Windows Analysis Report
Smeg SignRequest.pdf

Overview

General Information

Sample name:	Smeg SignRequest.pdf
Analysis ID:	1499932
MD5:	609192a8242e10bb7fdb1daa294b2f4d
SHA1:	5158d75d9317bd56881b30385abe220a1b36a525
SHA256:	cddbf9c1c1de14e5f50f254ffad6d28f6a485283d25b83342a593df577bc52a3
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found potential malicious PDF (bad image similarity)

Yara detected BlockedWebSite

IP address seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://qahey.teaf-c.org/VdrOrhOG#cristina.marinello@smeg.es

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Yara detected BlockedWebSite

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_262, type: DROPPED

Source: https://qahey.teaf-c.org/VdrOrhOG#cristina.marinello@smeg.es

HTTP Parser: No favicon

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 52.202.204.11 52.202.204.11
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_262.6.dr	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: chromecache_262.6.dr	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/

System Summary

Found potential malicious PDF (bad image similarity)

Source: Smeg SignRequest.pdf

Static PDF information: Image stream: 11

Source: classification engine

Classification label: mal64.phis.winPDF@35/69@0/11

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-27 11-59-09-598.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Smeg SignRequest.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1508,i,15954673363511197786,6214592246150896982,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://tmsnp.page.link/?link=https://apps.evluator.com/widc/ggu/Y3Jpc3RpbmEubWFyaW5lbGxvQHNtZWcuZXM=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2540,i,15681474454666713540,6780072518804137637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1508,i,15954673363511197786,6214592246150896982,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2540,i,15681474454666713540,6780072518804137637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Gmail.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Google Drive.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Smeg SignRequest.pdf	Initial sample: PDF keyword /JS count = 0
Source: Smeg SignRequest.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A98293bt_1bgwf8g_5p8.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A98293bt_1bgwf8g_5p8.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Smeg SignRequest.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
52.202.204.11	unknown	United States	14618	AMAZON-AESUS	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
104.21.5.111	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.133.89	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.105.132	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	unknown	United States	15169	GOOGLEUS	false
23.200.196.138	unknown	United States	2860	NOS_COMUNICACOESPT	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://apps.evluator.com/widc/ggu/Y3Jpc3RpbmEubWFyaW5lbGxvQHNtZWcuZXM=	false		unknown
https://qahey.teaf-c.org/VdrOrhOG#cristina.marinello@smeg.es	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown

ID:	1499932
Product:	CloudBasic
Start time:	17:58:15
Start date:	27.08.2024
Sample:	Smeg SignRequest.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	609192a8242e10bb7fdb1daa294b2f4d
SHA1:	5158d75d9317bd56881b30385abe220a1b36a525
SHA256:	cddbf9c1c1de14e5f50f254ffad6d28f6a485283d25b83342a593df577bc52a3
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	C423EFFABB178CFD4C2BEEBE98FFE6A0	7036D5D0190B34E1F5E6FE8D40D87A8DAECC73C8	A0C91EAB62326A1AE18FB1066711900064E4ADC490E10A6E1267E29D990987D1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	C423EFFABB178CFD4C2BEEBE98FFE6A0	7036D5D0190B34E1F5E6FE8D40D87A8DAECC73C8	A0C91EAB62326A1AE18FB1066711900064E4ADC490E10A6E1267E29D990987D1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	55B22B39A53BB22695B63E6E60EF46DA	66E24026EFD818A5369C97E98814A6B3F041E2CE	9C9FB1BCC7BF842B0D1F2AA3B49BC6CAC7B08C22FA376F29541F381A6E422ACD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	55B22B39A53BB22695B63E6E60EF46DA	66E24026EFD818A5369C97E98814A6B3F041E2CE	9C9FB1BCC7BF842B0D1F2AA3B49BC6CAC7B08C22FA376F29541F381A6E422ACD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1a938571-9313-44c8-b5d4-4a8dff4598be.tmp	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\51a80aea-bbb6-4dc3-9262-9d8b99b9de11.tmp	JSON data	CC94E6C9320000ECA7771DF6DB11AAE4	FC8A3D0890EEE5BE1A7804E0C318F370FC2293F0	EA46F1CE746D073602B9AB0AC301B34C929CFF9B92D0B7D2FE2B4904A3BABB77
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5f713a.TMP (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	AA403350A1AB3F0B99772397FD757BBE	4C5841D1BACD54EDA5E35140F926FD4209CD326A	8DC67D132D19E36F3F9AEBD35B129BA66AAFFE5533F59DCEDF66364CD0A0817D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	926CBD1423C7A0BC39D5364BD9CDB531	7576008C85AA8B14687428C0765EDE38CF04E7C2	AE954249302EA4835B0FECF4C969C919F82BE2F1DFBD4835DDA4BC89798F2538
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	926CBD1423C7A0BC39D5364BD9CDB531	7576008C85AA8B14687428C0765EDE38CF04E7C2	AE954249302EA4835B0FECF4C969C919F82BE2F1DFBD4835DDA4BC89798F2538
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240827155913Z-222.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	B1DFEE0DAF225E30D36903B287E907E2	DF6C30765D237D8F6C5DEC6957129CC56B22B515	73632DE20754B06A30D8CE16D4B77F4F6E2B0839B206147D84A1F1881F6C40F6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3	C942224913FF6C5B210F3613C75A9089	5932A14BD0645A3D53C9B97ED10D73989EC07CDA	92C2B7A6BEC8577FEA73209E49F2C230C37F5E4DFB898A3425BF2AA85EDC880A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	D8EC091B4D986C5F13914B50373264B7	2590A4834F23D18FC6B3B72577287C3C24F29DA2	7F3E60B1AEED26D6FFB3C094E818922585DF784657C955C6946015E51461D159
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	6D7DEB239D271A5F4038267B8131519F	D1FAC9DC7E22CA7A1DBFE18CC169E79E7AECF753	4C27D534E96ABDAD6F47F6CC5DECC93AD5169CBAC20FBF01594D0CB220F4ADF0
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	FA0EFD7D6700F57A6F2C942FE85C7A4D	2A5103A9607A18006F47F0F0D35B10653EA0605C	5753D3AAFABCF407F44A861B220636E1DE400F93B06E8501DF59B44C57DC53F3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	2D1C34CDEBFB0D8E98A39630A8116237	50FDBBEEB958E262FD22AB440F2E928101DB7A68	96CEAB3EC0C805EFAFC760F367FED505098F5D96E70363A10FCF3D1A9B358003
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	7E9358B3D77E533BD9770F658BFACBE1	142D568704572A9ED4DD7751B35C17DFB59AE930	C539323BC1F3B81A7DDD7B6C5E219AD0CF27B83700097143A5B15ED69BA0886D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	FDB50D00A2B3C24A89E259FB3B421C36	55CD373804ADC1EFFA6411F7B77D9397F5CC125A	3984E1F9565A0AB43B704C8CCB671D8FE9916855D1F9C47AD9B3D74138F9D0D8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	2DAB9015286D2871DC69AD8439CEA21A	0A6321DB66BE2F2A403FC9BC6B8F13FC52B05F6E	8873E817420BFB57BF3358E1B606A04E72C7749BB60F1EC5EC3978ED014C8F07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	9BFD5ECE21B360007CA91443722C26CC	DB38D9E16931B2C1B7118E7DA993F08BE04EDEAC	E2301674759E77EFA95223D5646781D620E4464890740EE8E7D7B7136F6005A3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	BD8AC578A201BAE52A0C03D5CF4A6A1B	4B424B8FC27EFE77B99AF81CE975EB92B5C7CCE3	AEB8C7BC97D180F7CB18E34CC4A18E150B8AC23EE29E4F7090881FD64957DFAA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	A20D6F2CA12D42D0540E17BDABF8E5C5	B9055439DEBC15B3F501C2D9DCC2C8EB0C3BC357	769188DC0F4F4DCFD29DE62EEB2104212DEC8B160753E3F253518302ECCEEE93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	BAD920970D494F2E7E2DAB4C189EAAD4	87998B368F20BEEE12EA8C65E9FE1E432A634CED	2A238D20D4A10E622515CFA0D419AB1DA524062C711D1E74AFFFBA9145CE4BCE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	B8030E548C439D8EAD1C868482435C36	B720608CCCC591308CFE229641CB4A047338A519	0D9DCB70F35AFDD5EB321BF6924F9ACFCF9183B50DF08EDCA1F06D957BDB3242
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	F19237959B3EA742B61AE3085D03582E	9C8E39F62A49804B90C7142E27647CFFD4273CFA	90555C8B7D75053BC3CD26C1E5C88770DB28BD90DC22E809478B3F268E69B149
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	1FFAFE471CE5B9264AF8BEBF8AFB062A	6EDEF1DE3CBFA0AE170FBEA9775BEA3D3BFF5949	11F029690FC9D85242093773D0787F1C0C1D402C4B22099D5FC66846915985F4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	83ACDA7A92100A95AD9B940B8DBDB69A	47B22F98BF3CF4C1A08A0284AA9E2680A5EA009A	757371CD716901AB66D287185537EDC1848E463162CE55907F5114F09B4B57F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	EBF84B2A25FD6A0673C7444A1790EFC9	8E236C5A954FE71D42C2A76E4BC651AE3CCBE085	61FFC7DAE0DCC2AC730A3B61A0EEC89FC98DB99A00498F9817A22D3B7A4CF985
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	A61992BD2BC82576806DEFED6976D963	E56D07CEBBB35C45B7F1B286534AE915494D619E	ED713E069AB8BF187E0AF51C0425EB6DF62B1938D35F872F653492BC0D95DEC5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	3D440BB9DA1AAB29CCC71213106F36F4	536D11E3AED2EEBBDD4A00B067BC634D1F8971CF	74E50E4050BF755B2DEC4C1E1AAD5522A8D4CB697FA585FC484A4DEA736B4E37
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	2515FB71C5237BF220BB424810E585B9	1F2439B8C3F1CAB7D2897DA1446ABE979370D6F6	FE5DBACEBAF42761F563565813E4A15D341FDC2218F5BBCC97E8353914B86662
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	574192FCD2C321A0806FC387FC16AB99	741138BE7F7E2BB6515DCC70B929ED2F88DC0560	D64A609B64486AD63F048C6F4E085960B771AE2134D954A0829CFB2337DB6A67
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	E371E491C2BF727BDED8A09B9975789A	8F19BED8E3E6605D316741F14CDF027DBAC36A7E	737489ED80B5257DB2D0F7EFCC79D1C98EACEB084E3293E78969A5FA134D2FFF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	EBD10CA02DC557677A24CA4E856CBE9A	153A858FB1CC31DF101E4CB7746740C8F1DEDE8F	B64D2BEB8A7C8150B0BE111A3D50F6FC3BF21CF8A5DD6CDF5F12B80D9A92795C
C:\Users\user\AppData\Local\Temp\MSIf39ce.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F9C66639F54BF25F5DE2A32678A480D7	C4D60413F063CF7F311651629A547770FD06D2FE	6172708A13A5C4E29BC3F4C812B5AD7F6424AB03E1F161673557DA9CC3D00FD9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A97rpvwx_1bgwf8e_5p8.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	2256FEA23D2D4664E820C92F0FC7AAD5	7C2E5E9A99CF177FD5F3F1C6D19552CDEB382EDB	664AFEAA76A656A4621F345F69C89F0D56924E935928D2B4486C058E8302FDD9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A98293bt_1bgwf8g_5p8.tmp	PDF document, version 1.6, 0 pages	1AEC28BF77E979EB5D761B6FC7289EC2	EE5576E1FA57AAB137C1CA4C14B70D371B3EB5E0	FA07A831C67B46313778FE4D774EC71247CEA2847CDD559C472192A0334AA25F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9s197vz_1bgwf8f_5p8.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-27 11-59-09-598.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	CA31135243C52A51096DBAD9C008AB93	01AE7D6E2D49E262620D03ADD72BC49BF237EAC5	00C8AF2708A574091A7E061CCE6C201C132090D484E2B51B2C56E7CC036961F5
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	A776C2D64F169DA9A5AEADE2528F2335	C792B2800754DB324E3A7E9A396C390B76E1BD7A	C0C62FDFBC0BD447DABAD474556AFBF32A202DB67496EA962F805E6A24110587
C:\Users\user\AppData\Local\Temp\acrocef_low\1aff6733-f413-46dc-98d4-82e894d97347.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\35ead299-451e-4420-aebc-3ceac32f1b97.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\4acf0237-ec78-4ad5-8f85-81f08916a6b6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AA6641E4BFC58F44E603CD0EE74AE8FF	29F99293E45449226D99AE893FA31E428BA80BF8	0C9CEF808C626D2412A4548C0F78FAFD52A30D49C36E1ED1CDA2BBF0E1B5F2F1
C:\Users\user\AppData\Local\Temp\acrocef_low\d56a5c7d-5e4b-46cf-ae70-3d8aa7009d28.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360	9431A1C2A3C1BEFE8F3925B1B333DC34	4E77620153F74BE80B9D533FD16826A276113460	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators	32FCA302C8B872738373D7CCB1E75FD4	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:59:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EB58660D5D4547AF5A2CC2D310F06536	E5595B223138130A5537502EC645AA10BF503DF3	990F92D4F106D88B79681AAAA7118EC46AC72340AF74506130C58B9B94F2308B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:59:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CA301F812F57947ED5709FE7BB066CC2	8873CA1C315E3CF7099805D08A2C66CFE31D452C	17EE44E17C91297EC922F29608DC438D87C2C71E1E5142F3FCCF8AADC6EACE15
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EA8A00CFF8963BBF31CE6E56487513B9	904BDF7721CBD7954970508E365212D243F4AD85	A67E369A25CD866D98EE5F7D02ED09D029C6CD0373129EAE9DF753DEE9662D54
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:59:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	550E24AA3997D8928A2C2DEC593E8252	798A179482C99082C8E7E981317544E226212666	BD9C1FF687E1768BACE9F0AE284714A12BE0985389C2E05EEA8432EE1975A3F2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:59:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	BD78710F50E81B040F953C6598A763DB	BAEA805C5E5689F88F100C188A769A8645BA80E5	949F2794A8D7FD6AB8A0E291A9DD7646DCEFA18A6A43EEDFBEFD817097CDD714
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 14:59:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A1FF323896366832981F5B60277DABDB	8416CA243ACE911009F66776D0E9A10F68B17003	7624B465DC90F676AFF06C56FA54AC9AD53B1C74AF2543C90CBBBBC4CAA29FBA
Chrome Cache Entry: 260	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 261	PNG image data, 54 x 54, 8-bit colormap, non-interlaced	C33DE66281E933259772399D10A6AFE8	B9F9D500F8814381451011D4DCF59CD2D90AD94F	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
Chrome Cache Entry: 262	HTML document, ASCII text, with very long lines (394)	BE697F2521822A28441A32AA12ED349D	B4D13B45C567D83689D75C11D312488BBE787A51	7BAEA57F0FFC139624A527A9D9312EC85A3440391E3DD9C2E971124134497C9C
Chrome Cache Entry: 263	ASCII text, with very long lines (24050)	5E8C69A459A691B5D1B9BE442332C87D	F24DD1AD7C9080575D92A9A9A2C42620725EF836	84E3C77025ACE5AF143972B4A40FC834DCDFD4E449D4B36A57E62326F16B3091
Chrome Cache Entry: 264	PNG image data, 54 x 54, 8-bit colormap, non-interlaced	C33DE66281E933259772399D10A6AFE8	B9F9D500F8814381451011D4DCF59CD2D90AD94F	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016

Windows Analysis Report
Smeg SignRequest.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report Smeg SignRequest.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
Smeg SignRequest.pdf