Windows Analysis Report
LEONARDMARIE.pdf

Overview

General Information

Sample name:	LEONARDMARIE.pdf
Analysis ID:	1502492
MD5:	1657fb0234ffff097b028ab01b843e75
SHA1:	f260ac67282568752c12ff3e3f05c21f95804a80
SHA256:	d859b6f24abaa69be6bac60cf956c849bb8a1a8ee82ddaebbc8c022cabbb74c1
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: 15.164.165.52.in-addr.arpa

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 23.22.254.206 23.22.254.206
Source: Joe Sandbox View	IP Address: 23.41.168.139 23.41.168.139

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic

DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: classification engine

Classification label: clean2.winPDF@14/45@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-01 16-35-52-428.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\LEONARDMARIE.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1728,i,13754806069514452620,14320685787743459304,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1728,i,13754806069514452620,14320685787743459304,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: LEONARDMARIE.pdf	Initial sample: PDF keyword /JS count = 0
Source: LEONARDMARIE.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91bo8kjb_1805joa_1io.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91bo8kjb_1805joa_1io.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: LEONARDMARIE.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.22.254.206	unknown	United States		14618	AMAZON-AESUS	false
23.41.168.139	unknown	United States		6461	ZAYO-6461US	false

Contacted Domains

Name	IP	Active
windowsupdatebg.s.llnwi.net	46.228.146.128	true
15.164.165.52.in-addr.arpa	unknown	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4597EF39908B5343388A5BB63AF4A4B6	53D01E005A3AA650DBEA7F6165BD0A809DEB60F9	635BF6E2C190DCA1168452AFAEE8057A78B31429F86FA0EA33541DD8AE23F3A7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	4597EF39908B5343388A5BB63AF4A4B6	53D01E005A3AA650DBEA7F6165BD0A809DEB60F9	635BF6E2C190DCA1168452AFAEE8057A78B31429F86FA0EA33541DD8AE23F3A7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	16F76F7E92609403916B74307DB24C9F	C87DD42A97E15BA382FB1C230E2D6B474EAEEE59	1A26A92D084295D432F2030ACCA8A8646217A33EA099A83AEA3FAD2B5DC9999B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	16F76F7E92609403916B74307DB24C9F	C87DD42A97E15BA382FB1C230E2D6B474EAEEE59	1A26A92D084295D432F2030ACCA8A8646217A33EA099A83AEA3FAD2B5DC9999B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1eb0c00d-649b-4536-b739-fb3d19b7c375.tmp	JSON data	6107D823E1ACDA7C00DCAEE013C3C384	41EB99D4D6D7F0AA5D26C5028CFEFC36D51FFFE1	0F2C04DDD565CB50B46110A0B5C5E56CC2C895317C8C34BD4F22D3EB2D7E7E3D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	6107D823E1ACDA7C00DCAEE013C3C384	41EB99D4D6D7F0AA5D26C5028CFEFC36D51FFFE1	0F2C04DDD565CB50B46110A0B5C5E56CC2C895317C8C34BD4F22D3EB2D7E7E3D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	0D8E94AC85AC81CAE41F7FB605BE6BF3	9F82BB0B3C55584D3CD66A41FB63990D7A9E032B	BBC7AA3A5DBA47D4FC94CB8EF4BA62B2BB58D27141C10323029EFC0B7492203C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	B6DEAC5E1D4F6F88A7458C24F992541C	9AA7880E0CF00F4175CCCABF19E09A4C6814FC18	9C4267348663B65D2017511AB9494A65DD6053B2FBD8B6F79F92A796C4DED3EE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	B6DEAC5E1D4F6F88A7458C24F992541C	9AA7880E0CF00F4175CCCABF19E09A4C6814FC18	9C4267348663B65D2017511AB9494A65DD6053B2FBD8B6F79F92A796C4DED3EE
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240901203554Z-151.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	78A2A053596E05F69D5978A32110C271	6738296927A296D76A6B316A21972F02EFA01005	6D180081D8EFD5E7F637E3A2F7714500A3F592293D2DA29A4A8071239AADA441
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	187C37C03D72DC7AC4C4C214DCDA9A38	E752C68108D553A1DA928DC2461CA90847A3E8B9	39CF95CF8F5B362350730DBA92FD8C0992DFBF7769D4AA1DA59598C04A4E87C3
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	B37A1FBA95229E654D86D2CD35C8A1F2	18F60F819E26A9B9278A6C6598EBB92112FD5060	87505602EFCC54A4020E1F1BF5C4839D31D6ACB9BD6C5B141E68F0AFFAC7B23F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1968	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	38E0E9A9FF048E42E885056F22E82CD5	B09639DB2525A122AE5D7A5B4029B8962AC38DEF	96DA3C751EFA8EA12671FC8BB6A67B2D41E3E7C84867F15173F5B273987E831A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	3BD0D1689CEB1BD2D2FC6F9B7EECAB10	D040A18AB96332F3935128C84F1398A936A14F51	0E1D9B768616E7BEFDD103DC414EE51BB6D65C37C2F7A39A6C814C4BC14954D3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	3E4E61AE631CE1FC73CF4B61A1354A55	CF4527CB492045E2A37F35CF165C93284170BFB8	46CFEB78A992F84E0A5129624FA763F357FCBC215B6287F8F0984D9D63C89D07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	91805CF1872AEBB6E7274E1CD8FC295A	3D9E634312226CCCD0D365535E10E4F49E1C6D58	DAC2746F2BEA42E3202E66AC523AA6A9DAE73BF0C29F15D1EB5229CE7C1F5D28
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	C3FFB585FF6AE2C0A1D76C2A1717249A	361DF5C2B979B748AE238DE249AA959C1579115F	3FB52B896A1130B175E772C9BF833773506A90D2BE91D101308EF629EAA94F24
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	E247830FDB62F64C0D7DD3DDF8770A34	93BBC073B6485D15400EE722E7A826E5CC7D261C	7513422CB0541B0083C8D6670F1DC87E33638653849AF7D8B2146D3EBB471210
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	16C96761778CDFBE4EF49935F2A77B32	109C61C533FF2DB91676113AD40E0A197998F202	1A1D0BACD44FDB1B3BF53A63F8AE2F96B3C76BD0DFE479E5F85F7F06E8138615
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	33BE38AF8F1DFDD235F1C49BED841757	FCFEBAE3203A5F00F05E974F8BCFD7B1392DB058	5D9989E6F725180FFC878E17C685AD3469BB1D26AE9DB99917F4D9516E176FC5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	B97F92A61EB3546DC6DEA8C8E5944ECD	D1147EE76D578C80D9D03C7339E468CF6C22698D	7D6E21947CE89297FF69DF4949E9497E906747896B5F763B4B27729B7C4CFBC2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	E89180650420ED60DBED8AC12BCB9EF3	F4759762A9CEB13C6DD537839DD6403135F0ADE7	9F6D69C32215E7FD002E083B27CE85BC9693FC89703E21259394DF9619959253
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	6F3BF9D61064C97156875F7DB53C529C	F3A0B67A925D668A4D2D6D9FF0D256BEE9109FAA	AB82158CD0EDC6D6402419FAE5E01605DCDA606FBFF8C4C051D130ED4CA4B330
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	7A1EFB1E6051AF4CBBAE5943A059383A	A328BF6A19B68A45315CBECE2A38A881A46D6253	FE06C775B8E7954D2C8831DF464B3E732A150B363039BA65D1B2E7080A7E0C21
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	88492F637C3C64A3B75B92FE50EF4994	132E3C9532F5FC939C9410B21B1BA08688A1E80F	48AD22AE33CA2667E87882D418D60CA1BCC5BBEC09436ECDE95E0FFD3129A17A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	12DD978D58E209F4E87605F69E7A7390	B9C92AD3996362DC854497D53F287273748E8C2D	1F832815566A4C3ECE04050867A41ABCFB22C88FC5BC46ABD11B716A647027E8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	BBE53898DB71D0B864B2D378E29C0C9F	BD42271F4F99AE5EF45B4D9062AFD5501B4480DF	3B88C2293325C6B6DA70FD6BF017533C36FCE9F023566E9F9FECDAD19C585FB4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	50B01E3087399180EC325391170051AE	05E5519D6007966784B7A8152C2A95D686B05A6A	36312751D5517AFB3D79624626A04649325558CEFA16E5A8BDA58329E43AA927
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	008DD004809604BB5FD59A934BB80068	03D33B8F52F9A2E0920F8ACBFBCA5E7F64AB94C2	A9EA36B325A921C26FA9B484FA15768140ABA58567625E58D615E166F3A5919D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	C500DC0362BB833E5D8F061D0542577A	EE17E459AC62FA9F51DD64258BBFD6CBBD35CB6C	B72442061AA7C97AA58CD510E9882CEBE8D5303A6EF0A779BFCF1D5790FDA28C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	3AC0CD1417B2BE09FC31AB8BFB46BF3D	CD8AF06684ED630CF198CA2A403AC26201B8F41D	E69923EBDC7C43A1461AD0B1AB054EE07DD35270CEE2511E9FA3E31983C48891
C:\Users\user\AppData\Local\Temp\MSIc0c50.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	6171B224E2FE36C6AA35BA9EA0BE271F	44E37C16DEF4E10600C54FD95BB6926569C877D0	B02B3807826ABC15EA410C947B7F10E35FEF87DE10D706A6569293586EFA049B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91bo8kjb_1805joa_1io.tmp	PDF document, version 1.6, 0 pages	428AAC7C8CE61D45F1D4AFDA2A44109F	3300D7ACB4FD1A916F70A6C267D8AEA393B15020	6BF9B7D1A4E706B3445CDCB5D734AB01F3C124E5798AA0D31415C02EC5A6B955
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-01 16-35-52-428.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	E429B256BE71F76D33EF756F15C149BD	66204C7E820AE07C29FA8933F55760E4500D7DFE	CCBE89B5A115CD2B3799927EDC23A69A7B7B16318B6847380BBCC573F05D8C55
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	FCBAFB6A6782442C664CDF8BF502B852	19343EB930B250D85078BBE70B507AD9FA77C496	7A18DF54DBFBB346AF5214959F281116059885880637169601041746B82771E9
C:\Users\user\AppData\Local\Temp\acrocef_low\31155122-071a-4663-aefd-0a09462a1708.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\bc3ac0b4-94bc-40b2-88de-a58c8579e3ed.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\e845e854-387c-47d2-b8c3-2f87ca7ac0b7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\f5aadbf1-8bd7-457a-9b21-86fd6801aac4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AE1E8A5D3E7B2198980A0CA16DE5F3D3	A1DB2C58AFC81E6A114A8EB47BE0243956F79460	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: 15.164.165.52.in-addr.arpa

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.5:49716
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.5:49717

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 23.22.254.206 23.22.254.206
Source: Joe Sandbox View	IP Address: 23.41.168.139 23.41.168.139

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic

DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: classification engine

Classification label: clean2.winPDF@14/45@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-01 16-35-52-428.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\LEONARDMARIE.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1728,i,13754806069514452620,14320685787743459304,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1728,i,13754806069514452620,14320685787743459304,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: LEONARDMARIE.pdf	Initial sample: PDF keyword /JS count = 0
Source: LEONARDMARIE.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91bo8kjb_1805joa_1io.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91bo8kjb_1805joa_1io.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: LEONARDMARIE.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

ID:	1502492
Product:	CloudBasic
Start time:	22:34:59
Start date:	01.09.2024
Sample:	LEONARDMARIE.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	1657fb0234ffff097b028ab01b843e75
SHA1:	f260ac67282568752c12ff3e3f05c21f95804a80
SHA256:	d859b6f24abaa69be6bac60cf956c849bb8a1a8ee82ddaebbc8c022cabbb74c1
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Windows Analysis Report
LEONARDMARIE.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report LEONARDMARIE.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
LEONARDMARIE.pdf