Create Interactive Tour

Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a

Overview

General Information

Sample URL:	https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a
Analysis ID:	1653788
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected suspicious Javascript

Phishing site or detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops files with a non-matching file extension (content does not match file extension)

HTML body with high number of embedded SVGs detected

HTML page contains hidden javascript code

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5876 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,9301898467132594540,6680670018931495582,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2076 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7684 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,9301898467132594540,6680670018931495582,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5012 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 8076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Cryptography
• Phishing
• Software Vulnerabilities
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Anti Debugging

Click to jump to signature section

Show All Signature Results

Source: chromecache_685.3.dr

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_943df3a2-8

Phishing

AI detected suspicious Javascript

Source: 2.241..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: blob:https://powauthyxservfuc.de/45bea188-d6cb-446... This script demonstrates high-risk behavior by using the `eval()` function to execute dynamic code received from an untrusted source. The use of `eval()` allows for the execution of arbitrary JavaScript, which poses a significant security risk. Additionally, the lack of origin verification and the absence of a message source indicate that this script is vulnerable to cross-origin attacks and could be used to execute malicious code on the client-side.

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 0.0

OCR Text: Tools Edit Convert E-Sign Sign in x Comments 7 Comment or use @ to invite oo Please wait... oo Looks great! Approved Thanks! If this message is not eventually replaced by the proper contents of the document, click view 7 to see document. Your PDF viewer may not be able to display this type of document. O View Document Adobe 1 hour ago You can upgrade to the latest version of Adobe Reader for Windows@, Mac, or Linux@by visiting http://www.adobe.com/go/reader_download. For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader. Windows is either a registered trademark or a of Corporation, in the United States and/or other countries. Mac a trademark of Apple registered in United States other countrie is 'trademark of tunus Torvalds in the U.S, and other countries, 1 Add ernoji rans Reply Guestt Guest 1 hour ago c 1 more comment

Source: https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a

HTTP Parser: Total embedded SVG size: 867619

Source: https://powauthyxservfuc.de/seeme/re.html

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a	HTTP Parser: No favicon
Source: https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a	HTTP Parser: No favicon
Source: https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a	HTTP Parser: No favicon
Source: https://powauthyxservfuc.de/seeme/re.html	HTTP Parser: No favicon
Source: https://powauthyxservfuc.de/seeme/re.html	HTTP Parser: No favicon
Source: https://powauthyxservfuc.de/seeme/re.html	HTTP Parser: No favicon

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 45MB

Source: chromecache_654.3.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_586.3.dr	String found in binary or memory: http://feross.org
Source: chromecache_685.3.dr, chromecache_511.3.dr	String found in binary or memory: http://iso.org/pdf/ssn
Source: chromecache_685.3.dr, chromecache_511.3.dr	String found in binary or memory: http://iso.org/pdf2/ssn
Source: chromecache_455.3.dr, chromecache_664.3.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000176ff
Source: chromecache_455.3.dr, chromecache_664.3.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017701
Source: chromecache_455.3.dr, chromecache_664.3.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017702
Source: chromecache_455.3.dr, chromecache_664.3.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017703
Source: chromecache_664.3.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017704
Source: chromecache_664.3.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017706
Source: chromecache_649.3.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735dac8
Source: chromecache_649.3.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735dacd
Source: chromecache_649.3.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735dad8
Source: chromecache_649.3.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735dadb
Source: chromecache_614.3.dr	String found in binary or memory: https://adobereview.uservoice.com/forums/598411-document-review
Source: chromecache_421.3.dr	String found in binary or memory: https://assets.adobedtm.com/d4d114c60e50/a0e989131fd5/83e253a47565/RCa008e249f0d14218bd31059450a0838
Source: chromecache_417.3.dr	String found in binary or memory: https://assets.adobedtm.com/d4d114c60e50/a0e989131fd5/launch-5dd5dd2177e6.js
Source: chromecache_614.3.dr	String found in binary or memory: https://download.adobeprerelease.com/public/resource/1482219688/PreReleaseAgmt%20License-en_US-20160
Source: chromecache_654.3.dr	String found in binary or memory: https://fb.me/react-async-component-lifecycle-hooks
Source: chromecache_698.3.dr	String found in binary or memory: https://fingerprint.com)
Source: chromecache_606.3.dr	String found in binary or memory: https://ims-na1.adobelogin.com/
Source: chromecache_455.3.dr	String found in binary or memory: https://p.typekit.net/p.css?s=1&k=ubl8raj&ht=tk&f=7180.7181.7182.7184&a=7357093&app=typekit&e=css
Source: chromecache_664.3.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: chromecache_512.3.dr, chromecache_642.3.dr, chromecache_540.3.dr, chromecache_456.3.dr, chromecache_465.3.dr, chromecache_630.3.dr, chromecache_411.3.dr, chromecache_689.3.dr, chromecache_531.3.dr, chromecache_631.3.dr, chromecache_501.3.dr, chromecache_406.3.dr, chromecache_457.3.dr, chromecache_447.3.dr	String found in binary or memory: https://prod.adobeccstatic.com/License/LICENSE.txt
Source: chromecache_664.3.dr	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/a?subset_id=1&fvd=n3&v=3
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/d?subset_id=1&fvd=n3&v=3
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?subset_id=1&fvd=n3&v=3
Source: chromecache_664.3.dr	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/5c07ba/00000000000000007735dad8/30/a?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/5c07ba/00000000000000007735dad8/30/d?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/5c07ba/00000000000000007735dad8/30/l?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_664.3.dr	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/a?subset_id=1&fvd=i4&v=3
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/d?subset_id=1&fvd=i4&v=3
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/l?subset_id=1&fvd=i4&v=3
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/95bf80/00000000000000007735dacd/30/a?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/95bf80/00000000000000007735dacd/30/d?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/95bf80/00000000000000007735dacd/30/l?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_664.3.dr	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/c0160f/00000000000000007735dac8/30/a?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/c0160f/00000000000000007735dac8/30/d?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/c0160f/00000000000000007735dac8/30/l?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_664.3.dr	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/a?subset_id=1&fvd=n4&v=3
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/d?subset_id=1&fvd=n4&v=3
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?subset_id=1&fvd=n4&v=3
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/dc1cb5/00000000000000007735dadb/30/a?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/dc1cb5/00000000000000007735dadb/30/d?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_649.3.dr	String found in binary or memory: https://use.typekit.net/af/dc1cb5/00000000000000007735dadb/30/l?primer=7fa3915bdafdf03041871920a205b
Source: chromecache_664.3.dr	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/a?subset_id=1&fvd=n7&v=3
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/d?subset_id=1&fvd=n7&v=3
Source: chromecache_455.3.dr	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?subset_id=1&fvd=n7&v=3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5876_1237364222

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5876_1237364222

Jump to behavior

Source: classification engine

Classification label: mal48.phis.win@27/589@0/24

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,9301898467132594540,6680670018931495582,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2076 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,9301898467132594540,6680670018931495582,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5012 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,9301898467132594540,6680670018931495582,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2076 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,9301898467132594540,6680670018931495582,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5012 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 408	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 661
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 661	Jump to dropped file

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	1 Archive Collected Data	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://powauthyxservfuc.de/seeme/re.html	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://use.typekit.net/af/cb695f/000000000000000000017701/27/d?subset_id=1&fvd=n4&v=3	chromecache_455.3.dr	false	high
http://typekit.com/eulas/00000000000000007735dacd	chromecache_649.3.dr	false	high
https://use.typekit.net/af/5c07ba/00000000000000007735dad8/30/a?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
https://use.typekit.net/af/a2527e/000000000000000000017704/27/	chromecache_664.3.dr	false	high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?subset_id=1&fvd=n4&v=3	chromecache_455.3.dr	false	high
https://adobereview.uservoice.com/forums/598411-document-review	chromecache_614.3.dr	false	high
https://use.typekit.net/af/95bf80/00000000000000007735dacd/30/a?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
http://typekit.com/eulas/00000000000000007735dad8	chromecache_649.3.dr	false	high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/	chromecache_664.3.dr	false	high
http://typekit.com/eulas/000000000000000000017704	chromecache_664.3.dr	false	high
http://typekit.com/eulas/000000000000000000017706	chromecache_664.3.dr	false	high
https://use.typekit.net/af/5c07ba/00000000000000007735dad8/30/d?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
https://use.typekit.net/af/c0160f/00000000000000007735dac8/30/l?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
http://typekit.com/eulas/00000000000000007735dadb	chromecache_649.3.dr	false	high
https://use.typekit.net/af/dc1cb5/00000000000000007735dadb/30/a?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
http://typekit.com/eulas/0000000000000000000176ff	chromecache_455.3.dr, chromecache_664.3.dr	false	high
https://download.adobeprerelease.com/public/resource/1482219688/PreReleaseAgmt%20License-en_US-20160	chromecache_614.3.dr	false	high
http://typekit.com/eulas/000000000000000000017701	chromecache_455.3.dr, chromecache_664.3.dr	false	high
http://typekit.com/eulas/000000000000000000017702	chromecache_455.3.dr, chromecache_664.3.dr	false	high
https://use.typekit.net/af/dc1cb5/00000000000000007735dadb/30/l?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
http://typekit.com/eulas/000000000000000000017703	chromecache_455.3.dr, chromecache_664.3.dr	false	high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/	chromecache_664.3.dr	false	high
http://iso.org/pdf/ssn	chromecache_685.3.dr, chromecache_511.3.dr	false	high
https://use.typekit.net/af/95bf80/00000000000000007735dacd/30/d?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
https://use.typekit.net/af/c0160f/00000000000000007735dac8/30/d?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/d?subset_id=1&fvd=n7&v=3	chromecache_455.3.dr	false	high
https://use.typekit.net/af/5c07ba/00000000000000007735dad8/30/l?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/	chromecache_664.3.dr	false	high
https://prod.adobeccstatic.com/License/LICENSE.txt	chromecache_512.3.dr, chromecache_642.3.dr, chromecache_540.3.dr, chromecache_456.3.dr, chromecache_465.3.dr, chromecache_630.3.dr, chromecache_411.3.dr, chromecache_689.3.dr, chromecache_531.3.dr, chromecache_631.3.dr, chromecache_501.3.dr, chromecache_406.3.dr, chromecache_457.3.dr, chromecache_447.3.dr	false	high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?subset_id=1&fvd=n7&v=3	chromecache_455.3.dr	false	high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/d?subset_id=1&fvd=i4&v=3	chromecache_455.3.dr	false	high
https://fb.me/react-async-component-lifecycle-hooks	chromecache_654.3.dr	false	high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/a?subset_id=1&fvd=n3&v=3	chromecache_455.3.dr	false	high
https://assets.adobedtm.com/d4d114c60e50/a0e989131fd5/launch-5dd5dd2177e6.js	chromecache_417.3.dr	false	high
https://p.typekit.net/p.css?s=1&k=ubl8raj&ht=tk&f=7180.7181.7182.7184&a=7357093&app=typekit&e=css	chromecache_455.3.dr	false	high
https://assets.adobedtm.com/d4d114c60e50/a0e989131fd5/83e253a47565/RCa008e249f0d14218bd31059450a0838	chromecache_421.3.dr	false	high
http://fb.me/use-check-prop-types	chromecache_654.3.dr	false	high
https://use.typekit.net/af/dc1cb5/00000000000000007735dadb/30/d?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/	chromecache_664.3.dr	false	high
https://fingerprint.com)	chromecache_698.3.dr	false	high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/l?subset_id=1&fvd=i4&v=3	chromecache_455.3.dr	false	high
https://p.typekit.net/p.gif	chromecache_664.3.dr	false	high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/a?subset_id=1&fvd=i4&v=3	chromecache_455.3.dr	false	high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/d?subset_id=1&fvd=n3&v=3	chromecache_455.3.dr	false	high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?subset_id=1&fvd=n3&v=3	chromecache_455.3.dr	false	high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/	chromecache_664.3.dr	false	high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/a?subset_id=1&fvd=n7&v=3	chromecache_455.3.dr	false	high
https://use.typekit.net/af/c0160f/00000000000000007735dac8/30/a?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
http://feross.org	chromecache_586.3.dr	false	high
http://iso.org/pdf2/ssn	chromecache_685.3.dr, chromecache_511.3.dr	false	high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/a?subset_id=1&fvd=n4&v=3	chromecache_455.3.dr	false	high
https://use.typekit.net/af/95bf80/00000000000000007735dacd/30/l?primer=7fa3915bdafdf03041871920a205b	chromecache_649.3.dr	false	high
https://ims-na1.adobelogin.com/	chromecache_606.3.dr	false	high
http://typekit.com/eulas/00000000000000007735dac8	chromecache_649.3.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.204.152.162	unknown	United States	20940	AKAMAI-ASN1EU	false
35.190.80.1	unknown	United States	15169	GOOGLEUS	false
99.83.173.21	unknown	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.21.32.1	unknown	United States	13335	CLOUDFLARENETUS	false
75.2.10.96	unknown	United States	16509	AMAZON-02US	false
151.101.193.138	unknown	United States	54113	FASTLYUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
172.66.0.163	unknown	United States	13335	CLOUDFLARENETUS	false
3.87.180.44	unknown	United States	14618	AMAZON-AESUS	false
3.236.206.93	unknown	United States	14618	AMAZON-AESUS	false
104.18.20.58	unknown	United States	13335	CLOUDFLARENETUS	false
108.138.128.23	unknown	United States	16509	AMAZON-02US	false
13.35.93.11	unknown	United States	16509	AMAZON-02US	false
104.21.96.1	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.129.138	unknown	United States	54113	FASTLYUS	false
23.51.57.57	unknown	United States	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
104.18.21.58	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.40.164	unknown	United States	15169	GOOGLEUS	false
23.204.152.170	unknown	United States	20940	AKAMAI-ASN1EU	false
23.204.152.171	unknown	United States	20940	AKAMAI-ASN1EU	false
34.120.195.249	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1653788
Start date and time:	2025-04-01 16:26:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@27/589@0/24
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, BackgroundTransferHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.72.99, 142.251.40.142, 142.251.40.110, 142.251.163.84, 142.250.65.206, 142.250.80.78, 23.216.132.77, 23.216.132.52, 23.200.0.183, 23.200.0.194, 23.55.235.208, 23.55.235.200, 23.55.235.226, 23.55.235.224, 52.22.41.97, 3.233.129.217, 52.6.155.20, 3.219.243.226, 108.139.29.44, 108.139.29.32, 108.139.29.111, 108.139.29.119, 34.199.101.34, 44.198.154.229, 23.22.197.209, 34.195.209.220, 52.20.69.193, 3.213.37.111, 52.73.237.128, 3.229.180.180, 192.168.2.5, 54.224.241.105, 50.16.47.176, 34.237.241.83, 18.213.11.84, 23.33.42.132, 23.33.42.141, 3.230.130.186, 34.197.224.31, 23.53.126.45, 23.53.126.64, 142.250.80.10, 142.250.64.106, 142.251.40.106, 142.250.64.74, 142.250.176.202, 142.250.72.106, 142.251.40.170, 142.251.35.170, 142.251.40.138, 142.250.65.170, 142.251.41.10, 142.250.80.42, 142.251.40.234, 142.250.80.74, 142.250.80.106, 142.251.40.202, 199.232.210.172, 142.250.65.174, 142.250.80.110, 23.51.56.185, 142.251.40.238, 18.173.218.99, 18.173.218.90, 18.173.218.60
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.1041666318009655
Encrypted:	false
SSDEEP:	6:8IXqaC6MpeUVY2e5XjeUD1HLfoMwQH6ReZJqTqrRIhFMqpT2:ZaB6Mpd4TZwMH6RDqrRIhFtpT2
MD5:	59B9D6076753F43CA028DEE9FEEA29F9
SHA1:	E816FAB0418CDB846915289954A82FC480E06FE2
SHA-256:	6A681EFE222B475927BA2523C484514FEED51749EAC4E4D0F4AA13A3A6094531
SHA-512:	3B58611826DAAC44A0023F43E278120167DC5F35C0E7691F337707C2EC438F028653AF46A352D21575B5CBDDAEBA96165C4D21828FDBF67298EA59A1E46F8097
Malicious:	false
Reputation:	low
Preview:	.Commitment__commitmentSelector__FUh_X{padding:30px 0 25px}.Banner__banner__iSqAC .Banner__top__mhBUS{margin-top:35px}.Banner__banner__iSqAC .Banner__bottom__IGEvw{margin-bottom:29px}.Banner__priceFullDisplay__pKdJE{color:#6e6e6e;color:var(--spectrum-global-color-gray-700,#6e6e6e)}

Target ID:	0
Start time:	10:27:03
Start date:	01/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7ea940000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	10:27:07
Start date:	01/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,9301898467132594540,6680670018931495582,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2076 /prefetch:3
Imagebase:	0x7ff7ea940000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	8
Start time:	10:27:10
Start date:	01/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2044,i,9301898467132594540,6680670018931495582,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5012 /prefetch:8
Imagebase:	0x7ff7ea940000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	14
Start time:	10:27:13
Start date:	01/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a"
Imagebase:	0x7ff7ea940000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (745), with no line terminators
Category:	downloaded
Size (bytes):	745
Entropy (8bit):	4.932467956418764
Encrypted:	false
SSDEEP:	12:qTjxVh2Rc1W6YXu6TieBWsRLWWEf/EicgGbSoW8m0oQWz2GZQ+aNVI:0jHh2KIq4ow2G/WQWz2oaNVI
MD5:	7E839354B85F2E143DB501A2B85E03B6
SHA1:	9DEF67AE2244448935054EC5117ECFD492B77266
SHA-256:	674FED77505A3C0BD12DB8710AC954554558F47916C526F830308FE2B96C37CA
SHA-512:	D6940D520F465EF1CB53E6FC58CF7CED38A8F386E21D4479EDA79082B0EB27E54B9A215C83AE538C1F7C846232C8136FC4481CFA7B16ABB43C04E7D715661F03
Malicious:	false
Reputation:	low
URL:	https://acrobat.adobe.com/dcpreviewdropin/3.46.1_2.1138.0/printHelper.html
Preview:	<!doctype html><html><head><meta charset="utf-8"/><meta http-equiv="X-UA-Compatible" content="chrome=1"/><meta name="referrer" content="never"/><meta http-equiv="Content-Security-Policy" content="base-uri 'self'; block-all-mixed-content; default-src 'none'; frame-src blob:; object-src blob:;script-src 'self'; style-src 'self'; worker-src 'none';"></head><body><div id="spinner-container"><div class="spinner"><div class="track"></div><div class="fills"><div class="fillMask1"><div class="fillSubMask1"><div class="fill"></div></div></div><div class="fillMask2"><div class="fillSubMask2"><div class="fill"></div></div></div></div></div><p>Preparing the file for print.</p></div><script src="printHelper_main.fe9e0a8b.js"></script></body></html>

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	7007675
Entropy (8bit):	5.754145201807522
Encrypted:	false
SSDEEP:	49152:v9GaDiHSA7kDkRYZ8i5EAWciKKHax0cLvxxO4vXnlUswBH0KBXgbadvb5ZfI1VEE:niHSA7k4KKHaRVlcbbfiIO
MD5:	6C806A6997561DCD12B3D0D986FDFEF7
SHA1:	94946394F494F6C8DE499EE5185C05ED692F5573
SHA-256:	BEDDBD57204A3D11D39F1B5B45B197EDDB648001304FFA1F86BE374C09676988
SHA-512:	F1B3285A5905D2E229AB4727D9735236A0625BC65424F35A668025E10DB67CCFC21CB6D53ED72C90950A32AA6465BD35AF9BB0C149FCDC2411FE9FFEF70E6A45
Malicious:	false
Reputation:	low
URL:	https://commerce.adobe.com/store/_next/static/chunks/pages/_app-cdcbc7020b3d0f01.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[888,942],{579336:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.AlertMedium=s;var r,o=(r=n(667294))&&r.__esModule?r:{default:r};function i(){return i=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},i.apply(this,arguments)}function a(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0\|\|(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0\|\|Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function s(e){var t=e.scale,n=void 0===t?"M":t,r=a(e,["scale"]);return o.default.createElement("svg",i({},r,r),"L"===n&&o.default.createElement("path",{d:"M10.563 2.206l-9.249 16.55a.5.5 0 0 0 .436.744h

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	67356
Entropy (8bit):	5.448052239853968
Encrypted:	false
SSDEEP:	1536:6RmsvZwmLNzXSOLzNEEDkNdtiBj5DSWdWy+W:ajX5K4FR/
MD5:	F229AA3E668F92EFA5CBF53BF986F577
SHA1:	A0FFEE86FABA8218AB5C94C8BD833030B2C08841
SHA-256:	253DE6797359738AB8E6EFD01BEB82A4D2FF424BA05B58B32FBB51D95CF54AE7
SHA-512:	BFC451E1E3705F6A6AE81F4FBA4CCD8C2EF6C50862053815823A7DD035F0031CB58729155156EC97BED0CA8D5418AAC2F364E7EEB55A01007EAE079B60A219D5
Malicious:	false
Reputation:	low
URL:	https://acrobat.adobe.com/dc-global-nav-dropin/3.58.0_3.591.0/progress-chunk.js
Preview:	(self["webpackJsonp-global-nav"]=self["webpackJsonp-global-nav"]\|\|[]).push([[192],{MWqy:(e,t,r)=>{"use strict";t.d=function A4uAlert(e){var t=_extends({},e);return s.default.createElement("svg",_extends({viewBox:"0 0 36 36"},t,t),s.default.createElement("path",{fillRule:"evenodd",d:"M17.127,2.579.4,32.512A1,1,0,0,0,1.272,34H34.728a1,1,0,0,0,.872-1.488L18.873,2.579A1,1,0,0,0,17.127,2.579ZM20,29.5a.5.5,0,0,1-.5.5h-3a.5.5,0,0,1-.5-.5v-3a.5.5,0,0,1,.5-.5h3a.5.5,0,0,1,.5.5Zm0-6a.5.5,0,0,1-.5.5h-3a.5.5,0,0,1-.5-.5v-12a.5.5,0,0,1,.5-.5h3a.5.5,0,0,1,.5.5Z"}))};var s=function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}(r("YWiy"));function _extends(){return _extends=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var s in r)Object.prototype.hasOwnProperty.call(r,s)&&(e[s]=r[s])}return e},_extends.apply(this,arguments)}},DvDf:(e,t,r)=>{"use strict";t.F=function A4uCheckmarkCircleOutline(e){var t=_extends({},e);return s.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7104)
Category:	downloaded
Size (bytes):	7158
Entropy (8bit):	5.237955007781479
Encrypted:	false
SSDEEP:	192:vzlYPcPbYHznud1CslJGWVhCX+1dZOfCYL/aINkq:6PMYHq4NVfCE/
MD5:	3DDBE14509480BF71CEDD725E5450ECE
SHA1:	F6984DE373027FF01A96089DCC39B6A42D77B2EB
SHA-256:	751DFC51FFB21AB4B46DE1E221285AF8B73F3CF5AE26BC17B048AF63277E4C99
SHA-512:	A3F171940A118E063FFF0206106E78250C458BF2E5D88BF293F4B2D8CCE43FAC4614B9A4C7A85813D6725926FDFD6D8007DAA5AD176B13CF1E8E0F1455104433
Malicious:	false
Reputation:	low
URL:	https://acrobat.adobe.com/dc-rendition-provider/3.46.1_6.221.0/ajsProvider-chunk.js
Preview:	"use strict";(self["webpackJsonp-rendition"]=self["webpackJsonp-rendition"]\|\|[]).push([[90],{gTnC:(e,t,a)=>{a.r(t),a.d(t,{default:()=>AcrobatJSProvider});var n=a("4PKp"),i=a("plsW"),r=a("0VNB"),s=a("6Wbc");class OrganizeApisManager{constructor(){this.validIntents=["organize-pdf","delete-pages","extract-pages","insert-pdf","reorder-pages","rotate-pages","number-pages"],this.intent=null,this.nonce=null}async validateIntent(e){if(!e\|\|!this.validIntents.includes(e))throw new Error(s.Sg.INVALID_INTENT)}async organizeWillBegin(e){const{intent:t,fileUrl:a}=e;a\|\|(e.fileUrl="localFileUrl");try{await this.validateIntent(t),this.intent=t}catch(e){throw e}}static getDcApiClientId(){let e="dc-local-virgoweb";return"prod"===i.envUtil.getHostEnv()?e="dc-prod-virgoweb":"stage"===i.envUtil.getHostEnv()?e="dc-stage-virgoweb":"dev"===i.envUtil.getHostEnv()&&(e="dc-dev-virgoweb"),e}async fetchToken(){const e=(await i.providers.dcapi()).getDcapi(),t=(0,r.v4)(),a=OrganizeApisManager.getDcApiClientId();try{v

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Phishing

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 396

Chrome Cache Entry: 397

Chrome Cache Entry: 398

Chrome Cache Entry: 399

Chrome Cache Entry: 400

Chrome Cache Entry: 401

Chrome Cache Entry: 402

Chrome Cache Entry: 403

Chrome Cache Entry: 404

Chrome Cache Entry: 405

Chrome Cache Entry: 406

Chrome Cache Entry: 407

Chrome Cache Entry: 408

Chrome Cache Entry: 409

Chrome Cache Entry: 410

Chrome Cache Entry: 411

Chrome Cache Entry: 412

Chrome Cache Entry: 413

Chrome Cache Entry: 414

Chrome Cache Entry: 415

Chrome Cache Entry: 416

Chrome Cache Entry: 417

Chrome Cache Entry: 418

Chrome Cache Entry: 419

Chrome Cache Entry: 420

Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:US:3b18b23b-dd60-40b3-bef3-3c70493b338a