9826A05E188	D1F3C84607F0CFD15ADA5E59498000F897F91DF1	22B532C8051A2DE93F566FDFB94FA13BCEFDAB168E206802A34EC0ABF5DBDF67
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	12706DF1F5A5CFE7F621356448877A22	57986D531D91A3E559CFFF4B4110759A54B5ADBE	D95F2956CB7ACFA320286057BB160790542F87F3AE2E29E123FDA128721DFF35
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	7F292E053BE8310480CB5397CAE4569A	40B23612058CBF676BE9273EE362C0861B6B61E8	6768679424A8C87C4C5393FC20A1EAFC1DF8624AF312BE9091FE7A98031FC369
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	066DDBE25BEA0D568258100FBBBAC6C1	6B917AE432D1357347570142842CB20D47AEA18F	8EB27C88AAB61BA7F02B427334284567AC20BB927CFB3B08DE65BB059C8FC887
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	4BB92359A91BFAA648DF3AC39B09BB0B	9542838BB304E6A14DAD2501CDB601674D8DA5FB	C8EC322A7528C5E0C6C98AB0E006CDF44488C0B5F94715C4B594459A15F506E2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	34524995DEBF37DF3E67B8BA73E79EAE	6C2B1DCE221BFF30407D4E65F95971AEAF61A316	6300A68F3A45ACB4EC9892F15C6ABCF66BF5A71D8701894265A60C2F9B2E51AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	557EDFF9D71C8A931984CBC9D772417A	F1E65069DF4544A13E4DD5110145543A2C55A57D	B662C59C1BB6D0ECCAC6BB0381F631B993B1087E955E425435AAAF195A259EC5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	9C39704FAAE976E1CCE31B1A15DDDA3C	FE850A584F176034B79887F142CAB9443B97F52F	5C7321EAFC526DEF28CE6AA561E0F4EFB8D7D4994AC5ECFD1B9DDDB664450AC5
C:\Users\user\AppData\Local\Temp\MSI7cfbe.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	7309030769A0A67AEF849986666511A5	35C6E2C5BE5DF1F221F1AE2ABAC3FA90D3FFFE8F	3AAB1800FA5B7BE43331B302E23C6C8D7F85C9E32716A393C8C2608A6C07D468
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-08-46-785.log	ASCII text, with very long lines (393)	06DEAEDB81D09FD8FB5FF668D8E09CB2	28A02BCBD5975117B97A08AFB049F2C94F334726	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (392), with CRLF line terminators	6E4741F5D96DD1EDA6BD3E0AFCB7FEB7	562D3F9870896167B4D67EBD731B73C95636B2AE	938C1BE056E378AEB3F5DF0CD2819FE54DCE92ABE26968F09DAE68E475E3E577
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	18E40BB8288BF3E4F7FAAED5938A4F6D	E3704378D91C4D703D3684C6F0EB92AE8586533D	C9627A20D4056565B87065706A1D75A88A21E178A81EE14F0AF366BC87B420B7
C:\Users\user\AppData\Local\Temp\acrocef_low\1f5e4699-88fe-4e25-9c25-a2911c722499.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\5f21dc58-7cfb-435a-af83-3ce8b48d4399.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	0E1580362291AD21A1D725FA761C79B6	C7F4D713FE4C54F61F1A49E50157466B02540C19	76239186C62B735AC3954CE66A2A216AA2D703A4AAF29F2C50CE1C2A8679E647
C:\Users\user\AppData\Local\Temp\acrocef_low\8138b0ab-650f-41c1-b64b-6354f4532533.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\d58e41eb-4acf-4038-9dda-ab394a8331cf.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	956BEC2EB32005025184F904D9622D32	C6A9A8B3F7A7AB8122FB00457C0F83D4A77F21AF	DEFD4ADB96BA87467278B6B06980FDAB1EE460D971B62ED05A89FF32983784EF
C:\Users\user\AppData\Local\Temp\acrocef_low\ff28a03a-b19a-424e-b522-17b111758400.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	410BB1A54ECCE470696636D4C2000E33	53A6AC06832DAA17D7C006C0A9B8B30597701926	8B6D42D70862D6623F66B09F6819A35E1AF4ACC409461E140DA020F386877F92

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: 171.39.242.20.in-addr.arpa

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49707 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49707
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 192.168.2.17:49709 -> 52.6.155.20:443
Source: global traffic	TCP traffic: 52.6.155.20:443 -> 192.168.2.17:49709
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.17:49713
Source: global traffic	TCP traffic: 192.168.2.17:49713 -> 23.47.168.24:443

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 23.47.168.24 23.47.168.24
Source: Joe Sandbox View	IP Address: 52.6.155.20 52.6.155.20

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 1f3fa221-8ac6-43de-8455-1f83ca5a15c8x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 52.6.155.20
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 1f3fa221-8ac6-43de-8455-1f83ca5a15c8x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic

DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	String found in binary or memory: http://www.sos.arkansas.gott
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	String found in binary or memory: http://www.sos.arkansas.gov
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	String found in binary or memory: http://www.sos.arkansas.gov(s01)
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	String found in binary or memory: http://www.wealth4freednm.com/l

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	Binary or memory string: nB.VBp@
Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf	Binary or memory string: .sLn+

Source: classification engine

Classification label: clean2.winPDF@16/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4008

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-08-46-785.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\REGISTERED NY LIEN JUDGMENT 3 FILED.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1580,i,13178085396687229074,4243365313787994588,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1580,i,13178085396687229074,4243365313787994588,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: REGISTERED NY LIEN JUDGMENT 3 FILED.pdf

Static file information: File size 83103267 > 6291456

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

ID:	1467207
Product:	CloudBasic
Start time:	21:08:06
Start date:	03.07.2024
Sample:	REGISTERED NY LIEN JUDGMENT 3 FILED.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	3d1421e74c45d30d1861983288f509d6
SHA1:	ae031b7c4a69f2b338b70df155c31133f48e1272
SHA256:	f7ae91286f594920119d821e62cfae146e942f8a22495ee18777ce945d0af8c0
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Windows Analysis Report
REGISTERED NY LIEN JUDGMENT 3 FILED.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report REGISTERED NY LIEN JUDGMENT 3 FILED.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
REGISTERED NY LIEN JUDGMENT 3 FILED.pdf