Windows Analysis Report
CV Ilario REYNAUD CHALLAT.pdf

Overview

General Information

Sample name:	CV Ilario REYNAUD CHALLAT.pdf
Analysis ID:	1615140
MD5:	8e8e4c3a60a7204079301de1a2349aa1
SHA1:	2d170f9f41c7f37c1665cc77e9f51e501503b35a
SHA256:	e6949aa2d066221b5c25517becbcbe40827688f4beb066ca63a05cc8f3352d3b
Infos:

Detection

Score:	2
Range:	0 - 100
Confidence:	80%

Signatures

PDF has an OpenAction (likely to launch a dropper script)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.16:49770 -> 104.76.201.34:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49770 -> 104.76.201.34:80
Source: global traffic	TCP traffic: 104.76.201.34:80 -> 192.168.2.16:49770
Source: global traffic	TCP traffic: 192.168.2.16:49770 -> 104.76.201.34:80
Source: global traffic	TCP traffic: 192.168.2.16:49770 -> 104.76.201.34:80
Source: global traffic	TCP traffic: 104.76.201.34:80 -> 192.168.2.16:49770
Source: global traffic	TCP traffic: 104.76.201.34:80 -> 192.168.2.16:49770
Source: global traffic	TCP traffic: 104.76.201.34:80 -> 192.168.2.16:49770
Source: global traffic	TCP traffic: 192.168.2.16:49770 -> 104.76.201.34:80
Source: global traffic	TCP traffic: 192.168.2.16:49770 -> 104.76.201.34:80
Source: global traffic	TCP traffic: 104.76.201.34:80 -> 192.168.2.16:49770
Source: global traffic	TCP traffic: 192.168.2.16:49770 -> 104.76.201.34:80

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: classification engine

Classification label: clean2.winPDF@16/28@1/54

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-02-14 09-01-24-193.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CV Ilario REYNAUD CHALLAT.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1564,i,13010626307312095656,4652424023390945233,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1564,i,13010626307312095656,4652424023390945233,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CV Ilario REYNAUD CHALLAT.pdf	Initial sample: PDF keyword /JS count = 0
Source: CV Ilario REYNAUD CHALLAT.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: CV Ilario REYNAUD CHALLAT.pdf

Initial sample: PDF keyword stream count = 28

Source: CV Ilario REYNAUD CHALLAT.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: CV Ilario REYNAUD CHALLAT.pdf

Initial sample: PDF keyword obj count = 61

PDF has an OpenAction (likely to launch a dropper script)

Source: CV Ilario REYNAUD CHALLAT.pdf

Initial sample: PDF keyword /OpenAction

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.22.41.97	unknown	United States	14618	AMAZON-AESUS	false
92.123.16.204	unknown	European Union	16625	AKAMAI-ASUS	false
104.76.201.34	e8652.dscx.akamaiedge.net	United States	3462	HINETDataCommunicationBusinessGroupTW	false
2.16.100.168	unknown	European Union	20940	AKAMAI-ASN1EU	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
e8652.dscx.akamaiedge.net	104.76.201.34	true
x1.i.lencr.org	unknown	unknown

ID:	1615140
Product:	CloudBasic
Start time:	15:00:39
Start date:	14.02.2025
Sample:	CV Ilario REYNAUD CHALLAT.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	8e8e4c3a60a7204079301de1a2349aa1
SHA1:	2d170f9f41c7f37c1665cc77e9f51e501503b35a
SHA256:	e6949aa2d066221b5c25517becbcbe40827688f4beb066ca63a05cc8f3352d3b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	27B280AE9940A94F7E86C561115F7A17	FD42EB286650EBB239F90C535D5759ED7E4B2347	51884565849AF13DE4CF5D29B4592C6D0DB003A79CAE3476E16787928C40D3A7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	247838BE6BA6BDBF5033450111A31B3F	6831E10C859C01B97999818B0856E34BA90EFCDB	EFE67B333DCCB0C75B3FEAE14FDC3A41504AACB719240C37991A5EFBB5127D5D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2f5ecaaa-abb4-4be9-b3d1-a1d23e526122.tmp	JSON data	3027B4218399161189BD120D96931DB3	DC056419272977D7EF547B8F03BE4DF89708ACE8	4A20C6487813147655F939F1314AEEC1D3FC9A01C330A596A2A319441EA7F377
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6946fd.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ddbf9deb-8e08-48d2-949a-c71f14c2fd53.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	B493DFC6DDB802E09558AB71DA31B759	2DF16810C829F4E83F631C8EB1FB6B2F73511EB2	8801DABD24AB04EA8123E0FB76981C983CD95B5F1AB01595A63050112FD490FB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	054A4ACB8C9722B3E0973470605FA4CB	61D8711E78BBC8B47EF1E691CA2B2EB189AEC68D	B6F42831726BAFEB852E8B10573044E3CF1850DAE15D50D9B9A7E3CD7E881D1C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250214140126Z-160.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	92822167A43CE741A36C1B0F72993A81	7348D7DE708AEA020E8B2CE92E89CCF381B6CFE8	5789DEEFFA8F6C44CBCF44EB24FF1EF6401DD4A6B130F3135D044E5AA3DAFCDA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	A59B20D87DA8310D5807C61F6CB09BF8	995C0877F8DB475E49E7024D9C54008FA628EF4A	F00DEE310FFDDFE5A1B3157E3B86410707E32C15480A164D0962058FB1CBF2E4
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	5B17FE1CE6D441292ACD63E70D3CA93E	78272CA72E48234BE508C3A90CF4815A0A445734	BAB48324BB6DBD991322A652173D6CDB7DB476415263AB8033ACCFE48B37590E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	5CF361B768B995011FD4AC39C69EBEFB	1D40D98C13407AF78D75BFEE57A40B2B6D32BE48	6E6C8C6C6440A0B730D728010D16DCA52CBE0BB2451860389FABC7F1E7659EC0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3948	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3948	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F62D7CFBEDC3621891DC60034A0CF21E	A4605D7223E762731A1FB0504902CD9BA2E18FEF	6A0F0631F94C1518C37ACBADAAA588053179BD109D96E2147FC5560ACFB11D37
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	4D85A6E5F6FC36D0A5C505F4D4FD4C2A	BF4D15667627035BACC51B0D59B2E31C239CBEB7	24604F691284F6E288B22ED42325200E7ACF8352CE38457FA3BA52B496E3B902
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	156E5407B2AE7586B2469305AE1CEBCF	12186845BBBDE881F375E9BF944B6F398D2DBAF4	7D62808344A0FAE2FBD410760A500E77BAE16962382F1C68FD373A6ABD435C36
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	2585B0C7C4DA242FB6DA60E50CCDC3F4	045D34B8E06CBBE119D579CBE792D2AF2803CB8B	310C160B9B1B639B44CD51FCCEBE26FBAEEFAEB174548F9D48C3EB28D9536E35
C:\Users\user\AppData\Local\Temp\MSI85961.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	5C85760D612FC4A402C3BAC4E3DEDF68	3D084BCD271754837D20FB3AE8F6DFD1FD92897F	615BC4F3C309C7D169BC5E707EC5BA6316B0C1F8343ACAA345E5CF18333A0FEA
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-02-14 09-01-24-193.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	09779728DD89758300CA46B329E043E4	E7A6BE0243EF4A18DAF406DF0E8A8B6A3B14C7FC	FA75912D902418F08DAE4A1E4595BC583D5295B1556B4B042C550CE1A49614B2
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	1610AFB16A66F73EBC9E3F149D015EAC	7849BE115D90EAFACFE00A15AC05E2A84A5DF2CE	62FE46D4EF6493D2F2465BFE4D93161B6953C62D0EFDB7D41F4DC6EDDA029DF3
C:\Users\user\AppData\Local\Temp\acrocef_low\9054d130-f83f-4227-bc75-302b15cbc02c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\b6e1ab83-2fb5-43b5-a3f6-e1129edc189a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\cc8b3933-771e-421d-9756-04b1b9e94ee3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	BA10C16DDBD959367310963B69971540	D3F40F26A53E5C5F1FBE6F5C6CC518FF327CB73C	3FBA0536D20C3565A6C657F163126BEE3C324645C355B2C1C13BC15B5DEF4665
C:\Users\user\AppData\Local\Temp\acrocef_low\e9810c51-74fa-4db2-a49c-1a19c858c3b3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	1A39CAAE4C5F8AD2A98F0756FFCBA562	279F2B503A0B10E257674D31532B01EA7DE0473F	57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95

Windows Analysis Report
CV Ilario REYNAUD CHALLAT.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report CV Ilario REYNAUD CHALLAT.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
CV Ilario REYNAUD CHALLAT.pdf