Windows Analysis Report
RJ-LLOH-DN1_1-20241219013626-16004075.PDF

Overview

General Information

Sample name:	RJ-LLOH-DN1_1-20241219013626-16004075.PDF
Analysis ID:	1579945
MD5:	9b0e379fc6ecb42a16b3cff68024da3f
SHA1:	f77a692c3a62052a94361ef6c543faae1acd5a00
SHA256:	9841d4b8993533887a5f67bd4a191d441ff3cd030011295d1ee752d24c0ef57a
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

One or more processes crash

Classification

Signatures

Source: Acrobat.exe, 00000006.00000000.1759785816.00000205769A3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: Acrobat.exe, 00000006.00000002.1970369932.000002057BB04000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 00000006.00000000.1772539097.000002057A962000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 00000006.00000002.1969256152.000002057AB3B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.echosign.com
Source: Acrobat.exe, 00000006.00000000.1772539097.000002057A962000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.echosign.comY
Source: Acrobat.exe, 00000006.00000000.1772539097.000002057A962000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.echosign.commessagePropKey
Source: Acrobat.exe, 00000006.00000002.1950471409.0000020574FC4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api2.branch.io/v1/url
Source: Acrobat.exe, 00000006.00000000.1774107252.000002057BA49000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cc-api-data.adobe.io/ingest
Source: Acrobat.exe, 00000006.00000000.1774107252.000002057BA49000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://delegated.adobelogin.com
Source: Acrobat.exe, 00000006.00000000.1774107252.000002057BA49000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://delegated.adobelogin.comH
Source: Acrobat.exe, 00000006.00000002.1951524276.0000020576B90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: Acrobat.exe, 00000006.00000000.1774107252.000002057BA49000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ims-prod06.adobelogin.com
Source: Acrobat.exe, 00000006.00000000.1774107252.000002057BA49000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ims-prod06.adobelogin.comU
Source: Acrobat.exe, 00000006.00000002.1970369932.000002057BB04000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://lcs-cops.adobe.io
Source: Acrobat.exe, 00000006.00000002.1970369932.000002057BB04000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://lcs-robs.adobe.io
Source: Acrobat.exe, 00000006.00000002.1970369932.000002057BB04000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://lcs-robs.adobe.io15)
Source: Acrobat.exe, 00000006.00000000.1754552731.000002057237E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?view=cm&fs=1&tf=1&su=
Source: Acrobat.exe, 00000006.00000000.1754552731.000002057237E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/mail/deeplink/compose?mailtouri=
Source: Acrobat.exe, 00000006.00000002.1941121542.00000205723CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.whatsapp.com/send?text=
Source: Acrobat.exe, 00000006.00000000.1774014911.000002057B9A7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ebixcerts.com
Source: Acrobat.exe, 00000006.00000000.1774383403.000002057BBA4000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 00000006.00000002.1970639963.000002057BBA4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ebixcerts.comE

Document contains embedded VBA macros

Source: WERBDA2.tmp.xml.9.dr

OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: WERBDA2.tmp.xml.9.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

One or more processes crash

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7348 -s 1696

Source: classification engine

Classification label: sus21.evad.winPDF@15/27@0/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7348

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-23 10-38-42-724.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\RJ-LLOH-DN1_1-20241219013626-16004075.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1744,i,10303162133773050494,14992278128259906983,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7348 -s 1696
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\RJ-LLOH-DN1_1-20241219013626-16004075.PDF"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1744,i,10303162133773050494,14992278128259906983,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: RJ-LLOH-DN1_1-20241219013626-16004075.PDF	Initial sample: PDF keyword /JS count = 0
Source: RJ-LLOH-DN1_1-20241219013626-16004075.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: RJ-LLOH-DN1_1-20241219013626-16004075.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Acrobat.exe, 00000006.00000002.1941121542.0000020572356000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK.DLL

Source: Acrobat.exe, 00000006.00000002.1951549763.0000020576BA6000.00000004.00000001.00020000.00000000.sdmp, Acrobat.exe, 00000006.00000000.1760099221.0000020576BA6000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: Acrobat.exe, 00000006.00000002.1942265983.0000020572CD0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 00000006.00000000.1756050677.0000020572CD1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Acrobat.exe, 00000006.00000002.1942265983.0000020572CD0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 00000006.00000000.1756050677.0000020572CD1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: Acrobat.exe, 00000006.00000002.1942265983.0000020572CD0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 00000006.00000000.1756050677.0000020572CD1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: Acrobat.exe, 00000006.00000002.1942265983.0000020572CD0000.00000002.00000001.00040000.00000000.sdmp, Acrobat.exe, 00000006.00000000.1756050677.0000020572CD1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1579945
Product:	CloudBasic
Start time:	16:37:45
Start date:	23.12.2024
Sample:	RJ-LLOH-DN1_1-20241219013626-16004075.PDF
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	9b0e379fc6ecb42a16b3cff68024da3f
SHA1:	f77a692c3a62052a94361ef6c543faae1acd5a00
SHA256:	9841d4b8993533887a5f67bd4a191d441ff3cd030011295d1ee752d24c0ef57a
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Acrobat.exe_ed3ebc145db33ad9157e6e17c9ac766fd81311_71e7ed2f_52d2c8e6-5f39-4ac8-95f5-139f216652ef\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	3AB6DCD9EBED7E01FBCC0EBD1F224357	1FE63BAE589499F07B025FAE094D664B07EEE763	583040A3B56FBDAB4D4DCA7759AD4CCD8E22FF565195B34FADDD32575F893977
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB9C.tmp.dmp	Mini DuMP crash report, 15 streams, Mon Dec 23 15:38:48 2024, 0x1205a4 type	AC67F0A112ECDBBA94E934D4162BD879	2EF8649C35BF65FDC10F650343B4CBBEF23AA3A4	F1C29D02D651DBC94CA8D916040773B7113978A0157CD76F651CBF603A082631
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD72.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	C09653B094E8E86B3688F9D58F572B22	1FAF2D02C244B97F0F411F77D2E92F3075BA921B	B0908009B3C709B1521A6C0C229B83E7C8B1A3EEB08100BE66E682B772D957CF
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDA2.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	31115AF8AE8943AB0EAC928D1C85E8B4	4795ACF71164E0C15ED6C2BAE297F58F7A67CAE4	EF8E57472F7C8441DC1E9BFA6D4CEAF742EE89A2B502F38EE7581632E19F3B20
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	63E3AF676A017CC7A85A26044366227B	6BC356E3FF630EC9EAB816B876D12D772AE657A6	7DDE9FA9C895CB20F9E034ED6396FE4082E1261560E8F15034267D21C2458574
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	63E3AF676A017CC7A85A26044366227B	6BC356E3FF630EC9EAB816B876D12D772AE657A6	7DDE9FA9C895CB20F9E034ED6396FE4082E1261560E8F15034267D21C2458574
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	12C9392A103E4A7F154C693D815B5819	E26185C1A2B1FA39FBDEAC2F48FFE40CFB560302	12253E33A998F59DBE32B9068A09E247CE8897CFDB748CA7394BACBCC1ECCD5E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	12C9392A103E4A7F154C693D815B5819	E26185C1A2B1FA39FBDEAC2F48FFE40CFB560302	12253E33A998F59DBE32B9068A09E247CE8897CFDB748CA7394BACBCC1ECCD5E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4a20a3ef-9fcc-466a-8dda-35e5e76284cc.tmp	Unknown	E6BB34E20212D50DD76ED498BD139C21	A1A56D59DB41BD95205928331BD405EF69237F43	1632A10DD18745D2173F6A8483AA8A7F402C2BA8AEDD5D88809E8EC65560917D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\87dd78cb-d131-4d1c-beec-48f68867fc66.tmp	Unknown	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	Unknown	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF610bfe.TMP (copy)	Unknown	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	E3B98CFFC977BE2E09D51B25F2C27F79	5250862F5433FF46BF14D62AA9D84F42E3355B51	218CEB0ECAB555041675952BBE6B7C662A6C476665C5FA5446CC4494C189991C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	AF2C04FFB08E98241A233E2150055783	282C0769DF1400752C2293C4EA70DE30CFCC3C93	DD5568F0C13B098F7AF2DC19832DB8651C442FACD8B61EEDD16027FB2D939057
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	AF2C04FFB08E98241A233E2150055783	282C0769DF1400752C2293C4EA70DE30CFCC3C93	DD5568F0C13B098F7AF2DC19832DB8651C442FACD8B61EEDD16027FB2D939057
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	27BF1ED3A451D66E0A45F3C32C769644	90A6F7458493E6EF93C082EC22910F6DBEE88879	72E038E6C61F67D73077034E5F7E44D534651F7ACCA8576694EDE32833C7FAF3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	7DE2D7CBA53C9E0E9BEB6616B337E78D	EF2E13B7443EFFB563805F9279BBA5FD8A25BEA5	E8D6D954B5DE1748FAC6585FF51D685F6A2079BEBFE223BA05913EFB045E6DCE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	E5828A8CEA826DF60F6379E8865E3BC2	55F71DAAAEBAD93842BD64AB203A3865ECD2FDD7	D82A1C7EA9F725A3F405DC6A0ABA1D04D4D4F9D3B9A8621B481C4EC903B95EF6
C:\Users\user\AppData\Local\Temp\MSIb330.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	855EACC394EF60D04924BCDC90755488	5EF0BBB234AF9343AA3876A32F8D1CC26183C118	80A90FB5C3319E923C96F4060BF7CF02C96F1BB015256E434081DFD41029ED89
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-23 10-38-42-724.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	8B7013CF51160BBF473E0CD41F70BE90	E2E6A420B6DE58C767E04300BC5BC1DC9EA0ECD7	EA56034D0B7A7501B784B55086FEB7B070EDD164F223BCA2BE8F7B1FB95C9D79
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	BBC23C5DBECE57AEE65A4B6D170B7B6A	6BD6701058181F148B98566799D5F5A66D3BAC4F	AA437112CC397B3B6940B30DC9A7C28EBFB2F9A3013B4BEA1B5EAD11CBF1820F
C:\Users\user\AppData\Local\Temp\acrocef_low\8d795295-0802-412c-8355-481711c9c51a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\9dce86c6-d941-47f8-a81a-d02b3b2ad36f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\a7fe67df-822a-4621-8282-d05a726c7468.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\c951907c-94fb-42ea-a887-763e7182cbbe.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
RJ-LLOH-DN1_1-20241219013626-16004075.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report RJ-LLOH-DN1_1-20241219013626-16004075.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
RJ-LLOH-DN1_1-20241219013626-16004075.PDF