Windows Analysis Report
Marriott Departmenty.pdf

Overview

General Information

Sample name:	Marriott Departmenty.pdf
Analysis ID:	1560414
MD5:	9a311255ac82fd1928be703c8c7ceb5d
SHA1:	e0b27de62ebd34f8f3a7d68ded0d5059bb16f587
SHA256:	9c0afeb203d3dcbcf738504ce4ca767e6684104a47b2769b6e23104eff7e4ced
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 23.195.92.153:443
Source: global traffic	TCP traffic: 23.195.92.153:443 -> 192.168.2.4:49744

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 107.22.247.231 107.22.247.231
Source: Joe Sandbox View	IP Address: 23.195.92.153 23.195.92.153

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.92.153
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/50@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1732

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 13-31-27-302.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Marriott Departmenty.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1512,i,11052619800477176223,8024173466366765854,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1512,i,11052619800477176223,8024173466366765854,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Marriott Departmenty.pdf	Initial sample: PDF keyword /JS count = 0
Source: Marriott Departmenty.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Marriott Departmenty.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
107.22.247.231	unknown	United States		14618	AMAZON-AESUS	false
23.195.92.153	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1560414
Product:	CloudBasic
Start time:	19:30:31
Start date:	21.11.2024
Sample:	Marriott Departmenty.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	9a311255ac82fd1928be703c8c7ceb5d
SHA1:	e0b27de62ebd34f8f3a7d68ded0d5059bb16f587
SHA256:	9c0afeb203d3dcbcf738504ce4ca767e6684104a47b2769b6e23104eff7e4ced
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	855CBA35D44EB898D349F81989813D41	1256D824FC0AE3DABBD3B7B3BB3DD090BEE83713	00A8181E5C65CEF453908AC696D722D3AA0C00CDDBAD6D84E001043D5DBE5968
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	855CBA35D44EB898D349F81989813D41	1256D824FC0AE3DABBD3B7B3BB3DD090BEE83713	00A8181E5C65CEF453908AC696D722D3AA0C00CDDBAD6D84E001043D5DBE5968
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	87A916DF7620AEA13B5324041213FCF3	572061B24A7B30B39D054C94CFF2FAF158DF5B31	7F671653580B9B886C0E358C43E94FC9698E15233E179DD3DF5A2F820B0B341E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	87A916DF7620AEA13B5324041213FCF3	572061B24A7B30B39D054C94CFF2FAF158DF5B31	7F671653580B9B886C0E358C43E94FC9698E15233E179DD3DF5A2F820B0B341E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\276fd2f9-332a-4c0a-bcb5-bf3d09a83ae6.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\55fce0d1-aacd-4f11-8d70-e69063920b25.tmp	JSON data	5D10464C88940DE9AC2355A300341BB6	EEEF7B9487B2559D1268522799D6A7C5B4989008	99A58F53870D7F03C3508082CF8CD72A393085513A3DB372798D35A5B6150FEF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF58d19c.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	F8E034276982F3ADD879F24E786CA704	5D99A1FBA745110BBCB0FC10D95EE77B580F9C53	05FF4D43FB722ADCACFCE588F0167D29A7F236D9D88B07625EE1C9BC5A203F67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	F39A7DBF66152232642FE54EF3DB8F17	14DB64B81D23451C050F65ED5A6B9D16C5E82037	81CF72977653D03A1B0BE1917C08F619FC7EDEE80B5CF41D6157BDF72F307290
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	F39A7DBF66152232642FE54EF3DB8F17	14DB64B81D23451C050F65ED5A6B9D16C5E82037	81CF72977653D03A1B0BE1917C08F619FC7EDEE80B5CF41D6157BDF72F307290
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	0709E9F97CF5D48029B00B9BF2CCD611	60A2635DA31912A5157C8660AAD5835FADBA2E2E	4F77E77C43F76744820526CB791BCA4DE3F0B0C5C090489677350989A9E1B0C7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	0D14FBF11CCC6E784E7B65364B2F1B92	C0178287DD81E7ED9519245B839EC2CDBC280CE3	03AC97EFFE1C4D54F71FC29314FC8C36BD6EAF668D73C7C6D8107EA2ADF16033
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	D552D1CE1B2171D0FA4EFC6A9CCFFE61	5809DFDC8E389DE7DBAB1372F1C21214DB21441B	3888EDE3BC03F6D61CD79E15B4BAA9BC347EBC2D4EF866139A8B31F17CB82F43
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	76D213136FB588FA618CBF96DCF58751	B0928CE2B17A92DC1A3484E6E4372332B39F16B8	B01120A7E3F1924B3EA87FB2A651C4CFE6CDBCDF321BE0F42D7F1C8FC8AE41F0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1732	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1732	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	642BD5B341DA2279EEFFD39DDBD1EB12	05BD377F1A3F7F9938BFADB56A1E0CDE38599A97	B1E0BF425EA1012C9E320C2BCDD37A0B896AFC9ECB12713825715EAE37AE7F5C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	0D2133C1D8C902AD6646C306EE18A3EC	6AD5EF478FB35408CAF299DABA5C544821D922C1	6CA5CBB08A0E99E252805CF667ADFCE3FDF04D02D40727B01676FF71ACA7859A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	71538CCE5E9ACCAE7D179ED8AEAC54D4	5EB68FF7FFB1216AAC2AD7F9E66CB48AF9C8343C	1882C68DC0D74A56E9C22B623D6B3218EB5DB600A5ECE55E07DA482053B662B5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	0EC32611DFBB02EE546511AFA75D3297	ACBD611C8A253BC56FAE410CA962F657D4D6D3ED	86867B55559DA01941E0D7567D0641D54FEF922C993E09EAE0E2B85E251A417C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	9310EE8B9E0C073E9C520A2552EC3402	584AB58C1E578E807F8BF9F28E9B410575B96AF7	932BB7D649BA0A8854FF09F0E1F345753C9C1963E6BF07489DC2355B90D44C86
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	5FB78CF391C748CB8EA30E95FF6EBDDE	4467BBBDC5327BB8C5BB6D2E66A322E42FBF42E6	1034BAE177D0A1ABE954BE1505717F9B78088E725511AA8A6DC500D33F6314E2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	242771AEF9251140A957B7A6240D3DC6	DDBA2207970EF2B9B7A0CE35E6D877EB6A5C7A62	791EEAA1EF6DE9B91444F5F4CF4CE5C128E4886E5DEF93B4049AA78C135D7ED3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	C594D63F629FE42F26A8733D0933C98A	F5A7EBBC48740F01D17D61207B9BBB1229A28CB6	DD7C02DBB5F0FF8D1192893424FDC45B93AAF2958FB954BD5B606A492D9B8FF3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	9A3F01E7AAD4340140406942E90FF55A	F6F890279E3DBD0891A032A4572741D9810665D2	8A18B06E9B7DD3C1CCC2AE92981DB47274A38E9E7892BE833D9FDD0BD8FF578F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	E4E0276F373B00BC5A5AE34CFB099910	0DAAA511E99375F36147245B4D670DC3C7064A01	B27D2ED32472DBF94543A5F1A8C5B8C9359878ED3D563D2C6206875E448BC30C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	7F04A18735C8C1131541FE9F4C25F34E	2F6C8612072936951F8765E81E1FCF674F178F47	F739B5485E1FFA7A55D963A8CBF1BC72CB3CB4CE0D63122E9A2F557D04E98FD9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	9F4BD91031F4C60870CCC6EA309ACE37	3959BEAC46A4F3F6718B55966D913EA4FF7C36FF	4418C4F853824AA4C395AC1AC1D92718AF3EFDD2C41A16B27DDA270C7547E2FC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	520F3F1A20ACCB290D0D83A87234503F	E94F5404F68C0E2A0150B5CAE629DE31D4B17627	37022900ACBD68B13EB2C126B25ACCAB5AAA002C0469C65E3A222A0B0362747E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	2278DB8C4299F56CC5516C29140DD813	307EAB0FD3C46C08B7B575D30757D7DF532CA52A	AD11F71256758B0F82FED8466558A34FF4CD777001FB41E356B0855F6970345E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	2BF8C4CE13ACEFC56291F916F2156380	3A6413BEDAFE6984EB21BE1162DBF4FF8043EE9D	22E6D2E39BE731A45EBB12E4D2D0A9561EE919D3CC451AF1AE514C004F2BB975
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	1CBC3ED4679D1C97A9E928ACF8EF404C	EF073329A61BB51D8C401A93A05913D477263B8B	243F874861AD14A7D0206B5AB5A41254ABB51D270405A4F3FA4A0352CAA5B519
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	F8C2AF40CC3AA6731924AF9F5BA9DFA0	4B444A5A296080ECC6D41A0E14870D0239A1F99B	C72A2E8645BD25F53C4CE0EAAACF23EEA4C90622FCC06B5B52532916CA3B037C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	F12A54790B3D76575B5A6BF90957134A	4B56919DF8B8BD6877EE91457506AFB0C493D063	3546C3ECD7AAA841A60EB23A96D824DB171C098656ABA99F7A12955B980BE354
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	0DD22398654FF56A0451A7E0FB5DEDCE	D81D933B75AF9AA0904E4DAD0EA473321F639234	1257A09FFBE9A02A6F52389A538CF60D07A39DE24A7F1F2102E79993BDA45D6C
C:\Users\user\AppData\Local\Temp\MSI7b8e8.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	82A208E16F8AA92CDE759A156ADD4275	F05C0DD54840290DCA2FF6062EC4895D8FC279B4	7C496AAC73951B96C901CBE3567A07F145A64B0CF67F3B1B4945BE6D7FD2B0AF
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 13-31-27-302.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	666361070A78385D9A0D3B97F03A09B4	2FC5D512CE27699404C0D2BE62D506D5642F4590	7EC20D5F073E7E8FB2F6ED0D7875959CEB0214297EEE60C3FADD34AA80C81810
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	8C5D1A407091721CF6444A67627BDEAB	73323CB955D6813176A40B00B1624F3C1E8028F0	1CCB6BAFF352E1F2B1E4ED2543A242C286AFF86199D423871DE102716FED9CFB
C:\Users\user\AppData\Local\Temp\acrocef_low\70c115a2-31f9-4028-b3f8-82785418f9d6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\a0219e40-d960-4fc7-99b0-8bcdf66364dd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\c994d6e3-1890-406d-b936-3420f7f79637.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\eb6aef0f-269b-41ea-bffb-7fbd727ac3d8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
Marriott Departmenty.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Marriott Departmenty.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Marriott Departmenty.pdf