Windows Analysis Report
Bennetts.pdf

Overview

General Information

Sample name:	Bennetts.pdf
Analysis ID:	1560315
MD5:	3e54ef89de3eadb9ffaebe75d00dda83
SHA1:	e533107836a653f09dfefee1ec6e27e55f244ca3
SHA256:	96b0f06474395992825bf9fe65a726be79a580fbf524c1e2b6705030a5481130
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected landing page (webpage, office document or email)

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains QR code

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 192.168.2.9:49720 -> 52.202.204.11:443
Source: global traffic	TCP traffic: 52.202.204.11:443 -> 192.168.2.9:49720

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 52.202.204.11 52.202.204.11

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01x-adobe-uuid: fdf9e666-cbf4-4e86-8c83-d46a601e2046x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.202.204.11
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.1.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443

Source: classification engine

Classification label: sus22.winPDF@14/47@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 10-59-31-064.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Bennetts.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1616,i,10632544991231734620,9954566153605342301,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1616,i,10632544991231734620,9954566153605342301,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Bennetts.pdf	Initial sample: PDF keyword /JS count = 0
Source: Bennetts.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9du0ah5_1mxgwyi_5w0.tmp.1.dr	Initial sample: PDF keyword /JS count = 0
Source: A9du0ah5_1mxgwyi_5w0.tmp.1.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Bennetts.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.202.204.11	unknown	United States		14618	AMAZON-AESUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1560315
Product:	CloudBasic
Start time:	16:58:24
Start date:	21.11.2024
Sample:	Bennetts.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	3e54ef89de3eadb9ffaebe75d00dda83
SHA1:	e533107836a653f09dfefee1ec6e27e55f244ca3
SHA256:	96b0f06474395992825bf9fe65a726be79a580fbf524c1e2b6705030a5481130
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4D1E4484713CABA93205234DBED7344E	E3EF4ADC331FDCE8A0F68AB6EC58D190BB1B8164	2BBA6989F6C5EF6A0575AC910B0205B6F188E6C2910D47B20AEA7A7E5DBDF3F7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	4D1E4484713CABA93205234DBED7344E	E3EF4ADC331FDCE8A0F68AB6EC58D190BB1B8164	2BBA6989F6C5EF6A0575AC910B0205B6F188E6C2910D47B20AEA7A7E5DBDF3F7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	D9F935725A4964FBBFEAF97B30F90E4A	5CCA384FA5A9D4E436A6E3C6A7EF3C46BFFFE590	160F1758DE8A6AC0F1927A069244343B833ADC19C6047306DCD2C8075F557A55
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	D9F935725A4964FBBFEAF97B30F90E4A	5CCA384FA5A9D4E436A6E3C6A7EF3C46BFFFE590	160F1758DE8A6AC0F1927A069244343B833ADC19C6047306DCD2C8075F557A55
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\76983ad9-5c05-4440-8674-4ec78c06c037.tmp	JSON data	29B394AA39E5B674E0D9851D4A6255BC	1DF3E0FDD4B1419EE62932E5D28279BACC39F077	B09135D73E3C47E32BCC00A9FC7F8F133CDE27D127628741BB97CF3033AC3FC0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	ACCB522AE87A739BDC04EB5A34975EEB	A41FED54445E729A85E7017A002D4FF6FCAFEC93	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6725c3.TMP (copy)	JSON data	ACCB522AE87A739BDC04EB5A34975EEB	A41FED54445E729A85E7017A002D4FF6FCAFEC93	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c26d1c51-d4ae-45e6-9b6d-22bf0096e039.tmp	JSON data	ACCB522AE87A739BDC04EB5A34975EEB	A41FED54445E729A85E7017A002D4FF6FCAFEC93	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	1E263D320842AB02EBE13E5AD30EE311	670414A702E8D8D12A4EEFCD7A6275D636CD4B67	16AC20EA5B98B28B516B7E6151CB1392DE7A85D2A4A26A422B8EC5C1D0B2E52D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	51A2224DA439E1682F1BA9A20EDC777B	5D602F8CF65C060E6941EFB0A4263BA6DE9BAABE	EDE3EF37059C89EE33451EE64400CC8364DF298F071FC65082F40E892768DCF2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	51A2224DA439E1682F1BA9A20EDC777B	5D602F8CF65C060E6941EFB0A4263BA6DE9BAABE	EDE3EF37059C89EE33451EE64400CC8364DF298F071FC65082F40E892768DCF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241121155933Z-214.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	44B49E2F6DA455F48FD7C3337F0E0522	F0E00310FB7EFBF07C5D1995F6D2E6A4612B1C32	723CF3D164746D37702409BFAC24E24BE45F36484F7C898FA6C8973D18984E2F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	1854494F4B515B8A5D415440699315DB	4C1D02E6E476784DFFEA383AAD89435F18CA3E01	82A2C66C9AEDB50EA45EA8062CD9936600AD58996A24FAA7F3DF04D8016F7E61
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	6893AFA862E5AD62F4B2322D1A556F25	3769477F55CBFB60F558C679AFEF242FF54181FE	512226F8A40D4BFECE8BAF26607A5DD3FD07890FBE88AE3B4E5A9213D96ED7B5
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	658C5A069AE89CEBDBB8C52D1FEF390E	312C1FA3E903227D9CC17F0F009F421AF0AE7413	0420B8AA96E97628C468858B46F1E7383CE9DA521B2A6094D547C22D1D0B4036
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	A897FD5BCA0C82DCE61FBDF8F43CA0C6	129A735428F7CCF2B1ECCC772100BADDA6234982	FF241FB0E0F227029EC069998BC390CCC6E7C94DC9A5A29E02FE19B34F5D5DCA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	A224FE67AAB8942682E91C40AD0867C0	F9068E9B8B2F87D09618FB7D22BB3044860F69F2	8963C30B8802AB537C9BFBA54F0C884B7765002FBFF067C17561A86D33BF4004
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	3589018AEB26D8D307B10E3F2BC8B1EB	E8BBB821A7D83BBD732311A99C6BAEC2EE453929	03BAF8D1BE2E1AFF8A92DC7EF24595520B087E215971954087D30D8B901D5398
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	8E1A0CD11A0F88A80A2F9DAA6ACB4A0F	CAEE2BE06E1CD9FA66279BBD4B1F27062C9E7FA5	98F1487AD4B1B0F2859753E7FED20B62B98285F9705C07C17E7105AF2C379DE6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	C1E6CEE7B6152C6AF78E61E441640320	71EF29C66CBCA693315F2A815BE87B7F467956E9	4F6129DF9A8B19628505084D9DCD96CDB1AE184F9B9BE990A80C0A41D3F1BBF5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	FD6A3231302593E9DF7EEA6470B41684	760E0DC02C65AF2B66887FDCA7E64618B4AB3D05	DC28C2829BCB80536873DB1EE8538510834876F6FEBC3941AF54C57444F60475
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	687AF74E86B63DE88D3C1576237EE7A2	831929A3DAF6F7B7B4F703269CE7CC76CB3CD817	54226F88A67825878132562DA4A7C96851615AEF193EE64F8B86ABCF6FA5E064
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	0619776855692D687B0E9DE35DA1AE06	564B419EB40DF1BB0EBF65E34297D01F17BA14F2	2156942C3590E0FE5A56BE60D26EF4BFBFA850A2A4CF286929CB1B99B91581DF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	0170F7F30787B3ECF7E073D2FB6908D1	227D657586A95A1F9CF0F7F5C972827C204D7927	D19450FEA17716F5FB5A8B0DEDD604E3D41B7068360D9E51AB0A7BEDA88A5AD2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	C97F8CD638C4D2DADFF7F9B6CA65D722	1FEE3332F0A0A3CAEE38B6FCD51094A4C5733E48	454903A38F462D7C3325631A182689867AC9C983140435EF807178289E9491E7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	2D11017FFA72B23351BAC0842AF7F5D4	C06CBEF4E78D002B2DA7F34C34F879D22DC7A2BF	30507BC222711835469F0954CB1E1847E9367042FF6F0EF093E70FA6760B17ED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	9699956EBA9FB63D258CFF181C2F2FF3	A168341B4A01AF4F328D2AD479D30260BD37033E	C91A9EC2913B9D45E3D9945CC0F2E043F2FA42F7D71E415F725D0BD849B4B72B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	77DC4EB87A0C6ED38EF4AD8F2A99E18B	83B961943E16030F12AF19A4304E41150CAF009B	9D8D4E9AA4283AA40D58E3479C3DD7BD3CFFF6BA265A707B60B588383FBD064E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	2B56C27CF9057B9083E17464BF724BF1	B19178E0B4D4E3D836AAF2A4FBB7D0464424B39B	34BD0D42ED28AF07371605DC97C11DE7C7F49D60A9BA626A0B09435C5AFAE0E4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	60FC2E49B54013AEEA8483FC008D6F5A	4B4A1AF33C492CBC7DF9737C0CBF684401538A2D	2804E315622D23ADBEC0D8B0EB6AF1440D4DF78DCA6E95AC9BC1949D0D27FA7B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	919DF784DF7C8D90441C782BD462FF46	5B95FD8187E993B029A445B7C7E39EEFAA10F0F0	D1E6BC2BE3C88C5E66A901BCE705EAD689DC7A4BEEE2F4BD3AEE81B0C8A8E1A9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F24670008BBFCD6852D7BB7742857E4A	19538DE2AE3C2B7683B96C1CD7E2B0AE324AF406	0DCEF920F56EDA3C5695CD06FE42910CD34E583E8FBD8823B35BBFFDA9E90268
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26	5A9C09E7451AECD406CEE1CF89A0F52B	2DCFB02BDF571755116E974BAAECBF261DF83D3B	DF7A87237A2579B9E38DE3A066A61E4410827B61303ED7E9C9826FF3C891D22D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	0A3386DCEE8C3F8E6B71A3595D72B0E5	5CCFD4352AC1BC0C0FFBB7004A9DA24447A7C349	524B52B578F7E8F652AF4897B1288CEF17040CDAA27D2AD45E11C23DCBD4B9DE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	01017FCE14A763EBEED508782C97CB1C	13DB52AB75F6E6577CDCAA2A72DBDB66F7241E05	4B5552826E17755765ADE4E34E27534D43167215572BD821DD53E71108DEADAB
C:\Users\user\AppData\Local\Temp\MSI6ee19.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	FDE5B4B746BED0FF2C94B037FBC605EF	20DFAD58BEE3B9610F9B30C3A967F334323EA1FB	3F92D6EF79F66F7BE549A7E9927FB84FA93DB69F61E4177C84889D1B18B46E6B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9du0ah5_1mxgwyi_5w0.tmp	PDF document, version 1.6, 0 pages	E5D88E532AE6A05DB5AD6B2239BA8818	353FA01702F6BDB93B34599C878D3061EB322CC1	D8F1DB3094A5819DE3BC2C1486608F3FFDACE83F18BBABDCAD5CF4ED6C63B021
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 10-59-31-064.log	ASCII text, with very long lines (393)	5BC0A308794F062FEC40F3016568DF9F	14149448191AB45E99011CBBEF39F2A9A03A0D15	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	7F61A8226E9A5F9719B4732343A0F211	1AE6A78FB45779B873FD81A8BCC45F0A01DB5105	7E753D894C24E4C5A29E3A11D2BADB1CD398BE8C3CCA81DB2943B2DDB83CEB65
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	C7F37E79BC20AAFB9159AEA0343B63E7	56BB71BB49EBB8A21ECCF2B5AC37D08573BC1BC2	3B7641B8DB5F723F35437E2229BD59DE2703DFE5637651F7B7B523830155E16E
C:\Users\user\AppData\Local\Temp\acrocef_low\057a6ce9-357f-4076-945f-d4a07a520ce5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	95F182500FC92778102336D2D5AADCC8	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
C:\Users\user\AppData\Local\Temp\acrocef_low\41191446-b0c6-48c4-9e45-e7b20c8ebe49.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\92fbaa1c-df05-4b22-aa55-b4b4f45ea675.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\bd2a99d1-3315-4fce-a45a-ad13ff20484e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
Bennetts.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Bennetts.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Bennetts.pdf