Windows Analysis Report
Receivables Invoice 38126.pdf

Overview

General Information

Sample name:	Receivables Invoice 38126.pdf
Analysis ID:	1467211
MD5:	be19480fdecf1e35deadc990ac5d6e55
SHA1:	01a10371636b9cfc1915dc689aa445737000d4ba
SHA256:	2719f42d72b564e46c05028cdc24898bf7b1b7998d4d0ece89b7758ca2786cea
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.47.168.24 23.47.168.24

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24

Source: global traffic

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/46@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-16-04-349.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Receivables Invoice 38126.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1628,i,9660631210412651443,1511898186335121154,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1628,i,9660631210412651443,1511898186335121154,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Receivables Invoice 38126.pdf	Initial sample: PDF keyword /JS count = 0
Source: Receivables Invoice 38126.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Receivables Invoice 38126.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true

ID:	1467211
Product:	CloudBasic
Start time:	21:15:13
Start date:	03.07.2024
Sample:	Receivables Invoice 38126.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	be19480fdecf1e35deadc990ac5d6e55
SHA1:	01a10371636b9cfc1915dc689aa445737000d4ba
SHA256:	2719f42d72b564e46c05028cdc24898bf7b1b7998d4d0ece89b7758ca2786cea
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	685BA1C0355A05453431EB5A45D81ADE	DF919D4CA9AEE502D7833E7EA93CA42A82021B87	CDF76FF5640FCDF2CC42EECA0AF33ECE297959A249184E88EEBE299082B3B71C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	685BA1C0355A05453431EB5A45D81ADE	DF919D4CA9AEE502D7833E7EA93CA42A82021B87	CDF76FF5640FCDF2CC42EECA0AF33ECE297959A249184E88EEBE299082B3B71C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	FB5F147A14704D62CDD4614EAE699250	6B2E156ABF8D429AB0E865F07AA8BD5AC0543681	8D4A2AC7CE28D8174E00F615DCAF2EDF41084BB0CE57520CD387BC91A4935B58
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	FB5F147A14704D62CDD4614EAE699250	6B2E156ABF8D429AB0E865F07AA8BD5AC0543681	8D4A2AC7CE28D8174E00F615DCAF2EDF41084BB0CE57520CD387BC91A4935B58
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	F3AA3218CB0AD51437C1C0A0407FC347	65AAADEECD19947F63ECFE76C8E9218D575DB593	52E6A34DBC7B20F9845B6219712362937CDD57AD1EC9BB0A67F58B8DFEF77305
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ae211107-6ab7-411a-81f3-df2df06feaf8.tmp	JSON data	F3AA3218CB0AD51437C1C0A0407FC347	65AAADEECD19947F63ECFE76C8E9218D575DB593	52E6A34DBC7B20F9845B6219712362937CDD57AD1EC9BB0A67F58B8DFEF77305
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	3779C946E425C3332F03D4D577252BCA	A6D3E4266C372BEA33AB6AC6E9A1436D0CE51220	8E96703759296BEC037EAE8B92828704179BA7A8ACF7BD337DB3F5A716104CB1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	4232271AA1EB44B2802EA2E76C590FEF	E7FBEFE8025196BB10E1F0BBFB04EBA4F486DDC0	399C58A27960388C8641A790D4B36106FFA0F301D167CA1AD830A66A04A1B958
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	4232271AA1EB44B2802EA2E76C590FEF	E7FBEFE8025196BB10E1F0BBFB04EBA4F486DDC0	399C58A27960388C8641A790D4B36106FFA0F301D167CA1AD830A66A04A1B958
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240703191606Z-153.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	7FE11A9848EA61CAA076CA5C8F5F2B55	0F532158B8138B37B63F0FB9BE3E6282E51BB5C2	2910233071B04BCE85B69C8EC3D2DDB5C15FCF5DF66D95256ACD9FF00C13EBF7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	6ADC143FCF535EA08EB8F0FE5CA7F70B	6CF09FE32DBDDCC250EC3160075B4D30A72F71AA	BF095078F8BA9B758D96BC6966DB39D147C7402C13F9F6B496EBECE90EDB2E33
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	F2672796B6DF30FE81368683BEF1181E	09862707A7CF9A04420847DA2087E2E894D00C15	428C9C1E3AF888C9B8D6DDF900CC1378281167846EFA31216E455C41395D980C
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	EEA9115A31AB4A8EE4D7233BAD2F7B40	E0BF61050AD521C43782875594ED48903F7DAAB5	A40BECB451FBC249B944E6A03FE9C9438FC608C09FC492ADC6D10F01365DEAD3
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	9957B98650ED06DDEFD2EDB8E79429C8	4D565A6EB14559011BB58561C3A8AF17A33075AA	08A393534C667D72B64689E37C8AF05855059C19819B3E47055D13514A734507
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7392	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	37941A7DF3F8D246B0E9B1B97328B81F	09ED88ACD78AC45FA812C994B4416A99DA45BF18	684867EB1EAB55E0147CABB957121362A46FC7F4C48B08A157706EB8E71B4B5A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	DC8827A71887ECE5BA53999BE29A7B98	AC43D2549F63320C3F712A904BD7A4E4D10DD5CA	CA4B919C353AF66678403CBAAEF24F56AA8B4B54F063D989A7A2F66370C63744
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	DAB344462CAA16F627486F5EDD352F61	4DFF0B4987B579F7D624F48BAADB98F744C2BFE2	1A3347563A2FBB66E3326DA4AE44F97BA4A4C4F8FD35F9DB0B4EF8D2AA2E72C5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	F33B798202D81B3818967AF4DBF8E1CD	41E8CE3FF0F523B56BD2F4AB6C3C0E5C9212154F	241F4B0FE9465B624227D3406EC98273643CAC4BE6A6E9231E491FF5B501EA31
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	7E32C1DAC0495755E8468115D8D34FC7	DCD9E05DC36E2B3F020E353D1BBB11B1FA42456B	9A969F9C13B53BA46E179E49F07937A1B5D4C22913E9958E0ED18F323E0A1B31
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	9990D31661F0AB44E89034AE931C5D42	98860667854B97466A3DADC101BF001BC7161F01	759C3CBCC4B3A7740DF25C9F5F76A3F18AFFB0F3B12C7FC3853CCF36208BCC55
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	F44C27F24B97D67E9818036BC7F6C871	9DB6526DC532DFD5EDD48E833AEA56A02E40AC55	B6D74B3A730E03A198913B62865FC93232FB04221178F9AE6A2AF89C2796FC86
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	BB6DCD2B5DADAB24249FB460F1BB4C55	BC84B3AF7FBD96372A122E5DBB47592147CE6A45	661D9C1E293F11116E7099CE0944DC7991A5FDDCEF5691B9330360C2D0B95A2A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	452D4F9E61BC0F4F9DFD1B9C0BF8D031	6063E1A5C0DC20636BF043FCB1626A3668E970AF	6A6B88150B3C40842586E225F010B63B51F95B61C60ED2B20FBDE0B0C92BECA7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	CADCB8EA7A74C4ED1C0A52B21E32A74F	D09D7B7946E3EF31622D974941F112078B211124	541C8A60787B148F6572364155F4CB8ACD2483C515E1233B10AB6173E290AC2A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	9421498F0DBFA40CA57E8006EDA7E004	6B305CA8B03A7C59787ED8E42545212700E4FA7B	5E5E47BBA520201EEB8051AD78C4F1CDCCB51EC728DF1B3CB26CF2857F846C9D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	A30BD48B18BF8EA674F3B929849389B4	843E51844FC1FECC25888973540749A0437DD86E	E42DA66864352B78E9FB3784A43477B693BF6253856A7F62E1C33A0245A0B557
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	7A0BFE14DB5945D2F8680DAA5CDA9E17	06EDE48FA1EC6C80371CB81F966729EF1E12FA1E	9EDDBF33E7064DF8689CC1FF15E0EEA6CF005B58C1DB0C2DA04B0D4233CE6D15
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	CB3C9247702145F7D87582056C1E8750	8DCE36DE1A920D211E63626CFF5A346A0133B0CB	A03091BE2CFC0A886504C1434E3233ED1E647E5532AA84CB1E2A1FCC6322E401
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	D7F1088332DE4A239C3F4718698CA16C	25326E3A218AC6589CBE27B381D5708A47A94491	C417C656672DB8DA298E86A4B0CEE3490F1BAD01AF4E62FC804A6121E86F8A4A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	2B7F219DF886E9CCB2ED1C4F52C818B5	904E98D16126B9AFED2F1D833243116FDCBF13FF	93477FDDC1FC5EEED4453F2D109E208292E1BDEC86FD1B8AE8865DFA1CC0696C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	D1DE78C1C24B0C6C9054562CFC65BA90	C696375E47F525497002B981725B7EAB33B3A7D9	F50AC4A6EEF9B4850273730CDB0043E98D0FC5326990395153A785FCDA3F5447
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	3A096440AF843C3F108F5B166504D0FA	96564967CC402A92C7AC7839A0B333C14296F9E9	F677584BBFFC56F9A31CC935F360F53096A24F6D989A090EB66D3733F7B202F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	AF697D47C58CBC288562914B1193E4BE	D2D5D1D9D77CE6EEF4A07353467CD1055F876464	B2761FDA9EA6304117A8B185FCAFC2901C58D2BB69D9FF7A7F9B497B1403382F
C:\Users\user\AppData\Local\Temp\MSI1ee1.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A924BACBA3D80B715D9DE5631CE4573E	3468BEF58A525F4426E7D066BAE0FD4B139A6F88	14A4329A42421ECEEA4FE93E801DA9CAE0D633A9F483C9D3BA0F2427012D7E00
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-16-04-349.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	C668B2EFF45955814EC8C110F0F3C5D8	561CD4F62BBC712AB08DE9F377364AF52AF72413	F70312443E2AEE0257D0033BBB230C8CBE6684AC3D3D40D927608E24B50EE51B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	890A66ACB288E881C70EBF129DE60707	4099F698D74FF1015ACC9D64DBBD7C236885312F	072489A87D0B3A5AC7BE9B0FE2A955EAB96103AC6F1250598FEF347E756AD013
C:\Users\user\AppData\Local\Temp\acrocef_low\45249dd0-3412-4200-96f4-bd6ccdb08dce.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\843e33f9-15d0-4e9a-a5f8-faf31a196f8c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\a5fceaf1-e9fc-4a42-8eed-63d6379fbbb4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\f0e749d6-797b-4428-9166-72f3bd251f4e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
Receivables Invoice 38126.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Receivables Invoice 38126.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Receivables Invoice 38126.pdf