Windows Analysis Report
Briefkopf YG Business.pdf

Overview

General Information

Sample name:	Briefkopf YG Business.pdf
Analysis ID:	1546140
MD5:	eb9b257ab180ee2bb68d738473d8f0f3
SHA1:	6c6d4e404698bb700a408677a9232ab1dddb4a66
SHA256:	46e69d437c09af59d573bd1ab4cefcd2c6ffcdab913fb33e50e7d411580f60ed
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 192.168.2.5:60816 -> 96.7.168.138:443
Source: global traffic	TCP traffic: 96.7.168.138:443 -> 192.168.2.5:60816

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 96.7.168.138 96.7.168.138

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.5:49717
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.5:60993

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60816
Source: unknown	Network traffic detected: HTTP traffic on port 60816 -> 443

Source: classification engine

Classification label: clean3.winPDF@14/29@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5408

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 09-59-01-750.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Briefkopf YG Business.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1640,i,10097200807821530073,9878019752465417983,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1640,i,10097200807821530073,9878019752465417983,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Briefkopf YG Business.pdf	Initial sample: PDF keyword /JS count = 0
Source: Briefkopf YG Business.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Briefkopf YG Business.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.7.168.138	unknown	United States		262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1546140
Product:	CloudBasic
Start time:	14:58:07
Start date:	31.10.2024
Sample:	Briefkopf YG Business.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	eb9b257ab180ee2bb68d738473d8f0f3
SHA1:	6c6d4e404698bb700a408677a9232ab1dddb4a66
SHA256:	46e69d437c09af59d573bd1ab4cefcd2c6ffcdab913fb33e50e7d411580f60ed
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	C18CCC58EBC80271DF60E7DC2CAC694D	A1DBDECE22D03F0E5415DDD885E68CB6CACF9DC2	13F42576DFDEDF2978538DE5363EC09994A1E314E2C27C0C23B70DC964A42225
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	C18CCC58EBC80271DF60E7DC2CAC694D	A1DBDECE22D03F0E5415DDD885E68CB6CACF9DC2	13F42576DFDEDF2978538DE5363EC09994A1E314E2C27C0C23B70DC964A42225
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	8B49CFA9789D5056B0237307201B21FB	80B66FB3210D8080FFA7F18BAEB62F688BD9B1F7	04D4E954494F51F946DE96BEBEB8904385E32A56A7FAF507D476A443DF8A369E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	8B49CFA9789D5056B0237307201B21FB	80B66FB3210D8080FFA7F18BAEB62F688BD9B1F7	04D4E954494F51F946DE96BEBEB8904385E32A56A7FAF507D476A443DF8A369E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0a41d476-36f3-478c-8f6c-0aebe40bbbeb.tmp	JSON data	FAA4468D866C25E0408558CB9DBB92A3	B73695A773AC22AAABF115CB35083E547E7608ED	8FA70BBBD3432DE96813F8093A3BCDD9F4B47E806F1983CB0D2D36D05D7BA729
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	FAA4468D866C25E0408558CB9DBB92A3	B73695A773AC22AAABF115CB35083E547E7608ED	8FA70BBBD3432DE96813F8093A3BCDD9F4B47E806F1983CB0D2D36D05D7BA729
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	4A7AA52ADCB24F979FD599C94E65E731	75AE76A74CDBCDB5034C6CD3FF0C99FEB7F69AB7	730FCEDDB285DAC8FBE93E48AC9DD06C32ADFD8D3CAF9277278D492F7212CB08
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	866D6D33ABA2A0703CD40DC0FE635ED3	75D26D1E3303026AC5722140587E5BF1E8493D7F	2EB368EF2B980A02420FBCE658F3D6ADE3733B428C1A02E55480344D3BEE62B8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	866D6D33ABA2A0703CD40DC0FE635ED3	75D26D1E3303026AC5722140587E5BF1E8493D7F	2EB368EF2B980A02420FBCE658F3D6ADE3733B428C1A02E55480344D3BEE62B8
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241031135903Z-156.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	F7F063A16DB2DDC587E4727D527AABC2	D211052EF96D725B091D6AEF68D85E7B8F7C0398	D029944D4193A4721412425D87F57C20D2B491923B909CB0BF8B17C058F2A2FF
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	35A862BEC2A1AEB12EC242724D3A5FFB	51D1C8FCF1F47F7D19EA52FEDA6D0167D3DFBD54	98210B33CFD337E30BD25A002F9DD8718140043111264A113FEEFA00058CF229
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	3E49513927532AF2B7F110079B9C75D0	433275E0E75B6177FD1BBDF39F4AFFE2C7C7EAE3	4D721D5042102E24382BE4CBCDDB22F20DD0CE0207ADDEA4C7B8B0355CF7EFCA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5408	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	3796AA8FFE26B2B6DFC084635A6DC1B2	790E5D65EF2D327D9633DFC8EE575B4D0CF4CB4F	725EF451FB4FD03CEA02A3A703F237EE345AA921E3F6E80042FCDC76FC58762B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	5A280BE4256C2AA7E2EC83B5E3A742BD	9C0A60E7D1658E3DC35CDEC90FCA0DCAC01F3285	73AABCAC8FFB814BBCF3DBC352B33C02C7C2931BA0F81AB222AD434DB6BA124C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	7F459A31D72BF69CD19E1E82CEBCE800	8A2F6E393EA15A824CE36BEAC8B46D1D55158E58	298C98AF08B885BFB9A9B12DF2CB04596EC1F04C0945DA6988C97405DF095749
C:\Users\user\AppData\Local\Temp\MSIf7cc.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	5B8DDD6DF78DB2E609B71FFA7DA4FBE4	799E42082B48AB82098825D2AE687BF9E6778533	F4548E7C28E1B20DCEDDD91B4CC867EE8A84D12876402AE60663948A646839F3
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 09-59-01-750.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	0064BA99593CBB3C580EF2A917E2E4F2	A549EF94F5497CF6214871C2CDC91D82BE47844D	A1D5737A27D3D6ADD95A01152030B5488F1F99153A8E87DE8B2E9FFFEDB3599B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	7730848CA39AAEAD8A7F84F6A3DCCD3C	0792756C59B4684376A16253EB8AF0E88E417DC8	48823C3C37B0C9E60BC694434AF77EED5F9D813CB3843D133DA7A2E06C654CB9
C:\Users\user\AppData\Local\Temp\acrocef_low\38d71874-ab04-4389-b1ae-0f999e3db7e6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\40450446-502c-4dae-aff6-18adaa6ca144.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\87626cf8-e120-4089-b9f7-719961725bdb.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\d5630bb1-0ee3-465b-9c06-381942c161d8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
Briefkopf YG Business.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Briefkopf YG Business.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Briefkopf YG Business.pdf