Windows Analysis Report
document.pdf

Overview

General Information

Sample name:	document.pdf
Analysis ID:	1564534
MD5:	1564debc205330db6ec59839837de047
SHA1:	07fe560f2f5b66bab01b3847aa26196ae8905a02
SHA256:	ac1d3a7d60e52c4b49fb2ab1cba0257e763bd2c26a971ce1161e3ae118dbc5cd
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 50.16.47.176:443
Source: global traffic	TCP traffic: 50.16.47.176:443 -> 192.168.2.4:49744

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 50.16.47.176 50.16.47.176

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	TCP traffic detected without corresponding DNS query: 50.16.47.176
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: document.pdf	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: document.pdf	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: document.pdf	String found in binary or memory: http://ns.useplus.org/ldf/vocab/DMI-PROHIBITED-EXCEPTSEARCHENGINEINDEXING
Source: document.pdf	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: document.pdf	String found in binary or memory: http://xmp.gettyimages.com/gift/1.0/
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com/detail/1471542553?utm_medium=organic&utm_source=google&utm_campa
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com/detail/1801741596?utm_medium=organic&utm_source=google&utm_campa
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com/detail/1889668931?utm_medium=organic&utm_source=google&utm_campa
Source: document.pdf	String found in binary or memory: https://www.gettyimages.com/eula?utm_medium=organic&utm_source=google&utm_campaign=iptcurl
Source: document.pdf	String found in binary or memory: https://www.shutterstock.com/image-photo/1940410141?utm_source=iptc&utm_medium=googleimages&
Source: document.pdf	String found in binary or memory: https://www.shutterstock.com/image-photo/2262759289?utm_source=iptc&utm_medium=googleimages&

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Source: classification engine

Classification label: clean2.winPDF@15/54@3/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7404

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-28 07-58-14-235.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\document.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,5964392041809778140,4607358404255903214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,5964392041809778140,4607358404255903214,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: document.pdf	Initial sample: PDF keyword /JS count = 0
Source: document.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: document.pdf

Initial sample: PDF keyword /Page count = 28

Source: document.pdf

Initial sample: PDF keyword stream count = 143

Source: document.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: document.pdf

Initial sample: PDF keyword /ObjStm count = 8

Source: document.pdf

Initial sample: PDF keyword endobj count = 349

Source: document.pdf

Initial sample: PDF keyword endstream count = 143

Source: document.pdf

Initial sample: PDF keyword obj count = 349

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.16.47.176	unknown	United States		14618	AMAZON-AESUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1564534
Product:	CloudBasic
Start time:	13:57:08
Start date:	28.11.2024
Sample:	document.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	1564debc205330db6ec59839837de047
SHA1:	07fe560f2f5b66bab01b3847aa26196ae8905a02
SHA256:	ac1d3a7d60e52c4b49fb2ab1cba0257e763bd2c26a971ce1161e3ae118dbc5cd
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	9EBFFA0A3706191F1CF081E389D5D246	729570EB1B54A4FCB3F79210DA0CC216FDBA1027	2539FCF2D7672D48A1356A8B17186D53780315FEE867E923766283A6FDE0D539
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	9EBFFA0A3706191F1CF081E389D5D246	729570EB1B54A4FCB3F79210DA0CC216FDBA1027	2539FCF2D7672D48A1356A8B17186D53780315FEE867E923766283A6FDE0D539
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	E6F32D53A532B419FFAF1F19C44517B7	A9DA22C90B6B28A12CDB1D0BC20362AE4959D32F	EEDFFF201485255187C18B8CAF0B65033198AEACFCBF57354231E47655A505E7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	E6F32D53A532B419FFAF1F19C44517B7	A9DA22C90B6B28A12CDB1D0BC20362AE4959D32F	EEDFFF201485255187C18B8CAF0B65033198AEACFCBF57354231E47655A505E7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6b7fa7.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a9c8cd2f-1842-4dc5-90cc-f84e45eb5b7e.tmp	JSON data	CB38933B6973D05F1C38C713C06060CE	58B98D5CC42131C2855A943F9965F59CC5BEE93F	7CA82E34C0610B9ADFD6376228DD51DF7D4C7E72684F9FB1CDF9AEDBFEA019D3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f4b2bd58-bb10-434f-a4fe-092b773219dd.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	5A479FE2CFDCB8F33B6DE8AAEE5283AC	06ACA57ADD33B1F6D8E143EC000302BAF9EA8D25	41836DB09C4A2B9EE64158A1B40478540A8F438473291ACEA79AADEA9E487746
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	24978DA7F4C78D9A83B624FA709F6B47	7517FD9492773A9EB13AA877C19C113EF32A98AE	E1EE61E6284A19CEB42983C9CE253F3A18B3007624003255202C9911499BC8A9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	24978DA7F4C78D9A83B624FA709F6B47	7517FD9492773A9EB13AA877C19C113EF32A98AE	E1EE61E6284A19CEB42983C9CE253F3A18B3007624003255202C9911499BC8A9
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241128125817Z-216.bmp	PC bitmap, Windows 3.x format, 164 x -92 x 32, cbSize 60406, bits offset 54	294332998F9C786C03FBFD7251133561	A1F101017FCAF7E07E203FFE2DADE17D1DA66222	0CBDE5518CEDD0665C8613482012071A40F636FBC625EA0C468C9CB067DFBAC3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	A3DC3124F9A3C6233345774C4EE87358	A890C68102588843EE62201578EA975A3E5044E3	06414117D4C9329ED7E686BB5F49979BD6051FAA288A0DCB0125E64BBCF6D27A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	F2527C41998B55E7479C61D78679FD7C	95B50B703028199C810AAC06DCEF267184744F62	93AD8CD53B5DE440738720C1E6E6798CA0F6680C44539ED1A6537B474CDC6B9F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	319DCB3481847766767FF92F8BF648B8	294150D333F371C92AC78A750CD7C3DC4DAFC216	F38B3339216AE36217E0509330AD93DED5B48BE89F98A758671E2ED4A4357C6B
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	90B75910134D7FFCD64ABDEE1B227A99	E43392AEAA16C0198DF8B64E64D46A672C483F19	3317A9DD6C58D1986D88D9E762F3BC5F00852E56A6F4230AD8DC7BBA8D70504E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7404	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7404	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	758B42992DDFC41CB5E57069C621B54A	D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD	55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	70D8BCBE74CB58575BFB26EE4A70127E	99DBFA441A8A8110BEE60556AC6FD7661DA1BD90	DAE6658BD62B3762EB0D32E6B4FEE3E362AF87AF4A179BA56444E8CAC1E3857C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	DD8FC134E974CBE997D96C28620513E9	2236A0608F5049552EA94411AC3A5448BAA0557F	7085245ECA42F81A6DF32073527E03386E52F9699209D738AAB89DE248F1D85D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	3A3B6A33FBBEC446278757182449D431	D111201DE2D6E01976369D7289B77DD4F8497DFC	388D09358444580B1FC8B43F60085A715BE1D47CE682D241B5D5150EA264BAD7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	CA63254CCD780ACE9293359B6EE84EC9	E20215D3E457F146E0B330870F44F40646136847	D45C6ECF2A52B7078299F5B1EBB05BEF02BAA310B04915C1567722031DA5DCCA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	0E2A8ABC47E05F24A0578B559A21452E	E4A4EF2DF24AA5E32F8775DCD0A311DFB1ECBC24	BA00A46A9C02D0CC4F4D14130F177CD6E15C4BE07AC920B79CB99A50C4831A3E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C79D9BB7361240D07FA2D98F2C415055	FDA5CFFDE86495283987B8AD8E79F26CD06DE75F	C8E8853F115D9C5A47A0700E787082D9E81AD216AE28225046B0925403EEF342
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	FAB64CAE574831701041F961B9EC8C07	4EE3D93E709CD74F7547B93770445B0CD7ECDFB9	EFB98B8527D12925DB6A93A042D7834D9F308542A1E2E09583D2A1ACAE3BF273
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	372CEB355CFDB4EBE379998593EC0947	31CA42A8F3D05D43B491852221F43F509C342EC5	7E203096550DFA7E9601C8EB15847D509C59E8CDE168DA04B1E7CE8F0D4AE8F4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	69D9FA0C5AFD821A51EB2434FF18B3B0	1FF8571CBB712AFF00EE0DB875A1B881B1F50FED	54F8EDFEB5CD73EB2E843CF7349C0CF6FAB9C2D064F721F607DBCA3CF8F76FBD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	0877C7AEF8892A91EBB2E1B2EF60DB34	791DCF388A60D2398D43303D85E421C2F8EA8881	B7849CD6995AB26D5FB13BAAEE3B36940EC94FDFF5F3AD198FC9C6A59AF77CFE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	1B6A7C4A64357E96FA49DA8FCCBF9AD8	15EA1AEAAC29E5A207160E94C9F8BDB473B859BC	94A81CDDF3F8D4290F828EA0955165D96CA624C5B27B325385EBB4C26A33F6C0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	70EB2944BDD5D9474F10FA1EEC4316D0	5B263184577C50D1EB9AD8D3985620C262952A99	631E13443812E8CB02430BC5B53B7FD520EC20DC603BD2067E70DF9D8C1F28CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	FD8E366A94EADEA7779A484E920097DC	AC97F1033A1D17575068799C6862E955F73C0FDB	B90BC34432244223CAE58F5BF4B6C64A93F8D8873A5EB37E4B903D1EFBFDBF49
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E0313A352311679056470AA838F85817	8EA09B6CFD649181E681CB8ECB1C125A1C926F23	7B31E1A44B7B9186EDE92ADCBC74B61BE9E3391AE6D86087AA50D169FAF9FF02
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	6BA70009FA76489505F6EC27B9AFDE88	A4EEAF9E12B78DBBA2D12DF55A1161A297716582	AEA206F489F03BBB8F47CCC389A565CD71769CC6AD5583E2E2C7200BC4C6CF6D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	8D36940B775577319FA5BBD738BAE4FA	27A6DA55B04D1D28D17BFA201FB33555131DEA77	5DBF782109208A5A3E662F71F7DA1693055687B79CAF19A987E0576E8353AC9B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	725800ECF060C099E6D29EA79BB1438A	717542EBABFF7B8FB7984D7DC5081ECC8869BB88	FFFD049C65C7D0427239DAB9B03F82F87D2857959E43C74F6DBC6C9F652861A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	C665E3093ED341D8E496CC61E0922A5A	0D55F8C496147D7D207A71865557193E83F858C6	730D89CF22B965457C99C001E88E3A77570389FC89D4517DA6C7D0BBE15C7719
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	A7ED218394C5CB3C3C3DA7FB6C0E491D	7219ED243D2ECD84B446379C0024D549D0092FD2	D3700A33E2C1615ED4A3587DA026FBA017773F6511E1E7694B5C7087B48BFC7D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	DC74D5E53170682C91D9B573CBDA6958	EE89B33158734C0E8FD12B81003041C1ADFA992D	26EECF94E3254A0AC55E74628D503A7314CDA0EA0679B11F7DFB073BA2050B83
C:\Users\user\AppData\Local\Temp\MSIad33a.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	EFC98D1352863E45C8C298E4AC32A781	ECAF49A383D28E85AE779C93A73A7E1ACB65074A	5AE173DA946402121B5C250B86BA0DD1D4F341328D062697EA8F7992185A76F9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-28 07-58-14-235.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	FC2D7D001C9DB8D886503946E4A52EAA	5DF74E65FE1E1B12B12F0D6B6CDB983267F1EC4C	30FF51A302C5233BFC8EAAB2F785E51623387D6435B9E2827D507151A433F6E0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	1D91B68387CC92AD6667C88B9984F63F	2AB119C25949C5F4738AE60515CC24A919E86423	3639430605EA71844B8E8466CA56A7ADA8263560D2D00BE697464BB89F8DF01D
C:\Users\user\AppData\Local\Temp\acrocef_low\2b56deca-b5e9-4993-bc4d-f548b7485df1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944	FA6978A9EA472E8ACFF72AFE8CC7CC81	D58155446B67ACF4DA331A977B8EC7BA105C2C4F	3D0DF2B14FC632520705424D2DA394922D3EDD8C977950656B736352CD5A37E2
C:\Users\user\AppData\Local\Temp\acrocef_low\b2f27137-ae33-4886-ae7d-c3c29e6ae5b2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360	8D04FDC5022E491B91EC6B32F003430B	6619D46E06076B5669D4CC677D6D8F638189E46A	7682C53053D66EF0B1A89335C88C4420226B10AFAC87A286E6E1A6BC795FEE61
C:\Users\user\AppData\Local\Temp\acrocef_low\bcbb2ed7-765c-4101-a45e-21909292eee7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996	C14EBC9A03804BAB863F67F539F142C6	FD44F63771819778149B24DD4B073940F5D95BFA	A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
C:\Users\user\AppData\Local\Temp\acrocef_low\d3155097-ca67-4cbf-a297-90568e3e891d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	80810A6BBD1140B4448CC39EE2349290	3BAB3900903546D160F952AE78050C6A9FFA87B0	BEA84A96782F94822B51A08753E155847A92DFE416A320103BF641AD9132CB49
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486

Windows Analysis Report
document.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report document.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
document.pdf