Windows Analysis Report
NB-1VS3WT8.pdf

Overview

General Information

Sample name:	NB-1VS3WT8.pdf
Analysis ID:	1520593
MD5:	715eb14a11a55a5154d8b3835d61134d
SHA1:	89b1d4e41a8828a686e7fca80ec5771e6f4a7b55
SHA256:	ec1a2764853ed2f615d1274b1dd90adf7b94316d14b9385a7d284590dbee5a45
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.6:49725

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.41.168.139 23.41.168.139

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: classification engine

Classification label: clean2.winPDF@14/48@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 10-25-28-082.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\NB-1VS3WT8.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1664,i,13688217025086456705,37325080128419518,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1664,i,13688217025086456705,37325080128419518,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: NB-1VS3WT8.pdf	Initial sample: PDF keyword /JS count = 0
Source: NB-1VS3WT8.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91q4d4dr_119t4va_3rs.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91q4d4dr_119t4va_3rs.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: NB-1VS3WT8.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.41.168.139	unknown	United States		6461	ZAYO-6461US	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1520593
Product:	CloudBasic
Start time:	16:24:32
Start date:	27.09.2024
Sample:	NB-1VS3WT8.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	715eb14a11a55a5154d8b3835d61134d
SHA1:	89b1d4e41a8828a686e7fca80ec5771e6f4a7b55
SHA256:	ec1a2764853ed2f615d1274b1dd90adf7b94316d14b9385a7d284590dbee5a45
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	13447B2712BB52B7C58321D2CD720829	F92BF283908991FBC336D94A3906D492AC4DB0A9	A0F5D8BB2FEBF7D2AB96F270CB94AC8E393C5360D49DF580C3E7F7F8DFFCEE34
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	13447B2712BB52B7C58321D2CD720829	F92BF283908991FBC336D94A3906D492AC4DB0A9	A0F5D8BB2FEBF7D2AB96F270CB94AC8E393C5360D49DF580C3E7F7F8DFFCEE34
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	135D8826ECFD559E302A812A43A09E4D	D425411E085356E5A8B1F3EADC2FA2A04BCC60FB	7BEAF9872A86A8919302979237CC2ACDC9A8AD5EECD0F918DA3289E11876B570
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	135D8826ECFD559E302A812A43A09E4D	D425411E085356E5A8B1F3EADC2FA2A04BCC60FB	7BEAF9872A86A8919302979237CC2ACDC9A8AD5EECD0F918DA3289E11876B570
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B8F3A0F657950ADD745FCEB25E419668	8FBC744179757A3859B67B41BB9591436ABC607A	A1A7F413029875B7AC6CE7DDE01144E7FD327DFBC91A340FBF3A1FABED656504
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b729d075-ab08-4fa9-a156-fe7aef5fb252.tmp	JSON data	B8F3A0F657950ADD745FCEB25E419668	8FBC744179757A3859B67B41BB9591436ABC607A	A1A7F413029875B7AC6CE7DDE01144E7FD327DFBC91A340FBF3A1FABED656504
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	AE697E0DBD567F514A1AB6AD079AB9EC	9521B8F5D9B5762C1D81B82CD88CD5B8042D4CCE	448B9D5C5B4F521149D3B7258E19D036F4AD438DD1A450630C44ECDCD01CB7C6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	52E463D540C9810B6EDF620E13DC2AD0	259257094364986D87BAD3698DB83E470865A22A	83D62708FE289C42EE8B517B3122CB5F70A29013B6865875CB04EE93905E7ED6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	52E463D540C9810B6EDF620E13DC2AD0	259257094364986D87BAD3698DB83E470865A22A	83D62708FE289C42EE8B517B3122CB5F70A29013B6865875CB04EE93905E7ED6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240927142530Z-159.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	B6929D9B71758D83497704B0361F588A	B6F7C451284CF4E689E9C7B5F6115C67EC45476F	0BA2142DB26F43E290E05EE2BD6CBED35BCC0CE96161E23DEC76BAC4379BE2F3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	A19BCD4C0E2512E0107ABD97437BACDA	C4DCEC0ED0EF8D3DB6A2C68D8E2ED633B3D1FFEE	42B5D588C8D0B9B11FDB85632C6B2571A6D105FC0E4F1FC184C85E5F5ED37A5A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	91E15C343628EAEE4EF4FE6A8425816C	AD581914D5201406248A2C4D30FECB4B9425189C	73263CF2C925FF61F42D21133CC036730D0194528BA5F1A91E86658E33015ECA
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	237027D2CDB3E102FF90ECC16004DF3E	413D5E8AF1E2CC5E447EC4B4B168342A67200DB4	16B3A6453076B09EDE7E4E8D63AF0678CE976A9DBD8F17997683D4F97333CD5A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	CA816E5A9B58B8342F5345BF6189F195	8E0B933277F8D95A1326C152A15A188D5019AF26	794498AA088014A81DCD6A7826241334908DB803A6EC6E2F04AAEA5C25E820AC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4888	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	098054AF90D28B3DCB0DD652182000ED	12A2246B0139665E3DD7232AF7B95EAC2C901863	5F94AD63124F4ED7F441C4161DD5BDF0EB95ABF548663507343E047C22508F13
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	0B48368B09CA49C762DEB426222A7530	D84B0ACE4C86DDDAA22138FFB137D9F96BC4C5F0	6A5D2ABB743AABBC5AB15D0D289DBE556A6957422A876400F67E7021FB6F960B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	2FBB9FA39C5D76CA66E9E3A302E1F306	D2EE2E5BA205A3D9489D204194765DDC0E731BB4	0B89F2FF0BBDA14DE69B8EFC79442329FA93CD9364369340E8D693A643144F43
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	3E74C7D1B4874838A61D62CE91591E7C	7EAEE10063E7633C9EA69CF0071EDA8B4383EB86	B882F1B6BBDF47009B94E53749920E4F91ABF2BD37B8EF59ADC89A253BC89339
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	1BCAF2E755D8A97AB56F313EE723170A	D4A32D3D0746A8B22CCD9DC0369E0C83A3E97704	298FF1B290D65BA188F95ACD90FAEF6F96C49600451F285D69929FF29B1568AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	3378C82CDDD3539BD3034E8C2C1C7C5C	96AE4ED1C9C37EC81A499B99215BCAD18A4EA4E3	DFCFA307E5D18AA65D824B855A5CDADE22BF42EE1FABE089D06628DEA6FAC15F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	FDFCA96689F50D056734582C83C7D921	4AFA4574E9945A8A3B1C1EF50FF3B34CC20FE05B	CCF0861AF52D9C9A21E3F665470762DD78C679D1A4FEB74D3BC83E14A85E0B85
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	E14D6D721151BCDF1EA9ADD6B582D9F4	D36862A39E65064DAD84BF9EAB82368B21E49062	BEDB29E7A1D493F112DBD23E29E1874040ECA2253465DB6529BD242575620AAE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	D3E884A15D7CFCC5308F5A2C9CBDFF23	790D74453BC879C64C79B1DA572C39C35915F27F	9FC93CDDB51AC97A87D4F07AC32C80C72745ECDCBA7862ABE5ED76FB1684FDDD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	7E96D69EB37E17BD3C7BDDAD00565EBC	97B56E986956465C10E2358ECC3023BA902B0F63	61412DA6298ACA54B9C95D93197754FA7CEA85586DFEC7C748CF0567F03BB480
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	551F05B60B41BE21B2B46E879C89A573	CAB70D7BC9FA33FE67656ECBA6FECA82189C1953	97E3C03453E35E8D18E59E6A661CC8AB1FD9C00B01AAA2E982F0F792C070DFF0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	75F247B40CF5000BDD086975DDCB46E0	68DFC81F9646B9F48CC549DD813A21C7A9803437	BC37EF00DBD18E8C91068B19CC5E4236066AA97F1BC9D320F9E4CB9C83B56CA9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	A5C7DCFC2AF2957E088935DC51C45DB5	48628AD0054B0B88060CA72A15BAC0D16C0822D3	8C72CA1C1272C1741C6626245C4309EDEE35F1F29A8CF2D14B9EAA5EC2A177A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	93FA9465CD2001997F2F608982B71F13	17979EC192DF6E901253CD3E665487957E735945	451254082DA9E726F6FE00E0A3CCBDA6D90517BF34F71F7BF306AE6113482F9E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	D2C0F5740508E9329E208AE1AA968E11	7998EAACE4EDAC0D37FFC4F41F92FA03E8795E64	606F7DFCB75BAA2D0B971206C932DF7AAFBE8E074769F5828F6CA3C15AAADAB5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	C5D9C1C642E0D67BA7A06920A2E21D2A	8B1B2E33FCEE6FB4F2C247162A504939FD6210A5	F838DFC93DE57FC3FD9BD7C634AC5665CDEDA9910F0A76400E81390011B95DF6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	5EEB16D8601F90FFB76B28BC55739EB5	CBB4C6B5485C85E9E2524BEDB39652A746D09DC9	D75BD0B8FD29F7EE5598A4BCD6ACA2B095AB6BA35D9FF6E72539833D07040C43
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	D1565FC95C369CF05086D9A755788A34	97B7ECD73B8B7C1875CE6C3AE6AE898E9C0FCC20	8C5ACA842903085B915EED6B8144DB32002A2B3A4BE452AF1569CDF75B52845E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	CE2780A93F95EA80ABDAF3E0624E3EFE	9F1EA15A649BBCF2801CC88B07C1778D629B3AD0	E959EAAE4735DD785D34989EE041C9F5D13F30548A59C97A8549902A10DEA69C
C:\Users\user\AppData\Local\Temp\MSId1a7b.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	ABB4A95DBB82E0A31B4E57FF140B3C16	8072ACC7B16284ED3C4C68D83320A01426B1DB9B	781C82E82B47FFF4BF7A72BF73A64E69D3DB7D58F2EC9BB4263DD05BBE166F07
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91q4d4dr_119t4va_3rs.tmp	PDF document, version 1.6, 0 pages	0F5661E1EB4618BAC38ED0C2CA22F068	157DA794AC0993112D481CE3D1D6C24999C62E51	0BDF76CF84532E51D397B4B4E79C6E48F549F3A7EA2B151D89E10611F0F7138F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 10-25-28-082.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	A211C8CDC808546AE9DDE4AA67FEA94C	0E8DAA7072F2C2A13010B5F8530CCB7ACA88623F	44FD9FBACE7EA9A410F93FAA002FF39A0D396A6578D2C008ED02F7A22C08C7E8
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	AAE7EDB394D76E578472C3B0ABEE39CF	89984766EC2EC65E1F170224C5B909C6D983684B	4CAF8AB70BD1EBF4D08BC09BE7335A4671C595AAB83E3EE15996EAF842E688F0
C:\Users\user\AppData\Local\Temp\acrocef_low\4c20b54f-655f-4ca9-a604-76e4b8f7b71d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\4fc2f9a4-9753-4948-bdf1-d6fc7fed60eb.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	13F55292D0735B9ABD4259B225D210FC	810CC5D545BFA11D2825F6E1DFA69176794DA7EC	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
C:\Users\user\AppData\Local\Temp\acrocef_low\83ab9770-6047-4679-af7d-613b4e04f643.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\971ed7cc-12f8-46ec-8848-9a610b92afe6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
NB-1VS3WT8.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report NB-1VS3WT8.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
NB-1VS3WT8.pdf