Windows Analysis Report
image08-29-2024-123918.pdf

Overview

General Information

Sample name:	image08-29-2024-123918.pdf
Analysis ID:	1501356
MD5:	fef2d5366df96c6517f5205045092498
SHA1:	b410d6e69994094c1b154d3b8efae585bb6eec3f
SHA256:	d50dccde354000b20082dbb26982d5d0b39d4ff3e0f05de6178626ee4c09d8f5
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49747

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.41.168.139 23.41.168.139

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139

Source: global traffic

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr

String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c

Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: classification engine

Classification label: clean2.winPDF@14/45@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4076

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-29 13-26-42-196.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\image08-29-2024-123918.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1520,i,3223990883004043102,255997904226767848,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1520,i,3223990883004043102,255997904226767848,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: image08-29-2024-123918.pdf	Initial sample: PDF keyword /JS count = 0
Source: image08-29-2024-123918.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: image08-29-2024-123918.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.41.168.139	unknown	United States		6461	ZAYO-6461US	false

ID:	1501356
Product:	CloudBasic
Start time:	19:25:37
Start date:	29.08.2024
Sample:	image08-29-2024-123918.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	fef2d5366df96c6517f5205045092498
SHA1:	b410d6e69994094c1b154d3b8efae585bb6eec3f
SHA256:	d50dccde354000b20082dbb26982d5d0b39d4ff3e0f05de6178626ee4c09d8f5
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	B60CAF61E6B3DB3B76F28F6A85C9070A	A273BD119BB1A1B7C5271623EDDF163BAAF016F2	DB2A0BDB659C2573C12C567DC06904247FA75C5BA67C94E0CF667D432AA8EE69
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	B60CAF61E6B3DB3B76F28F6A85C9070A	A273BD119BB1A1B7C5271623EDDF163BAAF016F2	DB2A0BDB659C2573C12C567DC06904247FA75C5BA67C94E0CF667D432AA8EE69
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	8701FC0A022AA90E016896312C9C4D93	61B698635FD4F44D74DC3D378D5E43404EBD9317	52E570C37C76160621F6D077F3B82FC0E538157C2015E8206F0069A58FF041F6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	8701FC0A022AA90E016896312C9C4D93	61B698635FD4F44D74DC3D378D5E43404EBD9317	52E570C37C76160621F6D077F3B82FC0E538157C2015E8206F0069A58FF041F6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0ecb46d3-ade2-463c-bd1d-3de736f45212.tmp	JSON data	B7ECC2C9685611094262617C52B68BAE	12CDAF46EA65F0931730EC9F78B0532E36070186	116EA87B482B1782D22C8FE79B31FDB7C8B414C3F95F601F5C1341585176603E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7ECC2C9685611094262617C52B68BAE	12CDAF46EA65F0931730EC9F78B0532E36070186	116EA87B482B1782D22C8FE79B31FDB7C8B414C3F95F601F5C1341585176603E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	9071A6212F423EB6C9CCC433EBC731D1	59F56500C9902982707CD871074F5CCC9CEE6D15	2205095C4E6BA61C9F273DD8AA82AEF81FA9459E3164A96DDBFC327F0CC35466
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	6764DA29BF41329B929C7AB5681C53D3	6BAA4ED66F3895535DE2CBC3765C2151E5D94990	D0E6E92924DD79277464C1D786B6B7FA60DD687C918E31BD28B7BB7E3E3C356F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	6764DA29BF41329B929C7AB5681C53D3	6BAA4ED66F3895535DE2CBC3765C2151E5D94990	D0E6E92924DD79277464C1D786B6B7FA60DD687C918E31BD28B7BB7E3E3C356F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240829172644Z-161.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	DCBFA2267D2DD006966FFCCB91BE61CF	F0DF6D90F9CB62FC4D10A7A290617A3737E7C5F7	7B1771F2133ADFA2E2E08E0A59E7889ED21B1E521D93C53DAB46E78E1913353D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	A4415BD4E6D12CC1AA085F6006A71F5A	646C1666EF13B3EE368CBB6758331B5E2B4B35CA	398318517D982EEFF3094965691E666AD5977D94A3681D5A21B0EFD6509C4533
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	BF3372A87AF6DC5FEEF9CAC067A05E54	A150025EA6AEBAA1FE27971BCA3B0043FE170A85	B3FB8ACA868FE7073ACB0074FA1F3587AFE40BF86214F7A9DF169C040CEC2426
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	C1A112302A3B9895FC7ADCFBF13C6BBF	803EF6FB44A31B9C95E2E876F75F8EC143DF4D39	0713D3B17DC2241151E0BE94490DEF8A2C289ACA4E6B9C1BF8F844EF732C8BBF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4076	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	50A60CD94878B0D84D43BAE5CD472E67	4F89DA5A4F169A6049068B92F3DC7F15266780B5	6A205C46170F835DE5EC2D949D6BE48C78F7899E3132C1DBD4ED41E8CF685FDE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	88B8EEE50DEB3A84D0A44A7C70028750	56B0D46C3F6182FACC7FA6B5DBAD2D2FB57A524E	9F8B7C40C79C086ECDD25B4DD0830687104AFB192D6C150F50EED149B2466D3B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	B1430D8D2C08A2C8D4DB641E79ED40B0	C667469B348ADD239CBC70A7AF8E52F8E22E0F60	813363B94BA7174D717C4CEE0F8DC9FC62761715776C511F16455EE386FDAD55
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	DED3C795E1A4A49DC735732D52177012	649B17215D8AF6110BE10854727876BE6FBDB4D7	57CD31FD3B486E0E481CA6C8F3DE669D91ABADF5921EFD2C2C5C287376F40F2C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	48DCE8E87DB5BA51A57293346CD78605	BD46D27843E0D3CF09681E844F5B207E539B7678	99405C1877AFB9EFAC992F6678A0420D4818F63F08B9656D524FA3D664C3A647
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	F7FA6A8016967D3EDAA42C507D1FAEE3	7989F1250B2466B5BC0A1C22AAE357C1BF1D140F	DDBA27C2B61752558B3A430B60D403C66FC1931BD3D5CF6CD18FCDC4DBF00B0A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	00B3F390C57F1E520649EEE3FE057833	53814B197AB312FA3F119E5361F97E04A25C555D	A37F6A6620044886916D751EE3799FED1D21C7A42257C54D2DB8620D1734A7DB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	4E8EBD02BE90C2CE10E7860306A97C6B	20E7D6C3418D5FBC256AC5F274DFE58D0CB811E8	C7ED94E680DF74414DF3576A6FB77E2BA51D8074A2C783577E51458F32F4A920
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	5C67AB41CE9E2D5EB2B3A47911A410B2	399D9B66543BDEAA0F509CF262C5A5ED51EAF652	B17D9CB0E08B547BD57F6124B2E8794AE169CD6D4E3E812487AC89DBD98074FB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	9907789332E127E44D1000B5DD383B58	5C96FA67CA52AB5D20F769F398F3077D92306B1C	844E9543BD52C9AF56E251AEEFD25B3AEFE003715B1AF72D0AD420A6093A944D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	58E2BCB4D50BE9FB8672FE2B8E5E1B1B	EAD3AD20DE66E27F7CA0E20490EB17A54A0F9350	3846DA479D74B72B9D31FB4B37EB8F68239C7F13D3A55B1F795FF2220B60B1AC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	955AF00757391DCF433A076627CDBDCF	0E09719CC80322A78FF15FAF3A73A4304D79BE0B	EE8170FD2E20BD38B4775CA14E7D4DFEAF181D53BAC881F4F3789E4327C7ACF0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	7DDC262203DCC9E28D1AE94981335216	852ADB91774F8165465852D72BEE14FD0EFF6E45	EA48DEBD02094C8BB8EF452968082E1E16D0F8C806CAFAAE8DFDF2C8DEA8291D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	34F70559091FA7EF7A506D22B81D418C	89DE83BE81C1FA5A7E0596EE673340164797A08D	AE90A5B42C520D2098A9B1885EC57B6AC770187AEFE43AE0827AC25922BDF9BA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	43A37949651951AFB81DC6A41F44EA55	1FFD54EF7F85502A06ABCCA974ED6D962B9EA93C	909EF73D7904A7A7F53F08C79E289DACA9E745EA48FDA2E5295A92EBCDBF3203
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	92ECFAE95BFF4FEA79D00DA909E5BD1A	E3CC33B9C2F8C78C54C85268BE39E3121CB2A8CB	BA18028D8233F50C247C9429D86231FB7C46E8507D0C91A78A427FD039861D87
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	96F890169613D92ADB3285ED40DF9432	41ABB37331B16FC410A7742EDC19FFF001FC1918	CB7C377BE412A2A9CCA58146028B1192A88DE8812840059F2987CA533C5C7747
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	27B63DE09A416C796DDBF09DFD2E3CE4	178C046398799FE19C2A2C5EDAA8F6C4E69E10C9	8C18C91E11C05810F59D37E267135A4585A7A68E2286E42835B22DD7E5BA48BC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	08A556DF081A02D4CE550D2C8AA0A450	9364550DC37D106B328CC51D49CD0F1E4FDACC6D	E8D6F8AB26073F0897B724221F56C7D0FEDFBC49EDD57104BE9B5E1E9AAB55FA
C:\Users\user\AppData\Local\Temp\MSI4dca9.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	8AEED635694060D2D7307641535835B2	0109E20D3742C861FD005161E62D2F4AB4392DD6	48D79D3E23A945E9CA0D4FCD2AC46B8DFB22CA741F0E1C6A87EFC16A9608D63B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-29 13-26-42-196.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	5755859B6825D27BD608EFC738ED4C1B	48BCBBE4A1606E4FEB8E886D7231851CC57AC150	CA280D3F7FA7037B2DA9D2A54D8F623D8F0DAAEFDAD4AFE4504C6CD8B914263A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	2D391CF614D8D7DF6FC7B3B2E77AE118	4AF6DB9C29C4F7748B22355605A1254B1F91C02C	7B821BAFFEA48580AFFC9A94219E37CC03D71542BD91406BB4499864E1775EF0
C:\Users\user\AppData\Local\Temp\acrocef_low\198cb078-b926-41bb-b00d-d872407b71cc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AE1E8A5D3E7B2198980A0CA16DE5F3D3	A1DB2C58AFC81E6A114A8EB47BE0243956F79460	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
C:\Users\user\AppData\Local\Temp\acrocef_low\aec52dc7-0b72-4dce-975f-6dee68468cff.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	22B260CB8C51C0D68C6550E4B061E25A	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
C:\Users\user\AppData\Local\Temp\acrocef_low\c02a3850-cbd6-4638-9065-47f3130ce456.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\f172700f-7254-4387-b0b3-19988836795b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
image08-29-2024-123918.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report image08-29-2024-123918.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
image08-29-2024-123918.pdf