Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Download

Resume_PaulBrew.pdf

PDF document, version 1.6, 0 pages

initial sample

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6e360bc5-c709-43b0-829f-8f9741fc4c4a.tmp

JSON data

modified

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db-shm

data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db-wal

SQLite Write-Ahead Log, version 3007000

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\CreativeCloud\CoreSync\EntitySync-2025-03-26.log

ASCII text, with very long lines (336), with CRLF line terminators

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250326210442Z-224.bmp

PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Acrobat_Notification_Surface

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

data

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 11

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

SQLite Rollback Journal

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

data

dropped

C:\Users\user\AppData\Local\Temp\MSI87c19.LOG

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader124.4.20272.6 2025-03-26 17-04-40-305.log

ASCII text, with very long lines (393)

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader124.4.20272.6.log

ASCII text, with very long lines (393), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\0b38775e-a653-446a-82b9-ea9a8ba59b67.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 130556

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\36c55ea4-47d0-497d-9b37-b0d39993b3f6.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\ae0d5c9e-4e87-4f0b-a54d-60a10c914ff5.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41808

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\b020b037-01bc-4d0b-b960-6758519a8884.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15506

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\ee6b6128-d43d-4c0e-9a5b-4c043ee59c13.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022

dropped

Chrome Cache Entry: 167

RIFF (little-endian) data, Web/P image

downloaded

Chrome Cache Entry: 168

Web Open Font Format (Version 2), TrueType, length 9344, version 1.0

downloaded

Chrome Cache Entry: 169

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 170

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 171

ASCII text, with very long lines (65447)

downloaded

Chrome Cache Entry: 172

ASCII text, with very long lines (1572)

downloaded

Chrome Cache Entry: 173

HTML document, Unicode text, UTF-8 text, with very long lines (2164)

downloaded

Chrome Cache Entry: 174

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 175

Web Open Font Format (Version 2), TrueType, length 17576, version 1.0

downloaded

Chrome Cache Entry: 176

Web Open Font Format (Version 2), TrueType, length 7728, version 1.0

downloaded

Chrome Cache Entry: 177

ASCII text, with very long lines (65371)

downloaded

Chrome Cache Entry: 178

Web Open Font Format (Version 2), TrueType, length 8572, version 1.0

downloaded

Chrome Cache Entry: 179

PNG image data, 520 x 676, 4-bit colormap, non-interlaced

dropped

Chrome Cache Entry: 180

PNG image data, 210 x 239, 8-bit colormap, non-interlaced

dropped

Chrome Cache Entry: 181

PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 182

Web Open Font Format (Version 2), TrueType, length 15368, version 1.0

downloaded

Chrome Cache Entry: 183

HTML document, ASCII text, with very long lines (399)

downloaded

Chrome Cache Entry: 184

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 185

PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 186

ASCII text

downloaded

Chrome Cache Entry: 187

RIFF (little-endian) data, Web/P image

downloaded

Chrome Cache Entry: 188

Web Open Font Format (Version 2), TrueType, length 18668, version 1.0

downloaded

Chrome Cache Entry: 189

PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 190

Web Open Font Format (Version 2), TrueType, length 11116, version 1.0

downloaded

Chrome Cache Entry: 191

ASCII text

downloaded

Chrome Cache Entry: 192

PNG image data, 520 x 676, 4-bit colormap, non-interlaced

downloaded

Chrome Cache Entry: 193

PNG image data, 200 x 38, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 194

Unicode text, UTF-8 text, with CRLF line terminators

downloaded

Chrome Cache Entry: 195

PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced

downloaded

There are 65 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Resume_PaulBrew.pdf"

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/24.4.20272 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\UserData" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1712 --field-trial-handle=1592,i,15319257295920843828,6072331317832979418,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=8000

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=7632

C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe" GetChannelUri

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2024,i,3087048889737537394,3794083359230199116,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2096 /prefetch:11

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://kn0wbe4.compromisedblog.com/XM25kT0NsS3kvY0JUQmZyOU44VitIVjVISFJuN29CWXNuN3JlQ1lhcHFHZWIyWEtnZDJkTm1vbGdnUWNwaXA2L214R0FVejhMQ0RJd1BrVHVZYzVUdjlmemhrUTdjSUZYYXh0VElzaU10THRlMkV3N2tkaFJURExwOUd1ZGdUQ05FTU82bWFzSVFyeHlqTU11alpPa0tjSjhMZGFjMlQ5UGhCS1ZwcjlDbEFZS2N3NmVWMjRzcnp2SS0tZ3JVRE1vUm80Sm5Fc3dWSy0tQVY0ZmlNYk1LWHhQbGwra1hxcWVXQT09?cid=2454325818"

There are 1 hidden processes, click here to show them.

URLs

Name

Malicious

https://secured-login.net/assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js

44.198.42.239

https://chrome.cloudflare-dns.com

unknown

https://comments.adobe.

unknown

https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css

104.17.25.14

https://kn0wbe4.compromisedblog.com/XM25kT0NsS3kvY0JUQmZyOU44VitIVjVISFJuN29CWXNuN3JlQ1lhcHFHZWIyWEtnZDJkTm1vbGdnUWNwaXA2L214R0FVejhMQ0RJd1BrVHVZYzVUdjlmemhrUTdjSUZYYXh0VElzaU10THRlMkV3N2tkaFJURExwOUd1ZGdUQ05FTU82bWFzSVFyeHlqTU11alpPa0tjSjhMZGFjMlQ5UGhCS1ZwcjlDbEFZS2N3NmVWMjRzcnp2SS0tZ3JVRE1vUm80Sm5Fc3dWSy0tQVY0ZmlNYk1LWHhQbGwra1hxcWVXQT09?cid=2454325818

44.196.92.142

https://secured-login.net/packs/js/vendor-69f70dd3792dc7287ac8.js

44.198.42.239

https://upload.wikimedia.org/wikipedia/commons/thumb/3/38/Icon_pdf_file.svg/210px-Icon_pdf_file.svg.

unknown

https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css

44.198.42.239

https://secured-login.net/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png

44.198.42.239

https://browser.events.data.msn.cn/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743023067049&w=0&anoncknm=al_app_anon&NoResponseBody=true

20.189.173.28

https://static.jobscan.co/blog/uploads/Rectangle@2x-1-1-1.png

108.139.29.30

https://upload.wikimedia.org/wikipedia/commons/thumb/3/38/Icon_pdf_file.svg/210px-Icon_pdf_file.svg.png

208.80.154.240

https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css

44.198.42.239

http://c.pki.goog/r/r4.crl

142.251.32.99

https://secured-login.net/favicon.ico

44.198.42.239

http://c.pki.goog/r/r1.crl

142.251.32.99

https://kn0wbe4.compromisedblog.com/XM25kT0NsS3kvY0JUQmZyOU44VitIVjVISFJuN29CWXNuN3JlQ1lhcHFHZWIyWEt

unknown

https://secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js

44.198.42.239

https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css

52.217.193.32

https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png

104.18.88.62

https://i.imgur.com/QRF01zv.png

151.101.44.193

https://comments.4xI

unknown

https://kn0wbe4.compromisedblog.com/XL2Rkd2RsdmIxWTNLTEh1NnVwWkc3a3VtcHpaRXM1b09pMDIzbTNZMk5CeEphZVV

unknown

https://secured-login.net/assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css

44.198.42.239

http://getbootstrap.com)

unknown

https://github.com/twbs/bootstrap/blob/master/LICENSE)

unknown

https://static.jobscan.co/blog/uploads/Rectangle

unknown

https://secured-login.net/pages/5b6e2d87961b/XM25kT0NsS3kvY0JUQmZyOU44VitIVjVISFJuN29CWXNuN3JlQ1lhcH

unknown

http://c.pki.goog/r/gsr1.crl

142.251.32.99

https://secured-login.net/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js

44.198.42.239

https://kn0wbe4.compromisedblog.com/XMHZUY0NyOVZWWXFKZCtIK3NmZzBUSmJCaCtQOVJ6Tm11UzU3TFFLeEhkdzg0QlB

unknown

https://secured-login.net/pages/5b6e2d87961b/XM25kT0NsS3kvY0JUQmZyOU44VitIVjVISFJuN29CWXNuN3JlQ1lhcHFHZWIyWEtnZDJkTm1vbGdnUWNwaXA2L214R0FVejhMQ0RJd1BrVHVZYzVUdjlmemhrUTdjSUZYYXh0VElzaU10THRlMkV3N2tkaFJURExwOUd1ZGdUQ05FTU82bWFzSVFyeHlqTU11alpPa0tjSjhMZGFjMlQ5UGhCS1ZwcjlDbEFZS2N3NmVWMjRzcnp2SS0tZ3JVRE1vUm80Sm5Fc3dWSy0tQVY0ZmlNYk1LWHhQbGwra1hxcWVXQT09

http://preview.training.knowbe4.com/XZ3FlZlZNOVhDMEN3Q2ZsUXJtQkI2Y2JURTg3NTdleWU3cEN2NUtvWFlQV1FiTjR

unknown

There are 23 hidden URLs, click here to show them.

Domains

Name

Malicious

cdn2.hubspot.net

104.18.88.62

dttjrzjva8zho.cloudfront.net

108.139.29.30

s3.amazonaws.com

52.217.193.32

cdnjs.cloudflare.com

104.17.25.14

www.google.com

142.250.81.228

upload.wikimedia.org

208.80.154.240

secured-login.net

44.198.42.239

landing.training.knowbe4.com

44.196.92.142

ipv4.imgur.map.fastly.net

151.101.44.193

static.jobscan.co

unknown

i.imgur.com

unknown

kn0wbe4.compromisedblog.com

unknown

There are 2 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

104.18.88.62

cdn2.hubspot.net

United States

108.139.29.114

unknown

United States

44.214.113.176

unknown

United States

192.168.2.24

unknown

52.217.193.32

s3.amazonaws.com

United States

44.196.92.142

landing.training.knowbe4.com

United States

208.80.154.240

upload.wikimedia.org

United States

151.101.44.193

ipv4.imgur.map.fastly.net

United States

104.18.91.62

unknown

United States

142.250.81.228

www.google.com

United States

108.139.29.30

dttjrzjva8zho.cloudfront.net

United States

44.198.42.239

secured-login.net

United States

104.17.25.14

cdnjs.cloudflare.com

United States

There are 3 hidden IPs, click here to show them.