Windows Analysis Report
BankAcc Confirmation Letter 002.pdf

Overview

General Information

Sample name:	BankAcc Confirmation Letter 002.pdf
Analysis ID:	1560169
MD5:	6dbda2c52ca6bd0759d7c156962f333b
SHA1:	233767c1551f4eacb99119170a563f175f47a161
SHA256:	3d94bdfe2fa47e61495f488c3fb43e46d2c1af99174cbe2013b7352628ca6999
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.5:49716

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 52.202.204.11 52.202.204.11

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716

Source: classification engine

Classification label: clean2.winPDF@14/30@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 07-47-35-310.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\BankAcc Confirmation Letter 002.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1664,i,17052531450104719093,7534709632114952489,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1664,i,17052531450104719093,7534709632114952489,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: BankAcc Confirmation Letter 002.pdf	Initial sample: PDF keyword /JS count = 0
Source: BankAcc Confirmation Letter 002.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: BankAcc Confirmation Letter 002.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.202.204.11	unknown	United States		14618	AMAZON-AESUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
x1.i.lencr.org	unknown	unknown

ID:	1560169
Product:	CloudBasic
Start time:	13:46:40
Start date:	21.11.2024
Sample:	BankAcc Confirmation Letter 002.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	6dbda2c52ca6bd0759d7c156962f333b
SHA1:	233767c1551f4eacb99119170a563f175f47a161
SHA256:	3d94bdfe2fa47e61495f488c3fb43e46d2c1af99174cbe2013b7352628ca6999
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	485C0480651751087D723FF0A00D0286	750D12E64F1CC91B795B7794D90E4EFF2E3BBEF5	E8254310DF92779E91AA3C1FE51C6D4D063000AC09EDC4AE815444FD095D4CB0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	485C0480651751087D723FF0A00D0286	750D12E64F1CC91B795B7794D90E4EFF2E3BBEF5	E8254310DF92779E91AA3C1FE51C6D4D063000AC09EDC4AE815444FD095D4CB0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	0C785238EF01D29F13AE6B0AC4AE15BA	B3B7C868F15FD25C7B043C397233B56FEE53DCA3	3231E8FF1E0F54E05B1E8992B0D5C76479A4E33CE004BFF836EDD17BC104774D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	0C785238EF01D29F13AE6B0AC4AE15BA	B3B7C868F15FD25C7B043C397233B56FEE53DCA3	3231E8FF1E0F54E05B1E8992B0D5C76479A4E33CE004BFF836EDD17BC104774D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3016a639-bc09-4fdc-b685-460bd3384cd3.tmp	JSON data	05194B01E11EE11E0572D82F6118048D	90B9B961274F48D4595A00C3F56572168019671D	8A38C91D0D9A92CFCB190AAB563C0A90AAFF4168C0179F7445DA35D745ACEF97
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5a4cd2.TMP (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d6f1cdd4-65fc-4058-9fc8-19cbe99c7840.tmp	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	051AA03F5039157B791A16733DBD929C	7B26E7DD73B199C4F9959EB42402285E2722F121	5F036EAD0E89C5AC4E37830741B335EB54C445008C03F4E6CAB6DD2D857F15E1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	77D9EE4450605594F59D66E3854FF3CE	6E1259DD756B8E67B0169A1940A6BEB1A85A9B4A	FD38BD881637D31CEB91DF7ECB24607944900949C64CB464CBE12E347A38CBCD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	77D9EE4450605594F59D66E3854FF3CE	6E1259DD756B8E67B0169A1940A6BEB1A85A9B4A	FD38BD881637D31CEB91DF7ECB24607944900949C64CB464CBE12E347A38CBCD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241121124737Z-168.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	16A23E3F3A73ABBB31B2BD032F776F3B	88B26D25591FAD06512EF7EFB4C2C7B7801D25C9	04F4452859E29105D917CED122E93C7469D2C1EB8744F2DA703D943491463523
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	D448EAFCAE7CB9F32515241993B92C88	87A1B4EE8B3BDAE2AD4FDD31C045CCD6F06126B5	ECC3B2EA889357BBB8E7471E8B80255EC3907FBA4EEBB6DFBA88D5AB88CC191D
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	4B082321CB86280FCE9D86FBC7D3030F	993726D74D233E094CB4F88675A0EFED11BB3E88	039CD0B17C19D242ADC8013BDEDB8C530595D4DC0C54AC9AFCEDE389589E8B9A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	119B033227F7131E6BA6960E008A6E69	A85222B534054B0DC600DEAD9A9365770849D8FD	824DDC7DCB9823CC6A93A0309BC17D8AF1F6A0222A136416DCBCB52EA11845CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	076F578D8155B86BBFB4698D5AE8F449	E219B3F21D33E787C58231C0BA7A3B6D21A914FD	9073173900AEBB1CABE094CBC85FDD610DC9711A0E9A54AAA48CF8E82563F5FF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	0EA7B5136DF99B202CB0549BE9D835CF	37DA31F711AE04C0CE7CC8862B95BF6299619D9C	A3DFB8DBF2713B6CB82ED3FEBD4DE7067DF3DE66388070D3D7B0E4F3B27AA083
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	91C8C8EC41D460D97AE0AB7DD0090C50	52675DF6005B9B8217A327F0551DA574948B8CA8	5A3E1DB21396A81FD23BE4E9C5FCE5182E1A1486E74789F6ECFC18F9A91ADF79
C:\Users\user\AppData\Local\Temp\MSIa0f4c.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	7B27AD598F672A7CDAD08FAC201FC9B4	C6B471DB6D6A5ACD39C7093E8C0F07A626615066	250D7A0D4EE21ACF31A8B2D1F94DCC466C4F9B74BF7A0DE023FD8CA988B83B88
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 07-47-35-310.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	78F57D45885E4E2EC2F4B4D47AEB7A52	2987E37C758D4B634A26E7D10F6CDF1C74A7DFAC	F25559638D966463E70E718B03F36779B5EB2F189A1FD238B27537B58EA96418
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	0CDEE2C56C1D2796E0E6D8AA319B7367	17AFE3BEC7FA3FFEFDCF8BD159E488FF8BD70670	F236F09064EC35E741E32D227DA03F067F2D07EEDB10263587767C50D62834D3
C:\Users\user\AppData\Local\Temp\acrocef_low\298fee19-dc9f-484d-8297-add0b53468d9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\4474efa7-ef30-47c2-b02d-ddc0c08d136f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\9bf6c38d-994d-432f-9ac3-631a1dca1f23.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\dbb49176-ee81-4c93-b558-25d1e816d80b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
BankAcc Confirmation Letter 002.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report BankAcc Confirmation Letter 002.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
BankAcc Confirmation Letter 002.pdf