Windows Analysis Report
CJ-241115826_CJ_430448_OE_BMSCAD.pdf

Overview

General Information

Sample name:	CJ-241115826_CJ_430448_OE_BMSCAD.pdf
Analysis ID:	1558820
MD5:	8b7dcee56b4a8a1c85180efd916f4057
SHA1:	2a11fc0fec727b5293a87e7e47550178a748ce7a
SHA256:	c3c590c7beb7883610edc82c7fa47d09e1ba7b9251d9745da14582ca440ccefb
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.5:49733

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.203.104.175 23.203.104.175

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733

Source: classification engine

Classification label: clean2.winPDF@14/49@2/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4564

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 14-39-01-679.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CJ-241115826_CJ_430448_OE_BMSCAD.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1676,i,1745309769064675600,3028205725165205519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1676,i,1745309769064675600,3028205725165205519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CJ-241115826_CJ_430448_OE_BMSCAD.pdf	Initial sample: PDF keyword /JS count = 0
Source: CJ-241115826_CJ_430448_OE_BMSCAD.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: CJ-241115826_CJ_430448_OE_BMSCAD.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.203.104.175	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
windowsupdatebg.s.llnwi.net	87.248.205.0	true
x1.i.lencr.org	unknown	unknown

ID:	1558820
Product:	CloudBasic
Start time:	20:38:01
Start date:	19.11.2024
Sample:	CJ-241115826_CJ_430448_OE_BMSCAD.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	8b7dcee56b4a8a1c85180efd916f4057
SHA1:	2a11fc0fec727b5293a87e7e47550178a748ce7a
SHA256:	c3c590c7beb7883610edc82c7fa47d09e1ba7b9251d9745da14582ca440ccefb
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	BF827A3BA4C43B9221B0384DDDB7B4D6	ADE2C7653FA5C5BFDB5EFF494E4611571ECC3712	8D4EFABC399FA1C34D15E72767D47DE2BE9BE0C1238ECDB060790FC2741C1DD2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	BF827A3BA4C43B9221B0384DDDB7B4D6	ADE2C7653FA5C5BFDB5EFF494E4611571ECC3712	8D4EFABC399FA1C34D15E72767D47DE2BE9BE0C1238ECDB060790FC2741C1DD2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	E1ED166E46B3BDE52106D28B80D05DEA	E75B94DB27F87784D7C71A4CE65F1FEA208764B6	D1584D76DC524150B1EF566CEA06C56F3A9CA61BF181DB7396EDABF847F2A589
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	E1ED166E46B3BDE52106D28B80D05DEA	E75B94DB27F87784D7C71A4CE65F1FEA208764B6	D1584D76DC524150B1EF566CEA06C56F3A9CA61BF181DB7396EDABF847F2A589
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	6E09B6D7F813CFFBFFFB5B603CF094C6	E368D6F49165F700A1CAC673020B3B648672EA8B	EFE94457A80BD9F7FD629EBE0F73BF2C82E66FC1A1992B5AEE887FD77B13466F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ad5e8410-3024-42a8-ad15-45f37d047dae.tmp	JSON data	6E09B6D7F813CFFBFFFB5B603CF094C6	E368D6F49165F700A1CAC673020B3B648672EA8B	EFE94457A80BD9F7FD629EBE0F73BF2C82E66FC1A1992B5AEE887FD77B13466F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	29346C772949E3150AFFFBABC7409CA9	8E406254D5D5BF0D29D7C470D9DAF554656E953C	905F6F2DE93E12E938C84CC1D598B138167D758E1FE37118145BB3E5CE57BAB2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	FB414F494CCCC298C1FB253F4A626F1E	5E969A232C5F15BECA212EA5E951A1503ACBDDD0	3DCA9445753163E022A3759E52AC6C1FF8DE7B5E6462986244BF4CF1FCD34BDD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	FB414F494CCCC298C1FB253F4A626F1E	5E969A232C5F15BECA212EA5E951A1503ACBDDD0	3DCA9445753163E022A3759E52AC6C1FF8DE7B5E6462986244BF4CF1FCD34BDD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119193904Z-171.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	893651C6D9EB1B14514A6BC2BCE2C295	4EE5D3CF2D101E88D062B7D60EAA780A2C618FFC	1DE8D9832BDDF537AA017AAECF7A30E635DB307449C33166E94C8D0C984C4E1A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	990E5005C4580D5077177EF453F8F55B	A8C3B8EAA3B6C1CE1A5F4F6022E334CEDD0A7908	B8893FE25503DBC2937B9233350ADCC999DB93E68834A0CD1F81BA714CE0B633
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	544994C380F12CCFCDB1896751345AA8	FDC16BBC55507600E9D763A6CA3B839C0994F19B	A4435FF1DC2E42AAB72F3B4CA4186DE21F00411714BC1DA5D89C6616E47C52C2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4564	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4564	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	8D3B7C8C8486548628DD92CD54023EEC	1EFFD9CB39D0194635707EE6F7D1C9A8AA18ACD0	335624B0A5B97F9A8C2FA2AD131C5E3E2A353F332405CBE94F22ACB1DB4CE031
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	BB5526E2CCEAA690D01716FFB46F79C4	BBFC3FFF6A616F46C00EDC2E274C9D199A3787F8	E5A31B61AC7A44246FB3B026164EEE98E4CFCF6A412F5BC7C382A8CA640DAB1C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	3864B6619C1ABA494D61C405A7289009	6630AE5CE6B306D3E6EA1867D684CF5A1E6197EB	41841CC57A75245A9EC74ED1ED7F7F7DC15158727E4976EEC61A8392FED7A1B9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	3F0D8471F993776B75A59F61BFF1386F	6050E67001DFD973DA05DAB26CBBF45851B2E36B	4DCB4DA6184A430CEFAEDBFC968C2597A187D814C6C1078E5FD7F590F5F9D237
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	58C973DD3B389AF73B6DD7B71E453495	292130558A0A58E6B7089B1138D4CCF8CE275556	2C96B7FCA399B1DFBAFA2C3C7079C602E88276B7F6A3DCFE02C1549952F894B5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	9E9F558A15732350453CC01C0318877B	FEC0E4DE75BA8A35F3DC656F851FAAA68B9A0813	52C7023E4DF3A868412374943E193FAB587A90A7AE995A9A2CF60E1F55F4DD37
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	E3904C71D204B388F18DCDB18762CDF4	B4212B4BF18F24CB99649ABDEA15C9C595A0370F	5169BFFB5FE3D513157386D56A9597AEB554F14716C2F515E23AD1FADEEF4564
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	6572A686C43A0AAEB06BBA3A47F871C1	75127EFC16175ED1C09EED7737FA89DA6751C000	565FACD8BEDF31220BC72357C70650ED8368B6EF16A57986AE0272E9D8F9E7CF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	742D73A0513F623D9D621A1F990B6D79	0D7856E826CC18D96A50CA1265E54D12FE8F1C10	E6122B80D5B58C1A169A5D134FD14E974CFAE50D018517B49BFCC9B27EC635BA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	21660A2CC148D59C52E9B3FDA0ACB47B	D612FB69F84F3D4ABD49845A3707F8D1531E8AFC	FD8EA0DBBDE4A42460A37CAC9FC28D4559B5593893B89240E5DC87DDB4E8EB65
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	1C9703372F384EB90EC52BAC1CE4D4D3	6AA7D1CB577A501F38E329E4F1DCB5045536F8FC	0F9A5DFA89A1FDF36AFD956C323550935009335ED60C4B5FCE8842EFC09AF2E0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	02D3F6CCE329A50B86C24AFE1AE65586	CC9F64BA9749B713D3EC2ECD973D36497DB5A5F6	AFB947FBD796CD2CB7692D75ED9496E9689331D2403CD115BCC8C7B8F2C6DCBC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	C72A963E6C2F93D51A92DA7C4E39E219	81EE533BB06B89AEFBE0333DB369EDF0E96FF8C6	2C6A81BEE27887A5E45BAAA03421C6E3219DF5526C3BA9C8B6A4625D0164CE9C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	B689C8DCFA0BBEEE0B42EEDC3EC889CB	BC2EBC9545BB673CD9D2BF8E3F7A26F18E432744	DB28D3C4BFBB0BF030FD6A8EA9876E5A2B97E291B43099B54EC2BBFC6EEFAFCE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	0968337BBAD44E2C5114B4234D66C1B4	2A9C9602DA5E0972DC655ED8860920BEC8D102CD	C82D5587F4B396AB4711DFABACEFCCCACA20F81312C9ADBFB55972FDD2CAA506
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	298E67B69E54DF9F9F77F56D35CB2F6D	A0FF6986ED9A97619A3C9FE32C263BBB6EB55120	8CD29BA7BC1EA1923EC231E7364B2D48C4316793E2820664CC96A6DFFC3541EC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	094B8C79DE0D064E820756C0DAF4DFD2	3966F34B3D208E9203CBE6C4FE60C88EEB2862EC	516956E9353BEF034ADDC2FC76D2019A2CFB3EDEFFF337617E509C3F69BD487D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	98A644EC9E26E16D67CA57B03B2D6648	1652D6C825FF853C31C9F14D85AFFD7285200827	F201B1EC08E1957AD6F89623925E0F4B9D051A237B087E804B28AE8406BAF184
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	4DA0DA02C80AAAEB570D4D7B6FE79034	3955EFC646E9567CFE5E2F655D7BF67FEA38722C	EBBFB1515BFB1FD939E6DDCD0D79A6B1AFF3BC458085E3A8BD02F70A6911BD61
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	C61434893A0D16238A6D7C3565C5C3BC	44248939A3452930FA3D233EC6487B49CE3304E8	DEFB55E28D6303ABF4E05F0FB8BEFD04B970963397BAB077B8AE075512973942
C:\Users\user\AppData\Local\Temp\MSI7c9ff.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	B3828CA8D3B8709BCB817113BF2EA9F5	034C5DCB01CC6D1CF4CAFEF571278B7AEAEE2BD6	FFB547A60AF14E423731AF8428138C94A8A320E1F3243F1456FA850CB319F6F0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 14-39-01-679.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	3D86DC3B148C4E3F525FA7C963AAFEB3	60EEA6144A4785891D159A34409D31E89CD7882C	D559DFC5B269681CD8F6E63D77AD0D2CA0F28EC1167D994D8A225523DE0ACE4D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	F1E46BB897C2B33A092DC4AB9C7E6EC7	FA816433A059FF5412B395231E39BBE1DFC390A2	11F6495FEBD11D98D9A6EFACCAC41C8FAE6F91537F1C5000354288EE3C84C26E
C:\Users\user\AppData\Local\Temp\acrocef_low\15984eb7-c458-4be4-868b-eaedb537f09a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\2ab1a692-a1e9-4b5f-949b-2cad9ee8fa2e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\7eefb852-2dce-475d-9ea2-b58d3d3251a0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\db3a378e-55ca-41c5-95c7-e7adb6ab5d17.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CA6B0D9F8DDC295DACE8157B69CA7CF6	6299B4A49AB28786E7BF75E1481D8011E6022AF4	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7

Windows Analysis Report
CJ-241115826_CJ_430448_OE_BMSCAD.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report CJ-241115826_CJ_430448_OE_BMSCAD.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
CJ-241115826_CJ_430448_OE_BMSCAD.pdf