Windows Analysis Report
unity.pdf

Overview

General Information

Sample name:	unity.pdf
Analysis ID:	1467958
MD5:	cc4676ef08e8aecbe22b9232f27b2141
SHA1:	03bb3a2cb2c8a5cf7b93cf7c666c470144cfd724
SHA256:	48331ea4e205e07525f47149d19c8f78dba24ee63147a74f7d0a443008e4587d
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

PDF has an OpenAction (likely to launch a dropper script)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.4:49742

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.47.168.24 23.47.168.24

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24

Source: global traffic

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/47@0/1

Source: unity.pdf

Initial sample: mailto:trademarks@unity.com

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4080

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-05 00-48-19-930.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\unity.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,11792256941342271432,3541520970309768941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,11792256941342271432,3541520970309768941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: unity.pdf	Initial sample: PDF keyword /JS count = 0
Source: unity.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: unity.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

PDF has an OpenAction (likely to launch a dropper script)

Source: unity.pdf

Initial sample: PDF keyword /OpenAction

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true

ID:	1467958
Product:	CloudBasic
Start time:	06:47:17
Start date:	05.07.2024
Sample:	unity.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	cc4676ef08e8aecbe22b9232f27b2141
SHA1:	03bb3a2cb2c8a5cf7b93cf7c666c470144cfd724
SHA256:	48331ea4e205e07525f47149d19c8f78dba24ee63147a74f7d0a443008e4587d
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	E23269790D1F900BC613CD45AC4EFC33	B8B0DDCA9F1B18639860246289E6BFCAF6F9CE78	6D9DADE853E422F878FFD875D0CFE80D08B79D2E86EFE9D420BE3B90CAA847D5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	E23269790D1F900BC613CD45AC4EFC33	B8B0DDCA9F1B18639860246289E6BFCAF6F9CE78	6D9DADE853E422F878FFD875D0CFE80D08B79D2E86EFE9D420BE3B90CAA847D5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	06C31562257D49386BB9868A76C6A48F	C4FBD374229B563E3760A3F82D9BFEDBCFAD4EDD	E12D2D1EEEA390122ADECD8EB11F8A96551E0C443F07F6116D8D9568EEBE87A6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	06C31562257D49386BB9868A76C6A48F	C4FBD374229B563E3760A3F82D9BFEDBCFAD4EDD	E12D2D1EEEA390122ADECD8EB11F8A96551E0C443F07F6116D8D9568EEBE87A6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	48871E9D909CE1B0DFD6E84B3BBAC287	FC7FCC4ED469A183D00C5870F9C3A06582A9C6B6	9AAA39371E870FAA27A0BE357CF0C765A6D5E35BA0635481093C1988B80010BC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fa98b2a6-1c3a-4f7d-bef1-474939b73aaa.tmp	JSON data	48871E9D909CE1B0DFD6E84B3BBAC287	FC7FCC4ED469A183D00C5870F9C3A06582A9C6B6	9AAA39371E870FAA27A0BE357CF0C765A6D5E35BA0635481093C1988B80010BC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	4820CBA09471B1C8AFC76770F95CB6AD	6743EDB50893958A7BCFDFB50F2CF852B9F47C31	308C495627B7814FC0EDCA7C626CEBB9EF7896557A4F5753CEACDFC48EB05549
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	187F2B003D9097E23F386A7F9EE0422C	47F7DE1ABBF205D803416F3CCD7015685C61FFF5	431FE9DE5CC289A41E9987C334DDB75D16818650E8C7C40551D5925411C7A55A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	187F2B003D9097E23F386A7F9EE0422C	47F7DE1ABBF205D803416F3CCD7015685C61FFF5	431FE9DE5CC289A41E9987C334DDB75D16818650E8C7C40551D5925411C7A55A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240705044821Z-159.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	0B0EAE0EC1A466A174F322A5234DD11D	BC42F4CBACC802EACB2396D11E1BFEFBFDBA873B	5BA23A6A335CA6656D8F6E4EA765842012BAE0509DC1EF96D851AB3B21E19B93
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	E2CD7E7D21F5F84101E24FCCC6E3959F	AAD4220B3D1162679B699C5B04221D5BCCF1895A	CDAF6599750F1E1D1ADA4CB076FE13840926CFA34BB1242D11D83091ABFB0455
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	80D984215D04B03BF800362796320691	3111C9149A59313945CB580142403B6135F921C2	951017989BC201DD275033B45359A453FC17FC0DB790F2CE7290324FEE630853
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	E3D8E908007899B6CA38E942864CCE86	0306752D17AEAA73132C2DA3AC9B7D4BDB531C29	5407AF8548847BD79771708AA63815242A366E69174DA02C26FC33B316BAF6BE
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	67F69FE02A06F298CC5178FAF067C316	FFD217AAF3894530EEA1DF47015B933F5F4536B5	56901C945B21DB272A8F6DB8232C12AAB10C107A6BA6F7E630F54D3A0449326F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4080	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F7B75939ED43CD13BC5FA5A7E72C9C16	2FB9185CFEB8001598A301C83ECA9948420007ED	2D50A4E5C21D7154373C0DF9DAF523FF54E48551510828BDD08D0E3B24125055
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	710999C6FB08C713D9F4515AE539B663	FC875769554BF478E4889B77FFDB63FE0D7212A7	E598A1B1586A0BC633E680A056909E8C7049D4D0A5505CFBE733676DAEE57AC8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	4939BD4ACB499B90284930D54B09A4E6	39ED7F920C0F32D5A4ADD8024F3051281FFD3E92	C17F9C42E3CEE7046DFFF7C16188117CDA86CB345BB9E978774704731E62DE12
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	E22EBB46CADEDC62FC948B8598A3198A	CE4F2D6E488D16D5B2E12F2C52770BE477D0D13D	6ED3AFE83F67EE33463975CAB1E12AF21B3919C63A198EC425FB1FB240B0A6FE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	8831A96EE7800A4A18A0E42463374065	FB467E6BB50792FEFE666A86484ACD6A2AA2FBFE	636A8F5C0A873B8399E85361E2C558F4507FC67E6F792FC461A1CD50A56B2C5D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	B7531D136134843D9631D81D14B4A290	0B7F707F3A929C9F581972F93D28259BB8089121	933D26FA8F24DF69D867F995935DAEA6DAF2284735ADF6289B28DC4ACDC73EC0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	F6AF54D2510B43B80F448F54D6546125	0ADEEC2B2ED19A18F71E3897F80DED990BEAFF4E	0D3DA9C13674373E86C1F54440834BCBC7F3E19AD57B4F585E7F9A40154A3834
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	608A445F38C268ADD0BE7198A40F82ED	A6B73FAF6DFFD5D9A811B5EB02421E68EF4DF927	06228E50D3002A6838F958F17C50854CA21939569FA162B1A367ED6414437FB9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	E31618089D5E5FADEE34B7851D350795	3438B2F58AFC37DB37D11003716F0F3C49B9BD33	C30C46064F443E3193AD1EB12C17824023D10989C41F62C8A89D6B71A8B6A31F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	25F0AE8E95D91957CEEADE34A6C3BFE5	3D8416D10A397C3F9FFC4F1BF6BC1E47CE297107	E48749F78C9A044E4D849BB9989A592F3155E4D3686C78F17417054C7B90CB56
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	7149EC6D6BA5666AEF399D26E3D07BAB	A8C78866B124860DECBEE5A507D3EEAD3E95BEF9	F1A614295481A0A4D184362F011845515ADFF8F8AD961721824992C32AEAEC54
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	EABA9BF78B4B71AD2DE148D9781E203D	ADE9E9E48E9C51E9BF348C6F3AC0E5826A39519C	74131FCAA8B34B0304290AE584AD8A41A1204999302DB37C5DCCA00F9225DD01
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	355440ABDB4B28A3290D1DF9C061BEB4	700FFEFF7F1159324894DED6DC260052112351E7	1FF0D5A372822C8AA5CFCE7EAFE01B0B7815D856DBE9430FB834F92FE1CD7166
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	6DEFAD47A540CC712B1DE8A27734D756	36AB72721A431478C06BA2816347C9F9B1B2AB05	539C099A3018BFD902D97611415D0AD8EFB9F031D133A67D93D86C04E2ECCF53
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	79FFDC9C632A8BA8B06A0AE77EF71924	1C381D6055F9314BA0FD596E9DC91E7399770560	27D828703BB000D64A6C4E496AEB3EA2EA13FC98D582E1BADD073C4FFD19B382
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	9ABF6B94275E448CF26F75C4895E2C77	D114E8EEB461507466C874872023F357BC6D7B5E	F4DA5FF6A2B5A26A2E7D47C8A064934AB1994102BE9A378CA1B9C0A5DF0B1932
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	EBCFBE9013510A72101E0959137D9183	CF25F89B8AAE0577792FE82F0DD573C89D9DCE30	A527CA1EEE43FE17E1DB24476DD2D248B38D33D0583E4377B912AD8D26746B3F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	0A3AF5B0285F558A09C18D41AD73E60C	CE7516F7247665A79D1D2D41CAFB2CE596D76567	3F14C5B6EA66C001D73FAA29413C2D6D815493CBE88AA9D60D1CD4748C215082
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	760E2663EF873A4FE5857D44920C414B	896B916E18958325DF4255945AC7ADE9A30E3D18	2B8F0FD15E3ED6E9410780C0C14D95C76B9DF0CB3A5461AB07F0386CB6A52607
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	AE5979D3C018185B3AA61D7055EABA51	02C6C499B37387623EB1F573E73DBFAF48EC055A	EE5BA41AC461125026A9B02F9CEF737D1F8CCA1DF069F2657DF9416B4697F12D
C:\Users\user\AppData\Local\Temp\MSIbb73f.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	2B99461A31C2369764DD45DEF055DAA1	5BF87CDDE5EE32BF237BC0B406642D685AC5A88D	F45CDDB1F800F0FE7F08A8351B00EECAAD0091C26085F5E57DFEC7617B59F5BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-05 00-48-19-930.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	E968B2E03A1E85AFFC8052A4C04153C8	4078F9D7FB507FEA9426851560032AA11F40C0FE	CD53DB603A075F317DD195DED13DA721B1B8E4E9080DAA87946487A5D7CA17F0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	FA78D1D2953E8D4C0C7802F72C6BD3FC	FCB709740758C463970FB5BEA7F1E321A58558CC	1A24FB2A65BA66224022079B7F6A92DE0C1234C44AA0D228E0D591FDF7C80E6B
C:\Users\user\AppData\Local\Temp\acrocef_low\14be27ed-ae7e-4a10-9957-f1b916d0c711.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	13F55292D0735B9ABD4259B225D210FC	810CC5D545BFA11D2825F6E1DFA69176794DA7EC	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
C:\Users\user\AppData\Local\Temp\acrocef_low\9004f0a6-50e4-40c7-bfb6-d1e76a1e7612.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\9aa22250-35b0-42be-92c7-67bedf2f46a7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\c644945e-9c28-41ce-a4d1-61647ac295e2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
unity.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report unity.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
unity.pdf