Windows Analysis Report
a63.pdf

Overview

General Information

Sample name:	a63.pdf
Analysis ID:	1467830
MD5:	e800cacb7da9706f7cbadecc954b0a10
SHA1:	58342023921cfa86088d234ba94230e805acfe94
SHA256:	13a80791ee707dca434fa10783c8adc4175c091adc6499c8cbc32db0d59a27f8
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.6:49723 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.6:49723

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 96.17.64.189 96.17.64.189

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189

Source: global traffic

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: a63.pdf	String found in binary or memory: https://www.dynaforms.com

Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: classification engine

Classification label: clean2.winPDF@14/47@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5924

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-04 15-01-16-013.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\a63.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,6273952302131609035,14343962952943444108,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,6273952302131609035,14343962952943444108,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: a63.pdf	Initial sample: PDF keyword /JS count = 0
Source: a63.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: a63.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.17.64.189	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1467830
Product:	CloudBasic
Start time:	21:00:23
Start date:	04.07.2024
Sample:	a63.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	e800cacb7da9706f7cbadecc954b0a10
SHA1:	58342023921cfa86088d234ba94230e805acfe94
SHA256:	13a80791ee707dca434fa10783c8adc4175c091adc6499c8cbc32db0d59a27f8
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	7CF986D70AAF93AAB22239692355D604	CCD8FE9289B0C07F81CA17836BE05A47478DEF3F	C29B8CC458CD56E09A83C584364E6239A54062AB269EEC98847A641A1DC73F80
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	7CF986D70AAF93AAB22239692355D604	CCD8FE9289B0C07F81CA17836BE05A47478DEF3F	C29B8CC458CD56E09A83C584364E6239A54062AB269EEC98847A641A1DC73F80
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	089718EA578F7DCFD34476C1F4FEC1BC	1BA9E2E92D6431EE9745B3C650CF5B2894E9245E	06383F077C58A12E2307E88CFA3130A93813A9D3077D59C236BB5205C991F288
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	089718EA578F7DCFD34476C1F4FEC1BC	1BA9E2E92D6431EE9745B3C650CF5B2894E9245E	06383F077C58A12E2307E88CFA3130A93813A9D3077D59C236BB5205C991F288
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\51c1e3ce-e1d8-4ed6-83e8-288964157c5a.tmp	JSON data	B0397CA1ECB8835E140B2EAE3B820334	020ECDD8CCCEF7622925DA49997E6C16717DB19D	A456CA2D38AF67560389E28EEEF6E1EFED89E37E76D1174AC52A2B727353C6B8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B0397CA1ECB8835E140B2EAE3B820334	020ECDD8CCCEF7622925DA49997E6C16717DB19D	A456CA2D38AF67560389E28EEEF6E1EFED89E37E76D1174AC52A2B727353C6B8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	E710C182795200EE174D4653DFE9514B	9967FC01FD6ADFE4A45B973D1F175A1DECF5043D	3964A8269D96E9BF3CADDF7D767B81E514CCC74ABBA899142131393AFC2C4C57
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	C19A2DD70E43FCDE540B3D77E531B9A5	B27F8F3953BB707B0933E0833268ABA8B774026D	D0B5E42A04DA6B7AE4A7911A7C2F5F671B5E0441F4828F195958B20769EBA506
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	C19A2DD70E43FCDE540B3D77E531B9A5	B27F8F3953BB707B0933E0833268ABA8B774026D	D0B5E42A04DA6B7AE4A7911A7C2F5F671B5E0441F4828F195958B20769EBA506
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240704190118Z-160.bmp	PC bitmap, Windows 3.x format, 119 x -152 x 32, cbSize 72406, bits offset 54	3077E0AD608B5D120A28634DC3890B8B	13B57A30AD0C726A3BA787A2250E14DF87D3BF18	0FC2D40E490DD2FA04909CA9840F24AEA668F86B1B99C6D81B65DC1DE9084F6F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	98143B3CBE02D31FF5328678A024B9F1	2D6E484D4FFB5FDBABFEB92A434B45DA3D43EBBE	8002EA1117FBF86BA0A6E4B49129804CEEF197951E72A238EF26A4AEFFE7BEDA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	BBE709346414FEAD27ABB1C22A0417D0	FACCBB9D55C02CC3F7858D6048BE67563E0DA773	C09E10154FC86999800D1E3CCD9859894E003B292D90B5F2BC2DD1628BF509E4
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	A4956F37D88E4C1DBC80614018D9A527	3F251D7EF62E370E1795193ABE5F1E140D86F716	9A38FB6412AB0F996F01F58830F99D687B3F9484D30F3BCD7172061380B5B08E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	A7A89D105D2687BFB8A5E30F3BDC3B60	8690383CF90FE73F2C9A9DA2615E14E82A4C569E	A77850151B9C649EC7F8D8980D0153333C79D3837E11CECB8EF10034170D6A6B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5924	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	5E0AA2DB488179ED77F9DB130422102F	FB06CC62FC7772736051D35BBE0784AFC209A34F	503F8C20B32FD26B33BEBA2CA83F2E327E31064EF204C0B19C33A073912891B6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	72EC08E1778E7192ECEF166C9822ACF1	18AE1B68E75DF9B2765F513C63B2659E7A13DEF5	38B00AF8F4628B3C1D0C0689D1D8E462E113F5E56515EFEF6153A374C14D8B68
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	C1453F3F9D77CFD76D96670BEEE0B17E	3A0B048788B6D0D94B16DE8BC4BA875A1743C217	A3BD190AF118F10B960B7DB788F0656CF897F35CB7E0CC30013876892928F054
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	DA63C4B0024D27D0EF7548738BFF6E49	B744DE8F98BA161EB5C92F5D24D132538F3C4D16	C1276F4A14451E12EA1789CD7F0FD4F2057D434011100AA3AEA5C9EF62C093EE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	130FA2113270DE180373F93CB140AC5A	B61CBCD952E8CB94F1D681FB82F58AA940E8E894	1031A42967C337223733170DA70DB89FE7B0658E3A864257E641ED1C26DBDC09
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	04C272443E559183CD4ED75D742484F4	3ABEC75AA940F76D4ACE3ABD9AF6F0D37369D036	CFFD755069A6501F7B92BDDE991817B51206468BE0AE0965720EA91556B769D1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	F0001FD6A46D2E81F605F15BE5BDBDB6	B3E540CED33609ABD1562C60F5127E97CF29B971	121C529C6CBC9E91524031DA06856B096F5292E4A9CB84D0540872EF6230CB47
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	220C69221DDEB5E8D5AD623AD8A8E13A	FCF566BCA91B137B79053C2AC16ED2D446BBACF6	AB1615984DBCFAD6EC19315ED8145AA74B5BDE07EC84AD1B727CBA9DD9EE6610
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	6B0E3B40B958B9D4AB5B94A73646362E	7133F6F0E9EA36737E7182C294DD571D375F9850	40A9BE9E648F41A28A30F1CFF68A8C9057F47DA8A7AD2385C2E26847475F04D8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	52C135D8B35FEABA6B82CC30BDD5CECA	BE1CEDBA8107403A71F1105ACC7592810766F5E8	C786034C91A3784146C84410F5C3ED3CBDAD14EC661EAD65ED7A50FF1B487C3D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	8E05DC6DA7F353B1A935F3EA53B1E7BD	0AA73323BCFB7313D674EB892F15FCC5C105331B	87FEB151624C7F01A3A7233C0F8F0511648D9B060995F6EC2BF2DA2D006AAD3A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	1750342B14AAB441286680DCD40B4DCE	EAC3F4271163B4013CEEFEC99E28BDCBD13FA969	C3F917CB9C0850E1955851A5D0F03860BF8CD565A250592698B5231C3FDFE847
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	073DFC53C99CB1C0FFC01967E3FF4EAF	7A7184F14EB72A25C4F348AE79CB8D1F0E9495EB	C63F52FDE3998EF88872DEF3CF615F4F466CA22B05F13D52E8003538873C719F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	8BEDC7E09342FFB641C750537BAEEC54	4631DD4B68F570D29A70EF4D4680AEF127E66FC8	363FD2CD20AF24AE4B1B6C3392CEDAD8C0EFE4C31C54D99052C50097B8DF10D4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	752372A58C8AA164BDEB6F515C2BF3D4	7EC0822015B65F48AD1A8A1C871D9D8D6BACA22F	5CDA2B4E4D2C2F9835CE9ACFE866893E36694804FC21B5B195A8A59A9BE6A63F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	5FDCDA54F540308F9E20A93010D1D9D9	47C60746493D766C665457775A87B8AC6C5A51F6	92E107FD45C50232D3B37EC3CB00E8E62D3A9C84498F6C43DB90B873B7C51731
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	B0341961B95D8000128BB9CEEDFCDC33	3862891CFD068AE2FCF5D408BBB295D5FA6BE2DC	1BFD35BB1708174A9177355A51FD50B8002739DB89FA5DC57C7460C32DDD1769
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	3AAAF06F5118D59FEF924BF71C2A22C5	33D1ADD2FF52DFEB10252F6E359610ABF770F40D	196680DFBBD832669570D0C11E2DD8EEAC8945DB59C56B958B450D99DB84DE89
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	F86BA04FB16C27EFB3917A07638425B3	668B06EC0C5D039675EDA13ED003FE28CCC74DAD	DEB87E561600A23495CD807B0EEEA30004AE2749AEEFF3BB138A77D7AC111E93
C:\Users\user\AppData\Local\Temp\MSIc427.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	E9601EF2AE3483DF2250179900683F89	3C6096A3017ECF42E7F6F909A90273BC8B6B4583	57B34BE61B1CE39A438620C375727CC8E093D6A22EB866CFC5FDB93C60B4C43D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-04 15-01-16-013.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	6AF245A07235470D5C734A64AB4AB42D	7AA1C9F06E92E0E6380ED4DAC29566B5271ABEF1	BA4065BE98484579D9747B736E9618526E8544D140AA3FA2818D5AB44044785A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	27B9F2D3BA4ACBFBFFE641BD00A983BC	B5D4A46683001AE2A7F04DAEC918C567E9CC0520	7E6CE30117CB98F7125CAE9469ED923173C157600763A1D23C3BA3F97321D722
C:\Users\user\AppData\Local\Temp\acrocef_low\0b3571d7-0f04-41f3-9916-71cebfa961cf.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\858bc593-a2b1-4b5f-9e8a-10b7661dd2d2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\bd64a074-8571-44bf-91e3-aa4131592720.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\f8df50ad-41a7-4cde-9bf5-0358a0739a35.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
a63.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report a63.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
a63.pdf