Windows Analysis Report
maliciouspdf.pdf

Overview

General Information

Sample name:	maliciouspdf.pdf
Analysis ID:	1501488
MD5:	fea26c05a0e34c85dcace36d02ecac9f
SHA1:	8160f922fdb287274a5962ed49d9e62b7d1b24d8
SHA256:	f161a489dd4aa6e48c77717deae162f52b917da5550fde450d1bfb3e154a3dfc
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

IP address seen in connection with other malware

PDF has an OpenAction (likely to launch a dropper script)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: maliciouspdf.pdf

Avira: detected

Multi AV Scanner detection for submitted file

Source: maliciouspdf.pdf

ReversingLabs: Detection: 73%

Machine Learning detection for sample

Source: maliciouspdf.pdf

Joe Sandbox ML: detected

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: 18.31.95.13.in-addr.arpa

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.7:49717

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.56.162.185 23.56.162.185

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: classification engine

Classification label: mal60.winPDF@14/48@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5420

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-29 18-37-32-677.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: maliciouspdf.pdf

ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\maliciouspdf.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1744,i,11800254572130627882,10832229251146507829,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1744,i,11800254572130627882,10832229251146507829,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: maliciouspdf.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

PDF has an OpenAction (likely to launch a dropper script)

Source: maliciouspdf.pdf

Initial sample: PDF keyword /OpenAction

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.56.162.185	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
windowsupdatebg.s.llnwi.net	87.248.204.0	true
18.31.95.13.in-addr.arpa	unknown	unknown

ID:	1501488
Product:	CloudBasic
Start time:	00:36:37
Start date:	30.08.2024
Sample:	maliciouspdf.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	fea26c05a0e34c85dcace36d02ecac9f
SHA1:	8160f922fdb287274a5962ed49d9e62b7d1b24d8
SHA256:	f161a489dd4aa6e48c77717deae162f52b917da5550fde450d1bfb3e154a3dfc
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	FCAD97396FFCE26A7A61C15D687A3009	AF4715DA4F104240F1688FA7099A5D663E820363	DBA884AA58C129AF838DB456EE2D5DCAF17D75CD65E9583CB51CF608AEF7AE46
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	FCAD97396FFCE26A7A61C15D687A3009	AF4715DA4F104240F1688FA7099A5D663E820363	DBA884AA58C129AF838DB456EE2D5DCAF17D75CD65E9583CB51CF608AEF7AE46
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	6036BFF992B83E89F1883B5E6EB68146	DF84EFBCC41D3DD35B410D78013E68960ECC3ECE	91569BBB6856EDA8D7056614A1F09B97BB3F9EFAAAF860E51C776E673BF7047F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	6036BFF992B83E89F1883B5E6EB68146	DF84EFBCC41D3DD35B410D78013E68960ECC3ECE	91569BBB6856EDA8D7056614A1F09B97BB3F9EFAAAF860E51C776E673BF7047F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\02085a0d-4f93-4115-85e4-12447d1f482f.tmp	JSON data	01C4BF8608F7FB2FAFBB2FD55655615C	25FD4234C76486211D0605EDE6E9BC2E0CE4FF67	F807146DD73480A4FA497217BD139A8C1321C643720C2F317A44C1134259208B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF693b74.TMP (copy)	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c973a4cf-774b-48c2-820a-b8b3e86e5100.tmp	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	353D85BB7F30A17B77B29014D80179A5	C414E40CF522944115124DA9D1157D380065FB8D	A3A414A01B6E21382C3D3E01BBA00367015530C2357006100F8E75D9E8F384C5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	5E95266515A478DEDCC6BC93CED424A0	03B7F56565572D82566599C2144BE60B55237DF6	84F53B52626BE51A3001254A0869CFCD903E5559E57E3EF329D1B83360A9683B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	5E95266515A478DEDCC6BC93CED424A0	03B7F56565572D82566599C2144BE60B55237DF6	84F53B52626BE51A3001254A0869CFCD903E5559E57E3EF329D1B83360A9683B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240829223734Z-166.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	F9CA182432AC0D508B998F53FD4D6FE2	8137FA76C0B7B396461FC49FC0EB59B365D8872A	922B024D0B9175F6D8747AC5B4C8C5C6E50BE4BE106A08A1D20D788C528B4EC6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	99A976CEE56925EDB04BFE699FD2331B	933BEF9D8F9CB56DC4516D9411034BC5AB836972	47BFF7D67C1D3818844F4AB0A80C849D859B9689AF15F647A12A82EFE15D74B6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	BF5ABCCB9165C954217DFCB53AF86A93	9D5B2B3F50BD608548FDEFA4728F713BDAA36BEE	4D1BF35FD939F01078D8C74FBC103024BE32CC0854D281CD12A7FE295FF27883
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	0ED7AAB6815C8BAE87351E9888805EE2	C9212EE0508D8F0FE6C92D549088E1B3517407E1	C645EC4A7E96B9F62A8E2C13722D2F65F16E9D10CC9768A7D536D0FA2644AA80
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	4C014D5EB800B821CF395A9DDA119F75	052FCF22CE494798949C26BD29B41235C7572701	520AFF8AA384C204C396E5389C357F32A0EBEFB6A406C246EB3415E80AC3CF7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5420	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	A193E6DA213AB3A1689B8BE70A6A5267	3B2D2E8ECB30B836077C207FA60AF76FCDDF26EE	07816B0A03A707AA3ABBD2B130EE4F9E4BD6CF766BCA126137E7EC11858274A4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	125523B8EFDA1C2F030985DD87A5C855	5CA4DF4055FBBBD8A0FD48D1B7E9562C0B51E5A2	18D2DCB23E21DC1F471BA5699E64D9E5818A7FEA831D695BE71A4EC1B25EA95A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	EDBC37EB627CBE9A7F62FE228BB65893	AADA9C6A1B3B86E87E9188456799722F764B74FD	5FBCFDECCC324ADCCA88F576513A0BD5432A8AEB7E5C6EEEA56F16E2E3B09CFB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	12A86194545674A2BBB0DB6B2264F524	16481D8C8DD7EC35D57DE4AC257064D51FF40C25	A37A5E382C5D3F0513914308349B01E60258C2786C308C761819DF5AEFCD1D80
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	594B379255B8851D700EDA6C7178C2C2	E0CC77392DDE5AB74687FD04BBD6F33A6B83C345	CA7EB7C02F64BBF7E4BBD6ECD99598914EAF73ABBAEB450265675A69997E7105
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	90DE606197311B74BB3BC0C22DA4912E	C40D84F77AE2D70C168DF3D3295039AD5D8C4CFA	E9E0C70E392206AC6A3C97BF3BC8B19A48985778AF9713FAA6A7512B3B3D7468
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	FFE66C6F1A0A6DF194D02611387E517B	C6610223291FE219C7C0D2B0C6AABC5D485060A7	89402FCF0A9B830BD157F927D1682955C0D56DDEA5D7304DEC5682E9F7AEB387
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	144466265EDE4ED242B9755ADAFB422C	57F1025DF4A5F9B85594700371584F6D33571E17	CB7BC64E7EE027B4CDA230870E1404ABA2A0F0AE80AAE5004AF777610D2A1042
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	0820E9927FC21366151ACD61B15DBDCA	D1A19FA3F005839D8CE3FF78FFAD02B4633DC072	A86DD2C7DC6D963473BAA1C46EACD0887901B0125F28E69A63D855F9A9ED12B2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	240A056E990D539B683516C049D42ABD	002F19B13C868F6485F9F199A276D1CF68510A03	2598708748EBEEE11734B36E6CC83E11FC33B7E4169E6003BF0DFAFC8EE75CBB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	64C4616A15D9EB6EAB504C3CE6FE6A43	164AFB6E40A699C7DA0FE9FAA331188E39CA3444	D689AEBDE4EC29247DAAB55735AA48CEFC7FB1864D65DB50BCB55D12BFDF7E9C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	3F575844CEFE0301F1B33004F8C60EA4	BC17C56F2D0423BE7B91B24804D26EC61E4F575F	A83AABAAA83A3F1B17ECD38D8CF1ECBDF71DFE22BA3EDAA6DA2D9251696FA61B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	38476253E6FAE072094FBCB747B8D19F	F6CBD4FB0930218A905059E62D8255A6125D0AC3	2B9FFA389693CE9CA0B6053A54DD4E943379A6FC2831AF7BD5D3F68E54277079
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	85C0D7DF9B37F211135AACDC93D6B605	3DAF5C677C20B8DA7DCDC403C79E12B82854B591	97184C7FFC324F8399360774EB0F5B47C47D6B1221774DD8B074C3E4EE0FAB28
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	C36D1912489037158DCC8ECC17B3D627	BB835EA603A39C308E155A3C64CB581583411B79	AE3C8F6865D1332B8D17A210E1CA43A5EEE05D5022656C63BAED32E3AA919B3A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	5DB3B84AD1114AD7934FEB12C2802B43	C8F804401CCCA3C1E83F68C9D698FAF49EE2C290	2D7A797362273D437C0DE96E1526E549E0E9EEAB924CBC2F1CAE1996910C4B2F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	BE32B0ACBF4D98CC1C80251188E841AB	ADB174364061F67E17E5713A27DB3DB21079013B	735E817B2D8969BF37689FC18104FC0CAB8FE0CECB9FA7E26869A3482D6372F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	C1DF130FFADBBF2EA372A71524596C02	6B26E8ACDE513D021132926D7FA3EC1C01AB7ADC	209C649117925FECBF3E6FC19A4E5BCE8717A42FB196276A0615460CC788185E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	5D092E20C35441BDB42AEAAE31FD559E	12D30F4B6B8C5F701A8BCEA1ABB72ACF1CFA20EA	443CF4A235CC1717698A6ED3CB523BC5750B95F120B31E6AB7BDC8C23EFB11A8
C:\Users\user\AppData\Local\Temp\MSI9006e.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9E008C5514735B5CAD3CF3692AB55120	F01FB11E0FFF25A85FA4EDC2ABF6A88A49EBB1A9	3B8781168E996D8A0964512EF362302ED1D6FA06B2C34663690F4CC125E4749D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-29 18-37-32-677.log	ASCII text, with very long lines (393)	F49CA270724D610D1589E217EA78D6D1	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	54D495BA457DE218081E2B55A207E58A	F71761F86EE40366B53E957D6541D8EEE195A938	1E8079BB7119838D893A3D4F1710E8C3F7C1081FDB796FAE37D3C9C67D6A035E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	FE4F82FE2D86F3636DC9041293701667	92C34C293DB12EEEF2A834E911E349EA014EC7DC	BC006CC2630CEF921C663AADDF9ED6578F6C17A46786B8B1D41E59A02FAC1C95
C:\Users\user\AppData\Local\Temp\acrocef_low\25e0e97c-c372-4d29-9546-e4c83f7c12c3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\5e59ce00-a904-4af0-b7a3-575585b211b3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\76c63f63-2e99-48af-b757-adebe95b39c0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\b3f8d9e5-3fd0-49f1-b611-c02574b62287.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CA6B0D9F8DDC295DACE8157B69CA7CF6	6299B4A49AB28786E7BF75E1481D8011E6022AF4	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7

Windows Analysis Report
maliciouspdf.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report maliciouspdf.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
maliciouspdf.pdf