Edit tour

Windows Analysis Report
jO7FHDAZ6f.pdf

Overview

General Information

Sample name:	jO7FHDAZ6f.pdf renamed because original name is a hash value
Original sample name:	00000a7b9b21e8e7ab8754e3023a06dd5d4df63da61a01c0f2da9ebc4ed42842.pdf
Analysis ID:	1558529
MD5:	44929fe50c9bd744987b6a84d88187a1
SHA1:	17988aa3d64d53bc844b122e6afc464161feb6d6
SHA256:	00000a7b9b21e8e7ab8754e3023a06dd5d4df63da61a01c0f2da9ebc4ed42842
Infos:

Errors Corrupt sample or wrongly selected analyzer.

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found potential malicious PDF (bad image similarity)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

IP address seen in connection with other malware

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Classification

Process Tree

System is w7x64

AcroRd32.exe (PID: 3256 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\jO7FHDAZ6f.pdf" MD5: 2F8D93826B8CBF9290BC57535C7A6817)

RdrCEF.exe (PID: 3432 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 326A645391A97C760B60C558A35BB068)

chrome.exe (PID: 1056 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "https://ttraff.me/123?keyword=super+cleaner+2020+apkpure" MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1448 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1232,i,4480364503558093569,10111975475138914287,131072 /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

cleanup

Sigma Signatures

System Summary

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe, ProcessId: 3256, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: jO7FHDAZ6f.pdf

Avira: detected

Multi AV Scanner detection for submitted file

Source: jO7FHDAZ6f.pdf

ReversingLabs: Detection: 51%

Machine Learning detection for sample

Source: jO7FHDAZ6f.pdf

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google			Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater			Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Directory queried: number of queries: 1010

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: global traffic	DNS traffic detected: DNS query: ttraff.me
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: support.google.com

Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://cdn.shopify.com/s/files/1/0268/7326/6352/files/police_incident_report_form.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://cdn.shopify.com/s/files/1/0433/6916/9054/files/dka_treatment_guidelines_2020_ada.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://cdn.shopify.com/s/files/1/0435/3284/5207/files/future_where_ya_from_mp3_download.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/fasanag/1663838111.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/felasorarabipis/logical_connectors_exercises_with_answers.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/henghuili-files/balanced_scorecard_conceito.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/henghuili-files2/97513405289.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/kavitokolezub/arquitectura_moderna_en_latinoamerica.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/memul/tojixedunurajilekan.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/subud/jokupuratifupawelipika.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/wonoti/23152353687.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/xanebavifamopez/73340951774.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/zetare/labofadokilex.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/zirojopemup/20186772622.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://s3.amazonaws.com/zuxadol/11614902076.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://ttraff.me/123?keyword=super
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://uploads.strikinglycdn.com/files/470d0046-f4a5-472a-9023-dd88432b3562/66520943261.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://uploads.strikinglycdn.com/files/5927a431-c229-45bd-aa11-512bbc638af8/xapuzimesuzu.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://uploads.strikinglycdn.com/files/6f5b1d1f-68f9-416a-b7b0-776b388baa9b/faxepowodudalufikazokif
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://uploads.strikinglycdn.com/files/771e1098-d86e-4cb0-ac24-bb2ed5a39624/jinevukuxigutulex.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://uploads.strikinglycdn.com/files/8a7f9763-a774-47ca-b392-ad9ca644292f/costco_pre_cooked_ribs.
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://uploads.strikinglycdn.com/files/ab6886ab-e467-4b1a-97df-74f1a5bcf0cd/87554276710.pdf)
Source: jO7FHDAZ6f.pdf	String found in binary or memory: https://uploads.strikinglycdn.com/files/c1b9c567-1954-4131-85ca-85ab9fe81445/56063045491.pdf)

Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

System Summary

Found potential malicious PDF (bad image similarity)

Source: jO7FHDAZ6f.pdf

Static PDF information: Image stream: 7

Source: classification engine

Classification label: mal68.winPDF@29/9@6/5

Source: jO7FHDAZ6f.pdf	Initial sample: https://ttraff.me/123?keyword=super+cleaner+2020+apkpure
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/kavitokolezub/arquitectura_moderna_en_latinoamerica.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://cdn.shopify.com/s/files/1/0268/7326/6352/files/police_incident_report_form.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/wonoti/23152353687.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/zirojopemup/20186772622.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/henghuili-files/balanced_scorecard_conceito.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/henghuili-files2/97513405289.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://uploads.strikinglycdn.com/files/5927a431-c229-45bd-aa11-512bbc638af8/xapuzimesuzu.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/xanebavifamopez/73340951774.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/zetare/labofadokilex.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/felasorarabipis/logical_connectors_exercises_with_answers.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://uploads.strikinglycdn.com/files/470d0046-f4a5-472a-9023-dd88432b3562/66520943261.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://uploads.strikinglycdn.com/files/c1b9c567-1954-4131-85ca-85ab9fe81445/56063045491.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://uploads.strikinglycdn.com/files/ab6886ab-e467-4b1a-97df-74f1a5bcf0cd/87554276710.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://uploads.strikinglycdn.com/files/8a7f9763-a774-47ca-b392-ad9ca644292f/costco_pre_cooked_ribs.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://cdn.shopify.com/s/files/1/0433/6916/9054/files/dka_treatment_guidelines_2020_ada.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://uploads.strikinglycdn.com/files/771e1098-d86e-4cb0-ac24-bb2ed5a39624/jinevukuxigutulex.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/fasanag/1663838111.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://cdn.shopify.com/s/files/1/0435/3284/5207/files/future_where_ya_from_mp3_download.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/subud/jokupuratifupawelipika.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://uploads.strikinglycdn.com/files/6f5b1d1f-68f9-416a-b7b0-776b388baa9b/faxepowodudalufikazokifiz.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/memul/tojixedunurajilekan.pdf
Source: jO7FHDAZ6f.pdf	Initial sample: https://s3.amazonaws.com/zuxadol/11614902076.pdf

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx

Jump to behavior

Source: jO7FHDAZ6f.pdf

ReversingLabs: Detection: 51%

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\jO7FHDAZ6f.pdf"
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "https://ttraff.me/123?keyword=super+cleaner+2020+apkpure"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1232,i,4480364503558093569,10111975475138914287,131072 /prefetch:8
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1232,i,4480364503558093569,10111975475138914287,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google			Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater			Jump to behavior

Source: jO7FHDAZ6f.pdf	Initial sample: PDF keyword /JS count = 0
Source: jO7FHDAZ6f.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: jO7FHDAZ6f.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: jO7FHDAZ6f.pdf

Initial sample: PDF keyword obj count = 59

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Directory queried: number of queries: 1010

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
jO7FHDAZ6f.pdf	51%	ReversingLabs	Document-PDF.Phishing.PhishingX
jO7FHDAZ6f.pdf	100%	Avira	HTML/Malicious.PDF.Gen
jO7FHDAZ6f.pdf	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://s3.amazonaws.com/fasanag/1663838111.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/zirojopemup/20186772622.pdf)	0%	Avira URL Cloud	safe
https://ttraff.me/123?keyword=super	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/kavitokolezub/arquitectura_moderna_en_latinoamerica.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/henghuili-files2/97513405289.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/zetare/labofadokilex.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/zuxadol/11614902076.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/subud/jokupuratifupawelipika.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/memul/tojixedunurajilekan.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/henghuili-files/balanced_scorecard_conceito.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/felasorarabipis/logical_connectors_exercises_with_answers.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/wonoti/23152353687.pdf)	0%	Avira URL Cloud	safe
https://s3.amazonaws.com/xanebavifamopez/73340951774.pdf)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ttraff.me	172.232.4.213	true	false	unknown
www.google.com	142.250.186.100	true	false	high
support.google.com	142.250.186.110	true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://s3.amazonaws.com/zirojopemup/20186772622.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://cdn.shopify.com/s/files/1/0435/3284/5207/files/future_where_ya_from_mp3_download.pdf)	jO7FHDAZ6f.pdf	false		high
https://s3.amazonaws.com/henghuili-files2/97513405289.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://ttraff.me/123?keyword=super	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://uploads.strikinglycdn.com/files/771e1098-d86e-4cb0-ac24-bb2ed5a39624/jinevukuxigutulex.pdf)	jO7FHDAZ6f.pdf	false		high
https://cdn.shopify.com/s/files/1/0268/7326/6352/files/police_incident_report_form.pdf)	jO7FHDAZ6f.pdf	false		high
https://s3.amazonaws.com/kavitokolezub/arquitectura_moderna_en_latinoamerica.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://uploads.strikinglycdn.com/files/8a7f9763-a774-47ca-b392-ad9ca644292f/costco_pre_cooked_ribs.	jO7FHDAZ6f.pdf	false		high
https://s3.amazonaws.com/zetare/labofadokilex.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://uploads.strikinglycdn.com/files/ab6886ab-e467-4b1a-97df-74f1a5bcf0cd/87554276710.pdf)	jO7FHDAZ6f.pdf	false		high
https://uploads.strikinglycdn.com/files/5927a431-c229-45bd-aa11-512bbc638af8/xapuzimesuzu.pdf)	jO7FHDAZ6f.pdf	false		high
https://s3.amazonaws.com/fasanag/1663838111.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://uploads.strikinglycdn.com/files/6f5b1d1f-68f9-416a-b7b0-776b388baa9b/faxepowodudalufikazokif	jO7FHDAZ6f.pdf	false		high
https://s3.amazonaws.com/henghuili-files/balanced_scorecard_conceito.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/zuxadol/11614902076.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/memul/tojixedunurajilekan.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/subud/jokupuratifupawelipika.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/felasorarabipis/logical_connectors_exercises_with_answers.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/xanebavifamopez/73340951774.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://s3.amazonaws.com/wonoti/23152353687.pdf)	jO7FHDAZ6f.pdf	false	Avira URL Cloud: safe	unknown
https://uploads.strikinglycdn.com/files/470d0046-f4a5-472a-9023-dd88432b3562/66520943261.pdf)	jO7FHDAZ6f.pdf	false		high
https://uploads.strikinglycdn.com/files/c1b9c567-1954-4131-85ca-85ab9fe81445/56063045491.pdf)	jO7FHDAZ6f.pdf	false		high
https://cdn.shopify.com/s/files/1/0433/6916/9054/files/dka_treatment_guidelines_2020_ada.pdf)	jO7FHDAZ6f.pdf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.232.4.213	ttraff.me	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.110	support.google.com	United States	15169	GOOGLEUS	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.255

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558529
Start date and time:	2024-11-19 14:53:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jO7FHDAZ6f.pdf renamed because original name is a hash value
Original Sample Name:	00000a7b9b21e8e7ab8754e3023a06dd5d4df63da61a01c0f2da9ebc4ed42842.pdf
Detection:	MAL
Classification:	mal68.winPDF@29/9@6/5
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document URL browsing timeout or error Close Viewer

Errors

Corrupt sample or wrongly selected analyzer.

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, vga.dll, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 2.20.232.204, 96.16.122.53, 96.16.122.55, 96.16.122.48, 96.16.122.51, 96.16.122.54, 96.16.122.57, 96.16.122.50, 96.16.122.56, 96.16.122.46, 184.25.51.83, 184.25.51.66, 184.30.20.134, 142.250.185.99, 142.250.185.110, 142.250.27.84, 142.250.186.170, 142.250.185.106, 216.58.206.74, 142.250.186.138, 142.250.185.138, 216.58.212.138, 142.250.184.234, 172.217.18.10, 142.250.184.202, 142.250.186.106, 172.217.23.106, 172.217.16.202, 142.250.185.170, 216.58.212.170, 142.250.185.202, 142.250.185.74, 142.250.186.99, 172.217.18.3, 142.250.185.163, 142.250.186.78
Excluded domains from analysis (whitelisted): accounts.google.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, clientservices.googleapis.com, acroipm2.adobe.com, ssl.adobe.com.edgekey.net, clients2.google.com, armmf.adobe.com, a122.dscd.akamai.net, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
VT rate limit hit for: jO7FHDAZ6f.pdf

Simulations

Behavior and APIs

Time	Type	Description
08:54:05	API Interceptor	222x Sleep call for process: AcroRd32.exe modified
08:54:12	API Interceptor	62x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://www-airport-lk.mail-gov.org/8e8f2a7a/doc.rtf	Get hash	malicious	Unknown	Browse
	https://www.google.ru/url?q=sf_rand_string_uppercase(33)uQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%C2%A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%6E%77%2E%71%76%6F%70%69%6F%31%2E%7A%61%2E%63%6F%6D%2F%66%6C%6F%65%2F%6B%69%6D%6D%2F%70%65%64%64%2Fsf_rand_string_mixed(24)/smigelskis@alpenacounty.org	Get hash	malicious	Unknown	Browse
	eek call.eml	Get hash	malicious	Unknown	Browse
	Review_&_Aprove_Your_Next_Payment76770.html	Get hash	malicious	Unknown	Browse
	https://uxfol.io/p/7d34b6df/0299cc7b	Get hash	malicious	Unknown	Browse
	https://accounts.isdinproviders.com/document/pXfhPTQ4e	Get hash	malicious	Unknown	Browse
	http://www.amartha.kotakwarna.co.id	Get hash	malicious	Unknown	Browse
	https://uxfol.io/p/7d34b6df/0299cc7b	Get hash	malicious	Unknown	Browse
	https://dorentop.es/yorii/Odrivex/	Get hash	malicious	Unknown	Browse
	https://gees.z13.web.core.windows.net/	Get hash	malicious	Unknown	Browse
172.232.4.213	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	messiahfitness.org/
172.232.4.213	ILTgEaPqmE.exe	Get hash	malicious	Unknown	Browse	englishboard.net/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	SP3IUr6MfJ.exe	Get hash	malicious	AsyncRAT	Browse	172.233.187.199
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.206.195.168
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.214
	https://website-70396.convertflowpages.com/firstmarkinsurance	Get hash	malicious	HTMLPhisher	Browse	172.233.61.221
	owari.sh4.elf	Get hash	malicious	Unknown	Browse	172.232.16.214
	owari.mpsl.elf	Get hash	malicious	Unknown	Browse	104.85.26.118
	owari.ppc.elf	Get hash	malicious	Unknown	Browse	172.237.240.232
	Portfolio Review _2024.html	Get hash	malicious	Unknown	Browse	2.19.97.184
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	23.222.241.146
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.215

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018811398465979306
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEfqvgu/:/M/xT02zhl/
MD5:	222E5D8EC1F8FD543C5B3F328752A996
SHA1:	90DE6F0F2A8E115926C4EA14C2F3AC1DB07958FC
SHA-256:	13A0E61B76D21FEA42C20F581E2DC5E6266A2DC0E7C101AB86C385398DFBC022
SHA-512:	9C068091DEAD9A1AB5E1066AAA85C42F38DA483D43172166B3F3E9BA8E21C6FC451E65F51FB5D3165460F649452BB67DB89FDD32DACD52872248085D55B6D280
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.252368157078351
Encrypted:	false
SSDEEP:	6:HU9hpIq2PP2nKuAl9OmbnIFUt8YU99FZZmw+YU9qC7kwOP2nKuAl9OmbjLJ:+IvWHAahFUt81/+v757HAaSJ
MD5:	1815A9196671A53DBD88DAC2DE238681
SHA1:	F9C0F3093E31A19B6907467317127C574CB610FB
SHA-256:	237B903DE9AC457C0E0762E4B3B914626F2E894BA08DCF387DB26CCA994F9C4F
SHA-512:	1AD6FFB398EAE69311D551A7F5D24E5737C0AC063A2F68E839FA8E787C23FA4B7A9F0A70E6222AB4647417BA8451F8C5316A6BBEA023A3812086BDBB739E29A0
Malicious:	false
Reputation:	low
Preview:	2024/11/19-08:54:14.477 3520 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-08:54:14.482 3520 Recovering log #3.2024/11/19-08:54:14.486 3520 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.252368157078351
Encrypted:	false
SSDEEP:	6:HU9hpIq2PP2nKuAl9OmbnIFUt8YU99FZZmw+YU9qC7kwOP2nKuAl9OmbjLJ:+IvWHAahFUt81/+v757HAaSJ
MD5:	1815A9196671A53DBD88DAC2DE238681
SHA1:	F9C0F3093E31A19B6907467317127C574CB610FB
SHA-256:	237B903DE9AC457C0E0762E4B3B914626F2E894BA08DCF387DB26CCA994F9C4F
SHA-512:	1AD6FFB398EAE69311D551A7F5D24E5737C0AC063A2F68E839FA8E787C23FA4B7A9F0A70E6222AB4647417BA8451F8C5316A6BBEA023A3812086BDBB739E29A0
Malicious:	false
Reputation:	low
Preview:	2024/11/19-08:54:14.477 3520 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-08:54:14.482 3520 Recovering log #3.2024/11/19-08:54:14.486 3520 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF662d96.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.252368157078351
Encrypted:	false
SSDEEP:	6:HU9hpIq2PP2nKuAl9OmbnIFUt8YU99FZZmw+YU9qC7kwOP2nKuAl9OmbjLJ:+IvWHAahFUt81/+v757HAaSJ
MD5:	1815A9196671A53DBD88DAC2DE238681
SHA1:	F9C0F3093E31A19B6907467317127C574CB610FB
SHA-256:	237B903DE9AC457C0E0762E4B3B914626F2E894BA08DCF387DB26CCA994F9C4F
SHA-512:	1AD6FFB398EAE69311D551A7F5D24E5737C0AC063A2F68E839FA8E787C23FA4B7A9F0A70E6222AB4647417BA8451F8C5316A6BBEA023A3812086BDBB739E29A0
Malicious:	false
Reputation:	low
Preview:	2024/11/19-08:54:14.477 3520 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-08:54:14.482 3520 Recovering log #3.2024/11/19-08:54:14.486 3520 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.007818402565218801
Encrypted:	false
SSDEEP:	3:ImtV+7M1xVlt/XSxdlt4dV1gt/lop:IiV+gxlKxdX4m1lo
MD5:	99A1861B153254A6F8FE2AF60FFEEF36
SHA1:	ACB2F19C7CBBC53A52177D5584DBA5B5DFBE6451
SHA-256:	2C39CAF92A3108E56ECB3A7D099F91B854519E6E846B6F19363E389A31794BF4
SHA-512:	B7A3A1206A7B35425190D2D1C0973CA54712E22E247B5AB35CCDC314564E39E487C10950BD9A3858CC229691B43B15E948B7D7B152B105BB5A0F4EBDD093D9C5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	VLnk.....?......LhXJ ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119135412Z-178.bmp

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.1899168454576614
Encrypted:	false
SSDEEP:	12:ptMthyxMM5qq5tILYAL8Elc/0FLVIJNQ+SA411uXUUd84BxhNk:DMthgnB5tRAL8EXhVIJm+S9/ukUdl6
MD5:	897DE8453824584C93E41BF43824A2B1
SHA1:	869665E53AAC2AAD037CE25C712B91047338C760
SHA-256:	A828D2E01E835F24A0C380711E38762D49B092ACD15C1B866E62990122F32EC5
SHA-512:	40A0CA612EE77B94646A35539928197A3C85DE7602BA54EDF55E9B05C66FAB21EC7A40C906D1C42763716997A4E0649E784318B74EAA8E0B9DD91AF852F576E6
Malicious:	false
Reputation:	low
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 14, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.575679203791139
Encrypted:	false
SSDEEP:	384:Xeh9dThKtELJ8DAcLKuZsLRGlKhsvXh+vSc:DAeZsLQhUSc
MD5:	0578F888DE89FBA4B4DB72A40AB9BCC7
SHA1:	D30D4E117B5EEF560F897877F631E5504A579849
SHA-256:	EAB57D0AE2A228ACE2FD2B01EF52ADC67AD40396F97B03E981BED3841A0A9FD7
SHA-512:	7180EDA1E509B8B586D5DFE9516B7B9117BC65D979987CD805638B74A28048223A3334211ED038267B3664048F0008FE97E40C0B2F0978FA24137866827056BF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.3088002767346287
Encrypted:	false
SSDEEP:	48:7MT2iomVmBsmom1CZiomCBszom1Nom1Aiom1RROiom1Com1pom1kiomVPiomgtqq:7NCm6rZf6uhICPtt49IVXEBodRBkY
MD5:	57D070D566D0BCF260E3474839FE9F6B
SHA1:	220D62D367FC302A44DB955C2E827AB473F7133C
SHA-256:	460165F107DE8DCE8D4639C03FCF791CA37FFBF69793CFEAE0466459C7FC6C23
SHA-512:	CC9109819E04C9D3C6F46B7861BB0595A4624F6BBFC8DCF601642EC92B8F6C8227816AE6DA227C0A835FDA0B5815300DB2CEC683529C3FA09FEE4FE054ACF99E
Malicious:	false
Preview:	.... .c.....7.Qu..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W....X.W.L...y.......~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	72643
Entropy (8bit):	5.393779678652009
Encrypted:	false
SSDEEP:	768:PCbTjMYOpdyVFWqnPvBRSiRkTIVzY3iUjWsDKXUrhIYyu:AlOpdyVFWcPvBBRkTIdY3b6UeK
MD5:	566FBD8C8CFF42236CACCE7CD9D0873D
SHA1:	E30A818529B8A951E686FECF21436D08E07E7BC6
SHA-256:	739DD58FA3BB2950B08D1C655E2506B6DBFB211FC90FE77CA63FC31564F475BA
SHA-512:	498D72BE83AAE3291F4A4684DE03426DE377E21BE002AA3F1F85E284DBF4B4EEB2CE7EC96E5257FF3230E53DA9D3DF92A10167C7FD865AE7AB2E4156436D2B90
Malicious:	false
Preview:	4.458.88.FID.2:o:........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.94.FID.2:o:........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.82.FID.2:o:........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.85.FID.2:o:........:F:Aparajita.P:Aparajita.L:&.........................."F:Aparajita.#.99.FID.2:o:........:F:Aparajita-Italic.P:Aparajita Italic.L:&.........................."F:Aparajita.#.95.FID.2:o:........:F:Aparajita-Bold.P:Aparajita Bold.L:&.........................."F:Aparajita.#.108.FID.2:o:........:F:Aparajita-BoldItalic.P:Aparajita Bold Italic.L:&.........................."F:Aparajita.#.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$....

Static File Info

General

File type:	PDF document, version 1.4, 0 pages
Entropy (8bit):	7.623595343186488
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	jO7FHDAZ6f.pdf
File size:	43'880 bytes
MD5:	44929fe50c9bd744987b6a84d88187a1
SHA1:	17988aa3d64d53bc844b122e6afc464161feb6d6
SHA256:	00000a7b9b21e8e7ab8754e3023a06dd5d4df63da61a01c0f2da9ebc4ed42842
SHA512:	3ca85b04edb2edcdb53565b6bfe2f182a73bbdaf07da3ffe05c527bcd87449b97a9e07cc4ab6d32d0522e7b10019d5b1a66512abc0cab7be1d9ddf4e88e1b6db
SSDEEP:	768:9gGzpDNpiGCRHHS988EfH+NLsFjGYeK+V+hhWtQM+gpLR6+W+q1XDu:+GFBpiBHr9H+WtGYbq+LUQM+OR6j1XDu
TLSH:	F0138D7EF84C1C9CE6D3C786D976BCAD912F73265ACD34C124B48B03B825865A7062E7
File Content Preview:	%PDF-1.4.1 0 obj.<<./Title (...S.u.p.e.r. .c.l.e.a.n.e.r. .2.0.2.0. .a.p.k.p.u.r.e)./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...5)./Producer (...Q.t. .4...8...7)./CreationDate (D:20201021140259+03'00').>>.endobj.3 0 obj.<<./Type /ExtGState./SA true./SM

File Icon


Icon Hash:	62ceacaeb29e8aa0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.623595
Total Bytes:	43880
Stream Entropy:	7.947211
Stream Bytes:	32600
Entropy outside Streams:	5.217424
Bytes outside Streams:	11280
Number of EOF found:	2
Bytes after EOF:

Keywords Statistics

Name	Count
obj	59
endobj	59
stream	8
endstream	8
xref	2
trailer	2
startxref	2
/Page	2
/Encrypt	0
/ObjStm	0
/URI	46
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
7	83c4748d4c708c80	5ae18d2a4e3a5934a3d42908fa095ea3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:54:34.573930979 CET	49168	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:54:34.573983908 CET	443	49168	172.232.4.213	192.168.2.22
Nov 19, 2024 14:54:34.574042082 CET	49168	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:54:34.574589014 CET	49169	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:54:34.574626923 CET	443	49169	172.232.4.213	192.168.2.22
Nov 19, 2024 14:54:34.574672937 CET	49169	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:54:34.574990988 CET	49168	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:54:34.575007915 CET	443	49168	172.232.4.213	192.168.2.22
Nov 19, 2024 14:54:34.575172901 CET	49169	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:54:34.575191975 CET	443	49169	172.232.4.213	192.168.2.22
Nov 19, 2024 14:54:38.929389000 CET	49171	443	192.168.2.22	142.250.186.100
Nov 19, 2024 14:54:38.929440975 CET	443	49171	142.250.186.100	192.168.2.22
Nov 19, 2024 14:54:38.929507017 CET	49171	443	192.168.2.22	142.250.186.100
Nov 19, 2024 14:54:38.929718971 CET	49171	443	192.168.2.22	142.250.186.100
Nov 19, 2024 14:54:38.929747105 CET	443	49171	142.250.186.100	192.168.2.22
Nov 19, 2024 14:55:04.577661991 CET	49168	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:04.577739954 CET	49169	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:04.619338036 CET	443	49168	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:04.623332024 CET	443	49169	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:06.037424088 CET	49175	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:06.037465096 CET	443	49175	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:06.037527084 CET	49175	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:06.042084932 CET	49176	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:06.042124033 CET	443	49176	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:06.042176008 CET	49176	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:06.043157101 CET	49175	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:06.043173075 CET	443	49175	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:06.043618917 CET	49176	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:06.043634892 CET	443	49176	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:08.935831070 CET	49171	443	192.168.2.22	142.250.186.100
Nov 19, 2024 14:55:08.979346991 CET	443	49171	142.250.186.100	192.168.2.22
Nov 19, 2024 14:55:13.071963072 CET	49178	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:13.072000027 CET	443	49178	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:13.072066069 CET	49178	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:13.072490931 CET	49179	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:13.072549105 CET	443	49179	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:13.072603941 CET	49179	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:13.073720932 CET	49178	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:13.073741913 CET	443	49178	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:13.074604988 CET	49179	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:13.074629068 CET	443	49179	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:36.048710108 CET	49175	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:36.048794031 CET	49176	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:36.095333099 CET	443	49175	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:36.095350981 CET	443	49176	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:38.979052067 CET	49182	443	192.168.2.22	142.250.186.100
Nov 19, 2024 14:55:38.979094982 CET	443	49182	142.250.186.100	192.168.2.22
Nov 19, 2024 14:55:38.979177952 CET	49182	443	192.168.2.22	142.250.186.100
Nov 19, 2024 14:55:38.979410887 CET	49182	443	192.168.2.22	142.250.186.100
Nov 19, 2024 14:55:38.979424000 CET	443	49182	142.250.186.100	192.168.2.22
Nov 19, 2024 14:55:43.082022905 CET	49178	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:43.082149982 CET	49179	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:43.123337030 CET	443	49178	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:43.123338938 CET	443	49179	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:44.131659031 CET	49184	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:44.131716013 CET	443	49184	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:44.131778002 CET	49184	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:44.135440111 CET	49185	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:44.135490894 CET	443	49185	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:44.135544062 CET	49185	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:44.136245966 CET	49184	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:44.136262894 CET	443	49184	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:44.137145042 CET	49185	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:55:44.137161970 CET	443	49185	142.250.186.110	192.168.2.22
Nov 19, 2024 14:55:49.618782997 CET	49169	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:49.618793964 CET	443	49169	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:49.618814945 CET	49168	443	192.168.2.22	172.232.4.213
Nov 19, 2024 14:55:49.618829966 CET	443	49168	172.232.4.213	192.168.2.22
Nov 19, 2024 14:55:53.979052067 CET	49171	443	192.168.2.22	142.250.186.100
Nov 19, 2024 14:55:53.979075909 CET	443	49171	142.250.186.100	192.168.2.22
Nov 19, 2024 14:56:08.986110926 CET	49182	443	192.168.2.22	142.250.186.100
Nov 19, 2024 14:56:09.031342030 CET	443	49182	142.250.186.100	192.168.2.22
Nov 19, 2024 14:56:14.137334108 CET	49184	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:56:14.137763023 CET	49185	443	192.168.2.22	142.250.186.110
Nov 19, 2024 14:56:14.183326006 CET	443	49185	142.250.186.110	192.168.2.22
Nov 19, 2024 14:56:14.183336973 CET	443	49184	142.250.186.110	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:54:20.683662891 CET	137	137	192.168.2.22	192.168.2.255
Nov 19, 2024 14:54:21.433444977 CET	137	137	192.168.2.22	192.168.2.255
Nov 19, 2024 14:54:22.183346987 CET	137	137	192.168.2.22	192.168.2.255
Nov 19, 2024 14:54:29.674350023 CET	137	137	192.168.2.22	192.168.2.255
Nov 19, 2024 14:54:30.423891068 CET	137	137	192.168.2.22	192.168.2.255
Nov 19, 2024 14:54:31.173913956 CET	137	137	192.168.2.22	192.168.2.255
Nov 19, 2024 14:54:34.525907040 CET	63926	53	192.168.2.22	8.8.8.8
Nov 19, 2024 14:54:34.526423931 CET	65510	53	192.168.2.22	8.8.8.8
Nov 19, 2024 14:54:34.529489040 CET	53	52781	8.8.8.8	192.168.2.22
Nov 19, 2024 14:54:34.537998915 CET	53	54842	8.8.8.8	192.168.2.22
Nov 19, 2024 14:54:34.548852921 CET	53	65510	8.8.8.8	192.168.2.22
Nov 19, 2024 14:54:34.556566954 CET	53	63926	8.8.8.8	192.168.2.22
Nov 19, 2024 14:54:34.752820969 CET	137	137	192.168.2.22	192.168.2.255
Nov 19, 2024 14:54:35.502054930 CET	137	137	192.168.2.22	192.168.2.255
Nov 19, 2024 14:54:36.252135992 CET	137	137	192.168.2.22	192.168.2.255
Nov 19, 2024 14:54:38.921108007 CET	64928	53	192.168.2.22	8.8.8.8
Nov 19, 2024 14:54:38.921509981 CET	57390	53	192.168.2.22	8.8.8.8
Nov 19, 2024 14:54:38.928384066 CET	53	57390	8.8.8.8	192.168.2.22
Nov 19, 2024 14:54:38.928426981 CET	53	64928	8.8.8.8	192.168.2.22
Nov 19, 2024 14:54:49.601824045 CET	53	62453	8.8.8.8	192.168.2.22
Nov 19, 2024 14:55:13.058881044 CET	65009	53	192.168.2.22	8.8.8.8
Nov 19, 2024 14:55:13.060055017 CET	64956	53	192.168.2.22	8.8.8.8
Nov 19, 2024 14:55:13.067868948 CET	53	65009	8.8.8.8	192.168.2.22
Nov 19, 2024 14:55:13.071419954 CET	53	64956	8.8.8.8	192.168.2.22
Nov 19, 2024 14:55:34.317547083 CET	53	64687	8.8.8.8	192.168.2.22
Nov 19, 2024 14:55:38.298150063 CET	53	56207	8.8.8.8	192.168.2.22
Nov 19, 2024 14:55:52.950228930 CET	138	138	192.168.2.22	192.168.2.255
Nov 19, 2024 14:56:04.330826998 CET	53	54695	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 19, 2024 14:54:34.556294918 CET	192.168.2.22	8.8.8.8	d053	(Port unreachable)	Destination Unreachable
Nov 19, 2024 14:55:38.298224926 CET	192.168.2.22	8.8.8.8	d03b	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 14:54:34.525907040 CET	192.168.2.22	8.8.8.8	0xae27	Standard query (0)	ttraff.me	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:54:34.526423931 CET	192.168.2.22	8.8.8.8	0xdfa7	Standard query (0)	ttraff.me	65	IN (0x0001)	false
Nov 19, 2024 14:54:38.921108007 CET	192.168.2.22	8.8.8.8	0x4e35	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:54:38.921509981 CET	192.168.2.22	8.8.8.8	0x33b5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 14:55:13.058881044 CET	192.168.2.22	8.8.8.8	0x2754	Standard query (0)	support.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:55:13.060055017 CET	192.168.2.22	8.8.8.8	0x44fd	Standard query (0)	support.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 14:54:34.556566954 CET	8.8.8.8	192.168.2.22	0xae27	No error (0)	ttraff.me	172.232.4.213	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:54:34.556566954 CET	8.8.8.8	192.168.2.22	0xae27	No error (0)	ttraff.me	172.232.31.180	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:54:34.556566954 CET	8.8.8.8	192.168.2.22	0xae27	No error (0)	ttraff.me	172.232.25.148	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:54:38.928384066 CET	8.8.8.8	192.168.2.22	0x33b5	No error (0)	www.google.com		65	IN (0x0001)	false
Nov 19, 2024 14:54:38.928426981 CET	8.8.8.8	192.168.2.22	0x4e35	No error (0)	www.google.com	142.250.186.100	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:55:13.067868948 CET	8.8.8.8	192.168.2.22	0x2754	No error (0)	support.google.com	142.250.186.110	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	08:54:05
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\jO7FHDAZ6f.pdf"
Imagebase:	0x2e0000
File size:	2'525'680 bytes
MD5 hash:	2F8D93826B8CBF9290BC57535C7A6817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:54:11
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x9e0000
File size:	9'805'808 bytes
MD5 hash:	326A645391A97C760B60C558A35BB068
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:54:31
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "https://ttraff.me/123?keyword=super+cleaner+2020+apkpure"
Imagebase:	0x13f6f0000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:54:33
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1232,i,4480364503558093569,10111975475138914287,131072 /prefetch:8
Imagebase:	0x13f6f0000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jO7FHDAZ6f.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF662d96.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119135412Z-178.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Static File Info

General

File Icon

Static PDF Info

General

Keywords Statistics

Image Streams

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Windows Analysis Report
jO7FHDAZ6f.pdf