Edit tour

Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb

Overview

General Information

Sample URL:	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb
Analysis ID:	1676488
Infos:

Detection

Score:	0
Range:	0 - 100
Confidence:	80%

Signatures

HTTP GET or POST without a user agent

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 2312 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 3404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,4302022126679975440,89919156623736118,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2108 /prefetch:11 MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 6420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb" MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

cleanup

HTTP traffic detected: POST /ims/check/v6/token?jslVersion=v2-v0.46.0-19-g35c1ff9 HTTP/1.1host: adobeid-na1.services.adobe.comcontent-length: 667sec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"content-type: application/x-www-form-urlencoded;charset=UTF-8client_id: dc-prod-virgowebsec-ch-ua-mobile: ?0accept: */*origin: https://acrobat.adobe.comsec-fetch-site: same-sitesec-fetch-mode: corssec-fetch-dest: emptyreferer: https://acrobat.adobe.com/accept-encoding: identityaccept-language: en-US,en;q=0.9cookie: AKA_A2=Apriority: u=1, i

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: keep-aliveContent-Length: 64access-control-allow-credentials: trueaccess-control-allow-headers: authorization,x-api-key,x-request-id,if-match,accept,cache-control,uncommitted-revision,rendition-live,if-none-match,x-access-token,Uber-Trace-Id,priority,Content-Dispositionaccess-control-allow-methods: OPTIONS,GETaccess-control-allow-origin: https://acrobat.adobe.comaccess-control-expose-headers: Etag,Location,Password-Access,Retry-After,X-Latest-Version,Version,link,X-Cache,X-Request-Id,Revision,Content-Range,Accept-Rangesbuild: fa028804content-type: application/problem+jsonserver: adobex-breadcrumb-trail: INV_XPX0V8GIIE-RENS_M79R4x-request-id: ade73b1f-f09d-4033-83cb-1d7a99f64f42strict-transport-security: max-age=86400; includeSubDomainstiming-allow-origin: https://stage.acrobat.adobe.com, https://acrobat.adobe.comAccept-Ranges: bytesDate: Mon, 28 Apr 2025 16:25:39 GMTVia: 1.1 varnishX-Served-By: cache-lax-kwhp1940116-LAXX-Cache: MISSX-Cache-Hits: 0X-Timer: S1745857540.688380,VS0,VE144Vary: origin,priority,Accept,rendition-live
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenserver: nginxdate: Mon, 28 Apr 2025 16:25:56 GMTcontent-type: text/htmlcontent-length: 548strict-transport-security: max-age=31536000; includeSubDomains; preloadvia: 1.1 googlealt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-request-id: 022a854d-edee-49a6-9dd1-e22bc48b4811-3f6ddaae3960457cvary: Origindate: Mon, 28 Apr 2025 16:25:56 GMTx-konductor: 25.3.31:c98864238x-adobe-edge: OR2;9server: jagcontent-length: 0cross-origin-resource-policy: cross-originstrict-transport-security: max-age=31536000; includeSubDomainscache-control: no-cache, no-store, max-age=0, no-transform, privatex-xss-protection: 1; mode=blockx-content-type-options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenx-request-id: ac67b325-42cc-471f-b40d-725cd6156155content-type: application/jsoncontent-length: 92date: Mon, 28 Apr 2025 16:25:58 GMTserver: adobe
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenx-request-id: 4e802268-00bb-4591-b365-dc873a80a24acontent-type: application/jsoncontent-length: 92date: Mon, 28 Apr 2025 16:26:03 GMTserver: adobe
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenx-request-id: 6fd1bf4f-f8a2-4f2a-a9ed-5c1cd0d38f69content-type: application/jsoncontent-length: 92date: Mon, 28 Apr 2025 16:26:04 GMTserver: adobe

Source: unknown	Network traffic detected: HTTP traffic on port 60850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60938
Source: unknown	Network traffic detected: HTTP traffic on port 60928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60937
Source: unknown	Network traffic detected: HTTP traffic on port 60831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60851
Source: unknown	Network traffic detected: HTTP traffic on port 60919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60850
Source: unknown	Network traffic detected: HTTP traffic on port 60863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60890
Source: unknown	Network traffic detected: HTTP traffic on port 60943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60936
Source: unknown	Network traffic detected: HTTP traffic on port 60938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60933
Source: unknown	Network traffic detected: HTTP traffic on port 60829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60896
Source: unknown	Network traffic detected: HTTP traffic on port 60849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60829
Source: unknown	Network traffic detected: HTTP traffic on port 60927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60863
Source: unknown	Network traffic detected: HTTP traffic on port 60907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60919
Source: unknown	Network traffic detected: HTTP traffic on port 60959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60959
Source: unknown	Network traffic detected: HTTP traffic on port 60879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60873
Source: unknown	Network traffic detected: HTTP traffic on port 60832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60955
Source: unknown	Network traffic detected: HTTP traffic on port 60888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60831
Source: unknown	Network traffic detected: HTTP traffic on port 60869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60951
Source: unknown	Network traffic detected: HTTP traffic on port 60908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60849
Source: unknown	Network traffic detected: HTTP traffic on port 60857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60881
Source: unknown	Network traffic detected: HTTP traffic on port 60921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60880
Source: unknown	Network traffic detected: HTTP traffic on port 60942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60925
Source: unknown	Network traffic detected: HTTP traffic on port 60925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60921
Source: unknown	Network traffic detected: HTTP traffic on port 60889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60920
Source: unknown	Network traffic detected: HTTP traffic on port 60868 -> 443

Source: unknown	HTTPS traffic detected: 3.167.192.22:443 -> 192.168.2.24:60850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.0.163:443 -> 192.168.2.24:60851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.140.36.51:443 -> 192.168.2.24:60849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.138:443 -> 192.168.2.24:60854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.238.109.70:443 -> 192.168.2.24:60857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.101.57:443 -> 192.168.2.24:60868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.0.163:443 -> 192.168.2.24:60863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.140.37.206:443 -> 192.168.2.24:60858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.156:443 -> 192.168.2.24:60856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.148:443 -> 192.168.2.24:60860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.101.57:443 -> 192.168.2.24:60873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.0.163:443 -> 192.168.2.24:60875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.236.206.94:443 -> 192.168.2.24:60869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.24:60878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.156:443 -> 192.168.2.24:60879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.195.249:443 -> 192.168.2.24:60880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.21.58:443 -> 192.168.2.24:60881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.167.192.22:443 -> 192.168.2.24:60888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.148:443 -> 192.168.2.24:60889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.24:60890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.213.188.57:443 -> 192.168.2.24:60893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.210.40.188:443 -> 192.168.2.24:60896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.170.167.46:443 -> 192.168.2.24:60907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.87.42:443 -> 192.168.2.24:60909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.138:443 -> 192.168.2.24:60919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.0.163:443 -> 192.168.2.24:60920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.0.163:443 -> 192.168.2.24:60921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.195.249:443 -> 192.168.2.24:60925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.140.36.145:443 -> 192.168.2.24:60927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.207:443 -> 192.168.2.24:60928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.167.192.22:443 -> 192.168.2.24:60932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.196.42.146:443 -> 192.168.2.24:60933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.156:443 -> 192.168.2.24:60936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.148:443 -> 192.168.2.24:60937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 75.2.10.96:443 -> 192.168.2.24:60938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.170.167.46:443 -> 192.168.2.24:60942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.87.42:443 -> 192.168.2.24:60943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 75.2.10.96:443 -> 192.168.2.24:60951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.24:60957 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@22/309@62/531

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,4302022126679975440,89919156623736118,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2108 /prefetch:11
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2016,i,4302022126679975440,89919156623736118,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2108 /prefetch:11
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Extra Window Memory Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

No bigger version

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://cdn-sharing.adobecc.com/rendition/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb;page=0;size=1200;type=image%2Fjpeg?access_token=1745895982_urn%3Aaaid%3Asc%3AVA6C2%3A89974d08-1426-484a-a131-f49c32dc1feb%3Bpublic_5d718b8953eec3bb42f28e24cdefe66242f3ca64&api_key=dc_sendtrack	0%	Avira URL Cloud	safe
https://cdn-sharing.adobecc.com/rendition/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb;page=1;size=1200;type=image%2Fjpeg?access_token=1745895982_urn%3Aaaid%3Asc%3AVA6C2%3A89974d08-1426-484a-a131-f49c32dc1feb%3Bpublic_5d718b8953eec3bb42f28e24cdefe66242f3ca64&api_key=dc_sendtrack	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ims-na1.adobelogin.com.cdn.cloudflare.net	172.66.0.163	true	false	unknown
api.echosign.com	3.236.206.94	true	false	high
detect.adobedccdn.com	127.0.0.1	true	false	high
dc-api-v2-prod-bh-facade.adobe.io	44.196.228.180	true	false	unknown
a1874.dscg1.akamai.net	23.220.73.148	true	false	high
adobetarget.data.adobedc.net	63.140.36.51	true	false	high
adobe.com.ssl.d1.sc.omtrdc.net	63.140.37.206	true	false	unknown
e119011.b.akamaiedge.net	23.62.226.163	true	false	unknown
www.google.com	142.250.69.4	true	false	high
by2.uservoice.com	104.18.20.58	true	false	high
prod.adobeccstatic.com	3.167.192.22	true	false	high
ethos503-prod-va6-k8s-p2-0-ce09078037a86341.elb.us-east-1.amazonaws.com	44.213.188.57	true	false	unknown
ethos551-prod-va6-k8s-p2-0-ae4ec75f18def055.elb.us-east-1.amazonaws.com	35.170.167.46	true	false	unknown
dd20fzx9mj46f.cloudfront.net	18.238.109.70	true	false	unknown
privacycollector-production-457481513.us-east-1.elb.amazonaws.com	3.217.152.210	true	false	unknown
use1-turn.fpjs.io	18.212.47.155	true	false	high
widget.uservoice.com	104.18.21.58	true	false	high
cdn-sharing.adobecc.map.fastly.net	151.101.193.138	true	false	unknown
ethos501-prod-va6-k8s-p2-0-3c24549beaaa9b20.elb.us-east-1.amazonaws.com	18.210.40.188	true	false	unknown
e7808.dscg.akamaiedge.net	23.194.101.57	true	false	high
o4505393339695104.ingest.us.sentry.io	34.120.195.249	true	false	high
dc-api-prod-bh-facade.adobe.io	3.233.142.19	true	false	unknown
use1.fptls.com	75.2.10.96	true	false	high
cdn.cookielaw.org	104.18.87.42	true	false	high
a1988.dscg1.akamai.net	23.220.73.156	true	false	high
assets-download-legacy.adobe.io	44.196.228.180	true	false	unknown
c.evidon.com	unknown	unknown	false	high
ims-na1.adobelogin.com	unknown	unknown	false	high
dc-api-v2.adobecontent.io	unknown	unknown	false	high
adobe.tt.omtrdc.net	unknown	unknown	false	high
cdn-sharing.adobecc.com	unknown	unknown	false	high
static.adobelogin.com	unknown	unknown	false	high
_49100._https.detect.adobedccdn.com	unknown	unknown	false	unknown
use.typekit.net	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
_39691._https.detect.adobedccdn.com	unknown	unknown	false	unknown
l.betrad.com	unknown	unknown	false	high
p.typekit.net	unknown	unknown	false	high
_19292._https.detect.adobedccdn.com	unknown	unknown	false	unknown
dc-api.adobecontent.io	unknown	unknown	false	high
files-download2.acrocomcontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn-sharing.adobecc.com/rendition/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb;page=0;size=1200;type=image%2Fjpeg?access_token=1745895982_urn%3Aaaid%3Asc%3AVA6C2%3A89974d08-1426-484a-a131-f49c32dc1feb%3Bpublic_5d718b8953eec3bb42f28e24cdefe66242f3ca64&api_key=dc_sendtrack	false	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/gsr1.crl	false		high
http://c.pki.goog/r/r4.crl	false		high
http://c.pki.goog/r/r1.crl	false		high
https://cdn-sharing.adobecc.com/rendition/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb;page=1;size=1200;type=image%2Fjpeg?access_token=1745895982_urn%3Aaaid%3Asc%3AVA6C2%3A89974d08-1426-484a-a131-f49c32dc1feb%3Bpublic_5d718b8953eec3bb42f28e24cdefe66242f3ca64&api_key=dc_sendtrack	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.1.138	unknown	United States	54113	FASTLYUS	false
23.62.226.237	unknown	United States	20940	AKAMAI-ASN1EU	false
44.213.188.57	ethos503-prod-va6-k8s-p2-0-ce09078037a86341.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
192.178.49.202	unknown	United States	15169	GOOGLEUS	false
54.227.187.23	unknown	United States	14618	AMAZON-AESUS	false
3.231.80.106	unknown	United States	14618	AMAZON-AESUS	false
18.238.109.52	unknown	United States	16509	AMAZON-02US	false
23.220.73.11	unknown	United States	13489	EPMTelecomunicacionesSAESPCO	false
34.196.42.146	unknown	United States	14618	AMAZON-AESUS	false
23.220.73.156	a1988.dscg1.akamai.net	United States	13489	EPMTelecomunicacionesSAESPCO	false
18.65.3.38	unknown	United States	3	MIT-GATEWAYSUS	false
63.140.36.145	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
107.22.247.231	unknown	United States	14618	AMAZON-AESUS	false
44.198.86.118	unknown	United States	14618	AMAZON-AESUS	false
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
104.18.87.42	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
18.65.3.93	unknown	United States	3	MIT-GATEWAYSUS	false
75.2.10.96	use1.fptls.com	United States	16509	AMAZON-02US	false
151.101.193.138	cdn-sharing.adobecc.map.fastly.net	United States	54113	FASTLYUS	false
23.220.73.207	unknown	United States	13489	EPMTelecomunicacionesSAESPCO	false
142.250.68.227	unknown	United States	15169	GOOGLEUS	false
172.66.0.163	ims-na1.adobelogin.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
44.196.228.180	dc-api-v2-prod-bh-facade.adobe.io	United States	14618	AMAZON-AESUS	false
52.5.13.197	unknown	United States	14618	AMAZON-AESUS	false
3.233.142.19	dc-api-prod-bh-facade.adobe.io	United States	14618	AMAZON-AESUS	false
34.231.53.248	unknown	United States	14618	AMAZON-AESUS	false
3.236.206.94	api.echosign.com	United States	14618	AMAZON-AESUS	false
142.250.68.234	unknown	United States	15169	GOOGLEUS	false
18.235.168.50	unknown	United States	14618	AMAZON-AESUS	false
23.62.226.177	unknown	United States	20940	AKAMAI-ASN1EU	false
18.238.109.32	unknown	United States	16509	AMAZON-02US	false
142.250.68.238	unknown	United States	15169	GOOGLEUS	false
18.238.109.70	dd20fzx9mj46f.cloudfront.net	United States	16509	AMAZON-02US	false
54.144.73.197	unknown	United States	14618	AMAZON-AESUS	false
142.250.101.84	unknown	United States	15169	GOOGLEUS	false
18.155.173.103	unknown	United States	16509	AMAZON-02US	false
23.194.101.57	e7808.dscg.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
104.18.21.58	widget.uservoice.com	United States	13335	CLOUDFLARENETUS	false
18.210.40.188	ethos501-prod-va6-k8s-p2-0-3c24549beaaa9b20.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
3.217.38.174	unknown	United States	14618	AMAZON-AESUS	false
23.62.226.166	unknown	United States	20940	AKAMAI-ASN1EU	false
3.167.192.22	prod.adobeccstatic.com	United States	16509	AMAZON-02US	false
23.194.100.185	unknown	United States	16625	AKAMAI-ASUS	false
23.62.226.163	e119011.b.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
35.170.167.46	ethos551-prod-va6-k8s-p2-0-ae4ec75f18def055.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
23.62.226.162	unknown	United States	20940	AKAMAI-ASN1EU	false
63.140.37.206	adobe.com.ssl.d1.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
18.214.244.253	unknown	United States	14618	AMAZON-AESUS	false
23.220.73.148	a1874.dscg1.akamai.net	United States	13489	EPMTelecomunicacionesSAESPCO	false
18.155.173.16	unknown	United States	16509	AMAZON-02US	false
63.140.36.51	adobetarget.data.adobedc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
34.193.227.236	unknown	United States	14618	AMAZON-AESUS	false
34.120.195.249	o4505393339695104.ingest.us.sentry.io	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1
192.168.2.24
192.168.2.15

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1676488
Start date and time:	2025-04-28 18:24:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@22/309@62/531

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 104.18.38.233, 172.64.149.23
Excluded domains from analysis (whitelisted): crt.comodoca.com.cdn.cloudflare.net, crt.comodoca.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb

Source: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb	HTTP Parser: No favicon
Source: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb	HTTP Parser: No favicon
Source: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb	HTTP Parser: No favicon

Source: global traffic	HTTP traffic detected: GET /users/ai/limits HTTP/1.1host: dc-genai-access-provisioning-api.adobe.iosec-ch-ua-platform: "Windows"authorization: eyJhbGciOiJSUzI1NiIsIng1dSI6Imltc19uYTEta2V5LWd0LTEuY2VyIiwia2lkIjoiaW1zX25hMS1rZXktZ3QtMSIsInR5cCI6ImF0K2p3dCIsImNyaXQiOlsiZW52Il0sImVudiI6Imltcy1uYTEifQ.eyJqdGkiOiIxNzQ1ODU3NTM4ODkyXzIwNzkwNjJjLWEwODMtNDg1YS05OWI4LTNiOWY3M2Q0MjU2MF91dzIiLCJjbGllbnRfaWQiOiJkYy1wcm9kLXZpcmdvd2ViIiwic3ViIjoiMTc0NTg1NzUzODg5MV8xNTNhZDZhZS02MDllLTQ4MzItYTkyNy01YzBjZDYxMTEzZjZAR3Vlc3RJRCIsImlzcyI6Imh0dHBzOi8vaW1zLW5hMS5hZG9iZWxvZ2luLmNvbS9pbXMiLCJpYXQiOjE3NDU4NTc1MzgsImdkaSI6IjE3NDU4NTc1Mzg4OTFfMmMxZTcxOTEtZWYwNy00MDcyLWIzZjQtYzBmYmQ0Y2M4ZmFlIiwiZXhwIjoxNzQ1ODYxMTM4LCJhdHAiOiJndWVzdCIsInNjYyI6IlVTIiwiZ3NlIjoxNzQ1OTQzOTM4LCJnZGUiOjE3NDgyNzY3MzgsInNjb3BlIjoiQWRvYmVJRCBvcGVuaWQgRENBUEkgYWRkaXRpb25hbF9pbmZvLmFjY291bnRfdHlwZSBhZGRpdGlvbmFsX2luZm8ub3B0aW9uYWxBZ3JlZW1lbnRzIGFncmVlbWVudF9zaWduIGFncmVlbWVudF9zZW5kIHNpZ25fbGlicmFyeV93cml0ZSBzaWduX3VzZXJfcmVhZCBzaWduX3VzZXJfd3JpdGUgYWdyZWVtZW50X3JlYWQgYWdyZWVtZW50X3dyaXRlIHdpZGdldF9yZWFkIHdpZGdldF93cml0ZSB3b3JrZmxvd19yZWFkIHdvcmtmbG93X3dyaXRlIHNpZ25fbGlicmFyeV9yZWFkIHNpZ25fdXNlcl9sb2dpbiBzYW8uQUNPTV9FU0lHTl9UUklBTCBlZS5kY3dlYiB0a19wbGF0Zm9ybSB0a19wbGF0Zm9ybV9zeW5jIGFiLm1hbmFnZSBhZGRpdGlvbmFsX2luZm8uaW5jb21wbGV0ZSBhZGRpdGlvbmFsX2luZm8uY3JlYXRpb25fc291cmNlIGFkZGl0aW9uYWxfaW5mby5yb2xlcyBwcHMucmVhZCByZWFkX29yZ2FuaXphdGlvbnMgYWNjb3VudF9jbHVzdGVyLnJlYWQgdXBkYXRlX3Byb2ZpbGUuZmlyc3RfbmFtZSB1cGRhdGVfcHJ
Source: global traffic	HTTP traffic detected: GET /users/ai/limits HTTP/1.1host: dc-genai-access-provisioning-api.adobe.iosec-ch-ua-platform: "Windows"authorization: eyJhbGciOiJSUzI1NiIsIng1dSI6Imltc19uYTEta2V5LWd0LTEuY2VyIiwia2lkIjoiaW1zX25hMS1rZXktZ3QtMSIsInR5cCI6ImF0K2p3dCIsImNyaXQiOlsiZW52Il0sImVudiI6Imltcy1uYTEifQ.eyJqdGkiOiIxNzQ1ODU3NTM4ODkyXzIwNzkwNjJjLWEwODMtNDg1YS05OWI4LTNiOWY3M2Q0MjU2MF91dzIiLCJjbGllbnRfaWQiOiJkYy1wcm9kLXZpcmdvd2ViIiwic3ViIjoiMTc0NTg1NzUzODg5MV8xNTNhZDZhZS02MDllLTQ4MzItYTkyNy01YzBjZDYxMTEzZjZAR3Vlc3RJRCIsImlzcyI6Imh0dHBzOi8vaW1zLW5hMS5hZG9iZWxvZ2luLmNvbS9pbXMiLCJpYXQiOjE3NDU4NTc1MzgsImdkaSI6IjE3NDU4NTc1Mzg4OTFfMmMxZTcxOTEtZWYwNy00MDcyLWIzZjQtYzBmYmQ0Y2M4ZmFlIiwiZXhwIjoxNzQ1ODYxMTM4LCJhdHAiOiJndWVzdCIsInNjYyI6IlVTIiwiZ3NlIjoxNzQ1OTQzOTM4LCJnZGUiOjE3NDgyNzY3MzgsInNjb3BlIjoiQWRvYmVJRCBvcGVuaWQgRENBUEkgYWRkaXRpb25hbF9pbmZvLmFjY291bnRfdHlwZSBhZGRpdGlvbmFsX2luZm8ub3B0aW9uYWxBZ3JlZW1lbnRzIGFncmVlbWVudF9zaWduIGFncmVlbWVudF9zZW5kIHNpZ25fbGlicmFyeV93cml0ZSBzaWduX3VzZXJfcmVhZCBzaWduX3VzZXJfd3JpdGUgYWdyZWVtZW50X3JlYWQgYWdyZWVtZW50X3dyaXRlIHdpZGdldF9yZWFkIHdpZGdldF93cml0ZSB3b3JrZmxvd19yZWFkIHdvcmtmbG93X3dyaXRlIHNpZ25fbGlicmFyeV9yZWFkIHNpZ25fdXNlcl9sb2dpbiBzYW8uQUNPTV9FU0lHTl9UUklBTCBlZS5kY3dlYiB0a19wbGF0Zm9ybSB0a19wbGF0Zm9ybV9zeW5jIGFiLm1hbmFnZSBhZGRpdGlvbmFsX2luZm8uaW5jb21wbGV0ZSBhZGRpdGlvbmFsX2luZm8uY3JlYXRpb25fc291cmNlIGFkZGl0aW9uYWxfaW5mby5yb2xlcyBwcHMucmVhZCByZWFkX29yZ2FuaXphdGlvbnMgYWNjb3VudF9jbHVzdGVyLnJlYWQgdXBkYXRlX3Byb2ZpbGUuZmlyc3RfbmFtZSB1cGRhdGVfcHJ

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: adobe.tt.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: prod.adobeccstatic.com
Source: global traffic	DNS traffic detected: DNS query: widget.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: static.adobelogin.com
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net
Source: global traffic	DNS traffic detected: DNS query: l.betrad.com
Source: global traffic	DNS traffic detected: DNS query: ims-na1.adobelogin.com
Source: global traffic	DNS traffic detected: DNS query: cdn-sharing.adobecc.com
Source: global traffic	DNS traffic detected: DNS query: files-download2.acrocomcontent.com
Source: global traffic	DNS traffic detected: DNS query: dc-api-v2.adobecontent.io
Source: global traffic	DNS traffic detected: DNS query: dc-api.adobecontent.io
Source: global traffic	DNS traffic detected: DNS query: c.evidon.com
Source: global traffic	DNS traffic detected: DNS query: by2.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: api.echosign.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: o4505393339695104.ingest.us.sentry.io
Source: global traffic	DNS traffic detected: DNS query: detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: _19292._https.detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: _39691._https.detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: _49100._https.detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: use1.fptls.com
Source: global traffic	DNS traffic detected: DNS query: use1-turn.fpjs.io

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4027), with no line terminators
Category:	downloaded
Size (bytes):	4027
Entropy (8bit):	5.132550923763104
Encrypted:	false
SSDEEP:
MD5:	6BEBDDD270485BEA51C20DFBE40562E9
SHA1:	D92A128B5B666F08491DFB13B163CACF33C47D6E
SHA-256:	9C2487BD7B9E8B54C7444469589FE7269EB62CEA2231B0ADC1384E5D83BF424F
SHA-512:	CA371EF06295FF5E4DAE3977C9383AAEF362A2908368BA85D888A08AF59B505C676ACDF315E23F914E383A7F4B94E1A3B3CCC288B445C301785A3B7266E5A446
Malicious:	false
Reputation:	unknown
URL:	https://commerce.adobe.com/mini-apps/_next/static/G6i21kTnMD9SEGwWXwm6j/_buildManifest.js
Preview:	self.__BUILD_MANIFEST=function(a,c,s,t,e,n,d,i,f,h,u,b,r,k,l,p,o,j,g,m,_,w,y,v,I){return{__rewrites:{beforeFiles:[],afterFiles:[],fallback:[]},"/_error":["static/chunks/pages/_error-cd3a4dcc303cc09fa80f.js"],"/academic-verification":[n,a,c,s,t,u,b,r,"static/chunks/3605-5385de9944ec34714b25.js","static/chunks/pages/academic-verification.ad67eeee.css","static/chunks/pages/academic-verification-c9d6b6102f1bb0197fa8.js"],"/add-product":[n,f,"static/chunks/efe3cd49-9ec6a1c86af94bd9d2a5.js",a,c,s,t,e,d,i,h,u,b,k,l,r,p,j,g,_,w,y,"static/chunks/7821-07ddcfc729ecc59bdbf0.js","static/chunks/pages/add-product.e6237b99.css","static/chunks/pages/add-product-e737315372abd9cf7903.js"],"/aem-validator":[a,c,"static/chunks/pages/aem-validator.32c73a60.css","static/chunks/pages/aem-validator-a1e153ffda2ad398849c.js"],"/aep":[g,"static/chunks/pages/aep-2c49cfc513f325f8a758.js"],"/analytics":["static/chunks/pages/analytics-a48341cfa418a0ea1471.js"],"/auth-message-handler":["static/chunks/pages/auth-messag

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	65644
Entropy (8bit):	4.693089206172513
Encrypted:	false
SSDEEP:
MD5:	BD2ED71CEB43E59EEDBA5BA5F077C626
SHA1:	9F8D9D927390F493F395C9D8D74F53CF65518977
SHA-256:	484A8264645A628CC5EDFB67EBC4AB4F7B5CD2D2B2ADE615FD40F6E03A2B7D93
SHA-512:	52EC2F03EFB197FB59A8C92AF4B29B82DC3248BCA1669F5A2237C39526A6DA97C8B88680FCBD1F724BCD4161254BF5949178E1D02B4D066C8BD2F85E0A328F8C
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-organize-verbs-dropin/3.17.1_2.687.0/tile-icons.js
Preview:	(self["webpackJsonp-organize-verbs"]=self["webpackJsonp-organize-verbs"]\|\|[]).push([[7979,5092,7760],{"8BCc":(e,l,t)=>{var a=t("YWiy");function A12SplitPdf24(e){return a.createElement("svg",e,a.createElement("g",{id:"A12_Split-pdf_24",stroke:"none",strokeWidth:"1",fill:"none",fillRule:"evenodd"},a.createElement("g",{transform:"translate(1.000000, 0.000000)",fill:"#D7373F",fillRule:"nonzero"},[a.createElement("path",{d:"M12.6767776,1.00019208 L12.7879026,1.00726736 C12.9708813,1.03121746 13.1409678,1.11520928 13.2720072,1.24802135 L13.2720072,1.24802135 L16.7437634,4.53199165 L16.8190863,4.61827384 C16.9345681,4.76956131 16.9989527,4.95637301 17.0000125,5.15028646 L17.0000125,5.15028646 L16.996,14.5241921 L15.6020907,12.7990162 L15.4644298,12.6188526 L15.328728,12.4562013 C14.7276523,11.782684 13.9280674,11.4792957 12.9717792,11.9811074 L12.9717792,11.9811074 L12.8155145,12.0784151 L12.6719914,12.1911613 C11.9008581,12.8438333 11.8425584,13.7245285 12.2954091,14.5178627 C12.3066131,14.5

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (37940), with no line terminators
Category:	downloaded
Size (bytes):	37942
Entropy (8bit):	4.757754161553184
Encrypted:	false
SSDEEP:
MD5:	BCE51C6FBE6961AB4DDC7F4239C3C81D
SHA1:	59DFDB16B6F68817880181D4D884DC77D0AD36C7
SHA-256:	04DB853F1C574A1C360802941A153951D4D0C65F4BD300D91105367C5F41C838
SHA-512:	0BA6EBBFF83A7EA853AC8F9A59B60918AEA6966200F86974D677D20330762C07256B05064A1B27CC1FB3CDA2EBB0C338C48DFF49E159B56AA5793FFF779CEF83
Malicious:	false
Reputation:	unknown
URL:	https://acrobat.adobe.com/dc-sign-dropin/3.22.0_3.444.0/translations-[request]-chunk.js
Preview:	"use strict";(self["webpackJsonp-sign"]=self["webpackJsonp-sign"]\|\|[]).push([[3023],{t39f:e=>{e.exports=JSON.parse('{"agreement_already_expired.APPROVER":"This document has expired and can no longer be approved.","agreement_already_expired.SIGNER":"This document has expired and can no longer be signed.","agreement_already_expired.DELEGATE_TO_SIGNER":"This document has expired and can no longer be signed.","agreement_already_expired.DELEGATE_TO_APPROVER":"This document has expired and can no longer be approved.","agreement_already_expired.ACCEPTOR":"This document has expired and can no longer be accepted.","agreement_already_expired.CERTIFIED_RECIPIENT":"This document has expired and its receipt can no longer be acknowledged.","agreement_already_expired.FORM_FILLER":"This document has expired and can no longer be filled.","agreement_already_expired.DELEGATE_TO_ACCEPTOR":"This document has expired and can no longer be accepted.","agreement_already_expired.DELEGATE_TO_CERTIFIED_RECIPIENT"

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 413

Chrome Cache Entry: 415

Chrome Cache Entry: 416

Chrome Cache Entry: 417

Chrome Cache Entry: 419

Chrome Cache Entry: 421

Chrome Cache Entry: 422

Chrome Cache Entry: 423

Chrome Cache Entry: 424

Chrome Cache Entry: 425

Chrome Cache Entry: 426

Chrome Cache Entry: 427

Chrome Cache Entry: 428

Chrome Cache Entry: 429

Chrome Cache Entry: 430

Chrome Cache Entry: 431

Chrome Cache Entry: 432

Chrome Cache Entry: 433

Chrome Cache Entry: 434

Chrome Cache Entry: 435

Chrome Cache Entry: 436

Chrome Cache Entry: 437

Chrome Cache Entry: 438

Chrome Cache Entry: 440

Chrome Cache Entry: 441

Chrome Cache Entry: 442

Chrome Cache Entry: 443

Chrome Cache Entry: 444

Chrome Cache Entry: 445

Chrome Cache Entry: 446

Chrome Cache Entry: 447

Chrome Cache Entry: 448

Chrome Cache Entry: 449

Chrome Cache Entry: 450

Chrome Cache Entry: 451

Chrome Cache Entry: 452

Chrome Cache Entry: 453

Chrome Cache Entry: 454

Chrome Cache Entry: 455

Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:89974d08-1426-484a-a131-f49c32dc1feb