Windows Analysis Report
Project Proposal.pdf

Overview

General Information

Sample name:	Project Proposal.pdf
Analysis ID:	1520707
MD5:	9b85f102a4d5abb6260746d762e6a242
SHA1:	5d1e77baa5e6ec00f8938e9dc88a51920751193e
SHA256:	1509d336bc7fd7a8bc6e3ae8b888c305df17a1d3fbab3419c2b8867e799138b5

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Suspicious PDF detected (based on various text indicators)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Phishing

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: REVIEW DOCUMENT HERE

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49712

Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: classification engine

Classification label: sus21.phis.winPDF@16/33@3/62

Source: Project Proposal.pdf	Initial sample: https://k3nd.rixotexa.com/gfsww/
Source: Project Proposal.pdf	Initial sample: https://k3nd.rixotexa.com/gFSWw/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6404

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 12-34-39-704.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Project Proposal.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2240 --field-trial-handle=1592,i,17894290379442899653,10121711594863025015,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2240 --field-trial-handle=1592,i,17894290379442899653,10121711594863025015,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Project Proposal.pdf	Initial sample: PDF keyword /JS count = 0
Source: Project Proposal.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Project Proposal.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
93.184.221.240	unknown	European Union	15133	EDGECASTUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
34.193.227.236	unknown	United States	14618	AMAZON-AESUS	false
23.203.104.175	unknown	United States	16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1520707
Product:	CloudBasic
Start time:	18:34:07
Start date:	27.09.2024
Sample:	Project Proposal.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	9b85f102a4d5abb6260746d762e6a242
SHA1:	5d1e77baa5e6ec00f8938e9dc88a51920751193e
SHA256:	1509d336bc7fd7a8bc6e3ae8b888c305df17a1d3fbab3419c2b8867e799138b5
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ae4f645-8b3a-4eb2-8697-0d20a2421e37.tmp	Unknown	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	Unknown	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF536c14.TMP (copy)	Unknown	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a4e8113b-9dd3-4b28-b3f0-7ccf031b1cea.tmp	JSON data	286472F2393F8160EE75E3B86890B87E	78D0BF06DF946A62C8987EA6E0AFF2A0472DCDFF	37274D18893602EA53EBEAC84CD79C3C1A7FFE449467944A1EDF106A1BB54CE5
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240927163441Z-164.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	BFB9E7D7B55AC1CA7ABE3A792FDAA54D	7F5A1653EEEFFEFAE2E8ECBED64F32313CE623B6	824C9F6E61EF26FDADF6044DB4F6D04EC374248AA0483981C38121819DB82A72
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	D3DC7248232634953AB37E054755D48A	6E8EB2A675DF64BDA9DD5EBDAC2E5FDF6A8882B5	A333A066E70CB4FCC0AC743F0C94FCE650896D835B8462AA2ABE33F3E3CF0E1A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	4277E6E0B770E58A76F2B7FC7EAC21C8	283A4BFFA3D69A6192CEB0614BB8375860CB15E0	9FF6654434831F06B322BDF501BC1321FE06134E6A7342CC8EEA981E6CBF37B2
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	9D166FF7591C7B98848237E1187327BE	F969DD82B432446A7147683D1029E97AE9EEE8FC	4E88FF39848E46C08FB5A2A6F14FEFE26208C60F08E8BD9197C88CEDFCCF3A02
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6404	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	337071C4BBAB58F88981D34423A77B2E	5BFA953B5CE9B3C55A58DE051751763ABC201811	6F5CCF0404A5894C5DC6597D99C848DC543BE0F31F15DB418494F9D6E42E1D51
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	36B1A5D41A2A54575F6D5E3DF36B01AA	5AC5831EE45C74E6CAC8539A9A1B68F637B805E5	A3B52DE9EA9FE074838BAB36AB88ADA039263D1EAF841A3D2489FD2AF3CCC370
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	86248E8868B91C6DD620C0DFF2038D21	A7DE7705046A5A0ED0D4A191D5BE3451CB595007	142115022C1E74DAEE0117D961A2E66EE7A0E036A34E88402FFF5428F7EF984B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	4F82A1525F2C6BBA4163FB46586C600D	813D4C5200CD27CA0B15ED937416C22C7D81C131	A2854BC404FC97672908FD9097BF3BAEAB36DE7524D97F5FEFD7E94CF6C3FCC2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	A76BF8A959B37594AE63484C7B105053	85B4F9BE2D7226965930A2770689AA4AF9D912B5	2C8892833A87A3807587A2FF14554A4ED9103211DF0949616B57D372A49A2493
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	2EFEAEBE08A97AED906BEB6185CF44CC	7540B0D82143542E0419427DBE9BD6EEEEA491B3	D7941ADA57344DE4A71ED1EF0D61B6C035EFF99E80552C396D4A201570E4350B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	41DD2493F63D3BB8AA522FFCB1D0AC88	6C5DE9141E032B41F22222A2C57A597151B30CBE	7C4B5CEFA2D08D95AAB5D5C498A29A20BB1237203D1E0B067E2E169BC7F9C771
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	AA378F2E94E4ED6CA4C0FCDA92959F18	FE3FDF815FE2017124D788D9675487008C9A8BF3	15D975481EDA427DEFACF26A525F51D8676885FFB92F396B3374E63242CA8310
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	6485C22D7605E043608FDC2B1B600008	FFFCD3048211305481BBFC495D067DD803C9A4A5	16503EBBCBAAEE222022235539379EC377A09654A2CE2C8E9FD3D8B5294076A7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	C1089E5FF03E59E57E7D1FBDBE94CE95	9595D577AA475C121A5BFFC4ABE6E8EF7EDDF500	AAE6A7D0069247997173DD340FC782CE5F5079DEAFFED625F68167D5CC1D606E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	B5F6ABCFB7B132E6DC013F87351FE91C	A51F752FA25CE25D407346B1AD762994597B7C9C	F5A2FB83DF2ACEF128B481D8E07630C7CD28FB1B9A71CE29F97E84BDB7090F7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	7C7570572501D2D75FD3B80DBFAEA013	7A77D7E1B2C9F089D3CE609F05AFF041CBBA74EB	944CF62B9805BB3EA82D2E955764BAC51036105E88010D232132C90A6DCBD0CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	80561FE71936BC431F45FA702E2CC2B8	742A41E80CA4A4F292900A14DDC79AEB38E277A2	832F109912CF448B1E5329174C4CC5F1C02F9A9725EBCA3D0B3AF2A02AA80301
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	B005995A0F5A7EA44968784404F8FCA6	F674702BB0A7E45AABAC0C23405F5C569DE7ED8C	308A56CBCAFB0FFA4F5FD601F286257D624DFAADCBBA84F2556EBC692F42CED6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	C831D30A2EFE0E3AB5C9B80F2C23FCEE	4D21AD4EBA8A6F9C3B1E2402E745D8CA4144F71E	0A408809F4488D666FAEC9F12FE0D096D5EAAEA3B798029BC45394532B109388
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	2266A367FBD9DA89FECB434007542B7F	FA8CE92E0CB1A92CC412BF871169C5D66783FAD8	5E35528972D92A92F592A86F963E8C5CA75AD2081843EA9602DAF5B0F51A6F47
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	BF2710F934FEC03A6966B5D1FFA6F5DD	0138EB38363D3EE048BB0DA73AA12F02E4248EA5	BD4C6074B366B56393146D09D02649B9A155CE697D3BF5CF0B7856FFE1A693C5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	1D412E0241217FF826D110BF3DBAD4CC	3B8FD10B189374CB61E42D49DEA3DE95A4705972	4F3CB21759BBB67CB5203159B4B5737E41C5B1B8539A633D7986EE2E840558D8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	AE9ECF8C57AD11C3426E251C48BFF41D	707716363643E4FA7A0EBA32C0F04E5E84E2767D	BECDD44FA856198D7F61E07E3E937568C92DCABB99988B7612C8624FDD3E2865
C:\Users\user\AppData\Local\Temp\MSI25eab.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	95FD38A5DFAA14F020780EE5544BBD03	85AC8BE857D51F1CC738B62BE9C7E08963EA244B	EE7D2DD1F1C6118252217E91F9CB5C08FA8FE9D7D92A1B0DDE90828FF969AA4F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 12-34-39-704.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	184757F54D23766C378BB6305003AEA8	9DA91EBA63F4FEDEEBC95040089E72ECEABCF809	0176E465170F9018174F01C724C1CA7F073AFDFE3E2580B953FA4BE704FF0E87

Windows Analysis Report
Project Proposal.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Project Proposal.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Project Proposal.pdf