Windows Analysis Report
20240927102105.pdf

Overview

General Information

Sample name:	20240927102105.pdf
Analysis ID:	1520454
MD5:	d9a3a230b5e4c8d5712abc0b1bcd3287
SHA1:	b1878a18271a71ed9eae127069731536f184f15e
SHA256:	d14b6f0341d5073b29abd846a8dbac6ed60e64a6103677835e9491390a13ace4
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.4:49748

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.41.168.139 23.41.168.139

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: classification engine

Classification label: clean2.winPDF@14/45@2/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 05-06-52-218.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\20240927102105.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1736,i,11910158590496879408,606956546599633943,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1736,i,11910158590496879408,606956546599633943,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 20240927102105.pdf	Initial sample: PDF keyword /JS count = 0
Source: 20240927102105.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 20240927102105.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.41.168.139	unknown	United States		6461	ZAYO-6461US	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1520454
Product:	CloudBasic
Start time:	11:05:45
Start date:	27.09.2024
Sample:	20240927102105.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	d9a3a230b5e4c8d5712abc0b1bcd3287
SHA1:	b1878a18271a71ed9eae127069731536f184f15e
SHA256:	d14b6f0341d5073b29abd846a8dbac6ed60e64a6103677835e9491390a13ace4
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	AB19D7D9941B0C31F8E1BD4D90129102	CB8649D9EF18074A89B5B3209393B564D887E87C	8E7B6770D1F916F8B8E5BFAEAF07CB79706BBCDAFF23CEE7F84D39D7BC0B6334
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	AB19D7D9941B0C31F8E1BD4D90129102	CB8649D9EF18074A89B5B3209393B564D887E87C	8E7B6770D1F916F8B8E5BFAEAF07CB79706BBCDAFF23CEE7F84D39D7BC0B6334
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	26E4A101A2751E3D6D244E8D14326C33	D8573AB4DD24D84E5D517F8E56F7F29DE3E98F04	07FCF14B177285A926509F6A1429B4396769C4FC2AD4C7F6BAF2E516BF4E6A60
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	26E4A101A2751E3D6D244E8D14326C33	D8573AB4DD24D84E5D517F8E56F7F29DE3E98F04	07FCF14B177285A926509F6A1429B4396769C4FC2AD4C7F6BAF2E516BF4E6A60
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	6F7C6C69C41319AC65D7F84051321567	7DF8FBE3AFA4137A04493CB35799A4DD4CF3B818	FEE79CBBD5BE175A04101E30D6A775D87BF51F2A1769674441063081DF9D14C1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\af2bccc6-5ad1-4e98-b292-4a4596955b6a.tmp	JSON data	6F7C6C69C41319AC65D7F84051321567	7DF8FBE3AFA4137A04493CB35799A4DD4CF3B818	FEE79CBBD5BE175A04101E30D6A775D87BF51F2A1769674441063081DF9D14C1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	6D75F5D5ED585823DDA1C22E28CF7E08	0CC5D7D9DEDAB9AE83305B819F48328D038449B0	6EC2F2792BA1366F46644F6BAB7A252CC55914D5E795A03CF226117AB6436FE1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	243C99D85FED5552E108BFF1F0C3A00F	79CBB49A0052B9706DFB90C63FA609D00EAAB647	DEDD80F59A00EE0D7C398D59B77524EE8358A06D6E4FD61E905C6A23D79A837C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	243C99D85FED5552E108BFF1F0C3A00F	79CBB49A0052B9706DFB90C63FA609D00EAAB647	DEDD80F59A00EE0D7C398D59B77524EE8358A06D6E4FD61E905C6A23D79A837C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240927090654Z-153.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	A33CFEAC332D8A5E2CEBCF1E08596240	61AABB910157FF9306CDE7BF7B54E51CA8C17815	4C6D58E2329DB46E91521B41075EFA33912D49CB2E8DD118A8D24F264B73335E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	C7E792DFCDA42A91252ECF24E13A8F4F	F99E67D1F9E283301894C9A9AEFB3E960B8E7DF0	F21DA543D7F9167649C7F10A094AABF885F96F7DCD5BE339A7B9AD7302361ED0
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	835B1AA2F8865FA40758CF9678310C00	B15E79C83898B59C4713E6709C9F770ADDD89EC5	C14B2326A3AB4A5A7177E064E9D31D3AA649C4E3EFD7F9522C5B8A768D83309F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	492B0801836AA87A521A0CFB9B9E4D50	33F9CF77803B6C5FD27B524C748329679EC561B6	854835291760D1B3E6D4E22B8B8620F2B4393A06023CEE091273089D1FEA6EFD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7104	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	30BA22E9A658CDB9627FFBD70400AC62	68A61AD6D5CDE7F304346A5A081BAF198E01D294	9FB004151D5E60259BCF4CC3AECBA11F644B39DE5ED8FE07E2E3524B7770F8C7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	8398530248B9298DC73F7AF4F843D524	F273B33C6560D1FDD4C7B14F6BE4518646FD4ECF	F147143B106E8EB55A37D17256A3D84983B5EB40A67E38A469F88726EBFC6844
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	6DFEA0D28B2E2AD63BFD90D0FDE0D3D9	4C7183D5AC041505C11302759DE9DAFFD8DEA193	4B5DC8366756BCF3A596623804221F4AE321A00455D59D3312F2310FBF5F37F9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	2A93FCCAFBC5A7E1A52C38077158C63D	332BD431FECD55A45B6591070C41AD2921F0906C	874C258030420535033B00A3C1D380E05B975CA7CF400A58781353CDE1982503
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	C7BC660B287E8B349A4E7897856B0A13	D2003CE0C7275CF1B9604C83E27B058F266C8B6B	544B10114495A646E4A28A7EE3A7DD7F10ED4234971C2B2AE76FF55CD6BB6CB3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D370576A678E3DFEE3B9C29976D9276B	BA4C28E032E40CA7A29C0847275B6C3E6582AFDC	5BA74E31CF83DCB67285259407F88DE211AACD5B25972914BCD6CAFFB6471B01
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	AE7F273A8B7F51E042C5DFCB0672FB89	A40EFCB615A9011B788AEB1B8D76B46997517A84	335A9DAFDE908171FDF5E92D78BC5070D9B5222CDD1008F91C2ECDC195817F06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	8F4AD8311BE60CAE4388B99701C3DF51	59508D6DC4B0902BB38DE0FDCDD05C23E2BEA5AB	33FFE67F9039E4853A134BC112C6F0418142AFCB833D3D2A0F82B0B0C553A10A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	95DB1215076E67CD8C42C9EBA9F32D3E	5CB6878F34FBDB1791E316267E715E4FB7FB16EF	B04DFEEED422167A48FBCE58EF6D25B411C141457B39A837D081D972D2C1D0B9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	299B92C1C9791E68A331BC278B934722	0BBF67E1C647D31081BC0F783FD449D0E513A0F1	5EF112DAB580205590B727A127E168D98410EAE64C77266177143C8FDBEA3588
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	8949D762C53C66B5D367771FA08C4DB2	72AAAF88FCD74E9EB0DFA5A5C14DE4FF9522FA9A	0EA9E0C6832B27B1319B28884F71B6BACF088891CA902C237D14B6191B1F4B1A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	E6ECD28368140A351BDC5F2FE67C6765	DB1FAD719470E74B3596540DDF285BC4B4D24092	2E314822E7223E8BF3C1C75E7FB89B229FB46F2D4DC90C60AB899722571C28E5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	47609E049C87BA0EA9E8952A79FC3DA4	E1008644CE7B863F58853E76A9432E7E96DE19BB	12304F27ED652DCD8ADBE713B8779CBEDB7597ADE22D30E6DB84E0846C234DC5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	7C9AEFF4AAC90A38DDEA4C6EC99B7BBB	C54019C8ACC970CE55B3BE57328A773BD7ECA095	E0E83B6AC16239D6C659EC54DC1A382CF6E10CB30844957EC259178BD1731EF7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	F157C27083D2D7F84D5CAAD0C5B4FD78	9392188BACD8FB3FD609CBCE4EBDAE52BC469797	CEE600185C40D766BE0664246ED286F8D4548861977F364FE393565308F05C79
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	361AFA21D73DF082F232F44D49BCA8C6	E91C0F36A31B2C51BABC6769B3CFB77F7EBC94DE	C030DF9315D992C6EC3FB6FE38A598B0BD618651E22E84F6CFD2279BAED0AFC4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	734D093F20BAE8A2E740475ED9B9170D	076DDCD01DF46A1068A692686B38213B31C51BAB	2B7B61F6B1F3AA07B724C9105DA9EB5F70A19F887120191C5386CA925949347F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	85638C9126F9B49045205046E90517BD	0E9E2C0E79FCA42007B3CCD1B463F31A44C95737	63652DB930B2B4731690294C5CF19D02DD03780DE6ED12FAD34C203A51DC6035
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	F22DEC7A39356BAF6DDCE31F066E4FD0	3110A14341B57A8EAD5262C11985E25CFBF2315C	9BA30008E2270846F23B0CBCF360ED3E9479430D7DFEA167C24B9EE267E88C1F
C:\Users\user\AppData\Local\Temp\MSIc075e.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	25A1C31CF582EF731F756D4812B5084D	209472739EAB4DA5A91421AD8353658237C46E96	A63BBD9C57EBA80F12B25C7C333611F5816ADCEE19CDD56FA8B77A1D77555C3A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 05-06-52-218.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	5DE26D0F7FD677AB527C3164FB19B5E9	39062AF78BBDFF2394654D3839E54912A9242C6E	A9EE01C07818EC4B80EFBBE29A96505BA12C0ABFC74713B06330DD419105D753
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	5101A7394D9266FBC5C6482EB1F6D9C9	829F6EEAEE7C3DA3022A6F8D36732513C7DE08E6	FE318C5E579A320296D20173E21B7A8D319073AB451E6D32845B3DCD6281BD81
C:\Users\user\AppData\Local\Temp\acrocef_low\3c75c4dc-38b0-4b09-8cb9-9a898c12b2b2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\445b266d-31d4-44d5-bc65-19149401b2e2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\458b9913-de60-42a6-a056-cf52791db169.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	A8E5C37206C98D1B655FF994A420FFB6	827237782AB5971EC205C3BCECCC7950BE9F84C3	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
C:\Users\user\AppData\Local\Temp\acrocef_low\88e84910-0dea-47cf-b26a-9f9793d87999.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
20240927102105.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report 20240927102105.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
20240927102105.pdf