Windows Analysis Report
Faisal Ahmad.pdf

Overview

General Information

Sample name:	Faisal Ahmad.pdf
Analysis ID:	1500511
MD5:	5542eb9a328dabc039eb82c911ec2952
SHA1:	4b9cf91bec4cf36c54af40b0ec5c8ae71016571e
SHA256:	fe7dbe67590f1bd9e360ec098514983d8c8f9ac04482b7951181c058128d32e2

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.17:49710
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.17:49710 -> 23.203.104.175:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: classification engine

Classification label: clean1.winPDF@18/47@0/66

Source: Faisal Ahmad.pdf

Initial sample: file:///C:/Users/fa6936/OneDrive%20-%20AT&T%20Services,%20Inc/Documents/Faisal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\6e161222-f5d2-4c31-8037-dfaeb49751d7

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File created: C:\Users\user\AppData\Local\Temp\acrocef_low\4cdc42c3-3e60-4f53-b427-6e8076f68471.tmp

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Faisal Ahmad.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1600,i,11690975926690780445,5659053138094850307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1600,i,11690975926690780445,5659053138094850307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 3E91A453DAC0AE739C414AFC3051D0C6
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Faisal Ahmad.pdf	Initial sample: PDF keyword /JS count = 0
Source: Faisal Ahmad.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Faisal Ahmad.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Faisal Ahmad.pdf

Initial sample: PDF keyword obj count = 85

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.144.73.197	unknown	United States	14618	AMAZON-AESUS	false
2.19.126.163	unknown	European Union	16625	AKAMAI-ASUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
23.203.104.175	unknown	United States	16625	AKAMAI-ASUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
2.16.202.123	unknown	European Union	16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true

ID:	1500511
Product:	CloudBasic
Start time:	15:41:29
Start date:	28.08.2024
Sample:	Faisal Ahmad.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	5542eb9a328dabc039eb82c911ec2952
SHA1:	4b9cf91bec4cf36c54af40b0ec5c8ae71016571e
SHA256:	fe7dbe67590f1bd9e360ec098514983d8c8f9ac04482b7951181c058128d32e2
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	2A107DC302FD31E3FA91E91A12000B5A	2320ADDC385C0ADAD5959F9EFA612B1E8F27C906	17ED4C9EDBF6A5F157E0BF07255C5081C7E72E4FFAE1E6F453B06645901AD079
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	8A91489ACA2D49E82267B0A601C15D51	B3DC8B92F353DA3259FF4DE6A705ED2899EEB0C1	6060FCE3F6348E540758EC574B11D81B1E52182C29276F8C7C9A2D73AA9D274C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	3D9EBA638B994F6FC3BEA4AB1A506BF1	98195EEF76FC884B5FA2D39125354AEDEFAA26C8	FF628C141FAEE6915035541625F029D56A15F96C77D552064B5AB410E2F1ABE8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b36f83a8-564f-47be-87af-6d9764bf788f.tmp	JSON data	3D9EBA638B994F6FC3BEA4AB1A506BF1	98195EEF76FC884B5FA2D39125354AEDEFAA26C8	FF628C141FAEE6915035541625F029D56A15F96C77D552064B5AB410E2F1ABE8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	10999ECD316C79D3AD5D5170280E2EF2	FBB18F3FA5145A7576032DC0F3186C6F616C9D5A	4FD89FD388839CBD510BE0AE2DF021EC4153ED05471646BCAFC5E31001BB0D6B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	465EF03CAABB1DB2A282FBA2A252A9E6	38A9A42D6C7E74C818F12AB849F0D4BE57714F85	FC28DC603FAD7B1C3D03E7D0C5A7663CF19604023CD6A0F2BBB668535AE02A07
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log	data	4EEC23DCD60815EAF8280F4672745886	20C8C96F5B695670C83FB6641B8FB9AC6462831A	A59904A39B75C4637C1C46D865788CD05B8DCD6C31B88E8942051C24F2AEFC51
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG	ASCII text	5D7815108E333AAB7E97F96A4676E7DC	A2DF2DE87BD198D71D6B0C29C5DA61FC9A297757	1EF05A1A040AB11AB84141574AE074924FCE17C8D7F839E7C7E9FE58854A777D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000001.dbtmp	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log	data	A05963DD9E2C7C3F13C18A9245AD5934	15A87493591860C6C22499DF3A705ACB3CB466BD	F40B7EF0FE0B676871403B8DD21CE42AF8E482DC8B81F09D93CB2C48CCD112B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT (copy)	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG	ASCII text	CF8FE8DD646EC8BF7CE04F64D1CA2EBA	45128030C5B6A55205D963309AA78EBD710CA150	631FBEC0BD93F04E2DB0A42E2F714F24B7FAF9C04128F6C563010C623DF21502
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240828134204Z-173.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	91C0BB4939623FC62B416ACC3B6A0577	5CEE1F77118B48432F525563F9D73D10D95395E5	BBE25407A1713451C14616CFA475279C6F91DFF21170F76247E02AE3416B3B05
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	C31CDC2B0E5F8FB2EC3210C858262AC9	5B9C329F2D5D5D794EE93C39577D58A69EA5970A	1576093453C65B9A871FAA65BCF9E4498286F16C242F0C85A07D629287F802A5
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	48D0706ADE828610C098A3946961D8B6	67E9AB6314C2A77FAFC8654B298CEC9244D84FFA	6A9B1E3839A87D5D5B7420F8CC8FB23D12DEA5843972AC3D4043A9095494CF98
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	7C46DA4EC96CD017D47A4C39E454B88A	67B8D2C57C730468236F866EF68D510A19A06E94	9C0ADBDA7CFEB7FB7E40354E04E5880E7CC1F86161E94407D96871355FD8AC1E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	777D63DCB36696183FC8A785C12FCEE3	7A0C28D0D4330F027EC5BD8ED35B21A7B859F0BB	42F2AC854ABCF5B8055DA9AD563845D002C6B810AFACF3E0CB26495DA00C8AF0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	EDB9487088F959E7AD42C442D33876CE	9DD096591CE4BE8DC61ABFE406EE910D16C57AF3	0B932C60E502AB54F8E1929B9F330E5734B40262C11F8C9182CBB518252028BB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	C91872FC007BD759D51EF143D21E7A00	9F927CBE8A59A26C24C434A981F52F23FE67E25C	906E9ED6AFE5F41BCAD409301F3E6B7A6B540D5CAF177C3C5BC28C1CF66FB135
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	E14F4D00950B02AF31A9C960AB71DF85	C8EC7EECEC4D3DE3922A18187BFF470656BE03FB	AA83B58AF139E26CAC47BD0D0C3CF517D1C8321410DC79C7C60A76E3CEFC95C0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	00368A0070638BCACB57BB9FDC88A538	75FF2E6537D824FCE56B76F280FDFFF8903E983C	9A2A5CF81EE9351E0392C10CFC1E3A2BC3E3F4A731B05D647C4B66F2675E63D6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	EAC81FEFF562D800F8C6E7F143F6AC29	6C6E8D28A10C92A310FB4CBC0971B7BC644C9A99	1441C3F709C1EEAEA949205FBB5CDEB645F4D7483304ECAB571D556781DB3546
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C9EEBD159A3734105728279BAE9E5C95	C7E234691482565705F535E21F8F31129C61BD13	7E4A0FA6997641801F9E0E67F82228F0FA611584FCE042441505AA0FDC3BB468
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	FE8DA637B09A39EA8045ED726BBCA7F0	541D365ACB2E8FFC1100EDF319560232FCEB97C6	AEDBA0A562AB880B6B6B30AD88DF46712D3C150AAA3B623C3DBD096740AF219B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	A624C084013FEF0DB9DFAD36E09A12C0	CA8B4D9CBE9F5FE8E68CCD80DC18320F51AFE102	AEE78591FA5664D4DAFFB0B40AD8293E4DBAE4604858DF98AF0C9E64EE3D9C2C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	492DBA054BB961510BB0D259522B09F2	D028EE74554E10D6B18EB7D4BF0F0C81CF34ABA5	72A413F8990BF78EF214E5C88E12DC5C8D5D96FB62868ADB20CCB4D01E6E0AAB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	DEB2E7EC4A1FEC1414FF25CA3404558E	6EF4F99F5EE168D8F5580C90ED18771BF00348A6	439885E536ED966A581968D1F59FE7F99F6C2998E16C93042F0090647AECBD9E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	6DC0DB3D9DE0BD86EA5EFB5BDEC92732	2E8ECBF590EE5748C370D44B198EE446D6DA5551	03F192B38F470B99575D803B3052E31B69DE56B5C1645D36A40E8D6D812C1357
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	A32A6646475F9578A32E8DBB6C36A58E	F6459ADF28A1E03DF1876E3AFC2EE55F06132D77	C7A16E856219727FF9A1C57103D000E806A7BAB58BC55680AD9B76FF3597B6E6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	B6B3763DD081A5084D8E0CF45DAED9AC	F84A61CE3A70FA4F945AE0E484EB7441C36E1AF9	8359025F82DCABEA8A378FA2B1B7528EA16A94D2BAC2F76E2F6F4E9A596D5DC0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	6BAB69A28CEE049F225ADA9FBE88DD5A	C5C24D7EAE991C612ABA3AC49FD4216A4335C758	7ADED39C3FF4921F7327B78B76FD59CD931916AEEBCC0BF72EEA50C1B966D5F3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	B9E49FFFD375CE6E13A0D0CB33B3AC6D	2C4232D8BEC76FBB8F5152E8572DC7175EB2721F	A2B0B23497DE1FD09766FB8D788364849EF07F03370BE32E94461F932D37F5EB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	58B61F1909521E1A7AD37BE5AED5C989	D4585AF339C892172C6F4F9066538F11C3A26541	4EA98BC755BC5968D86C697EC9ADB84388BAFA72125F9AA4C279334B5FE5F18B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	C6B1A210FE8DC1C62EC0A8912AD1BE09	0804545004AD9AF6940291500E76D08AF45CED85	14B0DD0EEAA022B58DE7BF35154370FD732401F61CC179A33F3FE27DA25EE7CF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	44A06650CEBB1509326A2EB5563A7ACF	0EF64C38546DC5307E40CEF7AC5B2166819565D1	1510201A058E983CC1510AAD8579657AE515EF4FDE79AACEA7ACA5D133700E0F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	8B86804DE9FE1E690D2E7D836CEA3CBE	4FCA9A555619D78970096D1DAB3E02A6CFC7522E	566CDFB6D5FBCE6250042E6E26CCFF35AD438DAD98F6A54E2266DA408297DA50
C:\Users\user\AppData\Local\Temp\MSIcfcec.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	C0C402A3ADB9BFAC78D80F1B87A3ABA0	DDEA158E1A06D263EB79B4AAA38752C61B7B4004	672F6D80E25851448E80398BA4A64C047D2FEE08D4236C28C41ECBC6A1356DAB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-28 09-42-01-940.log	ASCII text, with very long lines (393)	06DEAEDB81D09FD8FB5FF668D8E09CB2	28A02BCBD5975117B97A08AFB049F2C94F334726	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	8F87EE910DE290E12213F212AC3B3A56	ED1FF2D441150A9975152C1CA93482E9906F0CD1	56E59D6B3273C5899BCFFA57DAC1BD4E3ADA359E91D324E214D74ED2A6EBC9C4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	46AA6A46E3B8EC94AD88E10A9EFE009F	0B6E04FB79C29B2421B08CBC4403EDDA35AF5F66	698A2467B2E5A23673217BAA858A92B398624ADD2DDAD80373453D94C8E7E2E4
C:\Users\user\AppData\Local\Temp\acrocef_low\22adcbc2-023b-4079-9da4-c9993b3f8977.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\4cdc42c3-3e60-4f53-b427-6e8076f68471.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	E787F9888A1628BE8234F19E8EE26D68	44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5	3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
C:\Users\user\AppData\Local\Temp\acrocef_low\d9885f4e-31e3-4255-b0e2-dce726fc5e13.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\f03c7652-34b0-4bea-81fb-f974b90b7772.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\f592cd1a-4d31-47ae-93b8-717fd2cd9f0b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	956BEC2EB32005025184F904D9622D32	C6A9A8B3F7A7AB8122FB00457C0F83D4A77F21AF	DEFD4ADB96BA87467278B6B06980FDAB1EE460D971B62ED05A89FF32983784EF

Windows Analysis Report
Faisal Ahmad.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Faisal Ahmad.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Faisal Ahmad.pdf