Windows Analysis Report
Snc2ZNvAZP.pdf

Overview

General Information

Sample name:	Snc2ZNvAZP.pdf renamed because original name is a hash value
Original sample name:	6a638569f831990df48669ca81fec37c6da380dbaaa6432d4407985e809810da.pdf
Analysis ID:	1522685
MD5:	0618acfa112b625533434c552da4789f
SHA1:	936549949236c17330009a1a2490274fcb836a98
SHA256:	6a638569f831990df48669ca81fec37c6da380dbaaa6432d4407985e809810da
Tags:	pdfUAC-0099user-JAMESWT_MHT
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: Snc2ZNvAZP.pdf	ReversingLabs: Detection: 26%
Source: Snc2ZNvAZP.pdf	Virustotal: Detection: 18%			Perma Link

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS query: name: 50.23.12.20.in-addr.arpa

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.5:49720

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.56.162.185 23.56.162.185

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 50.23.12.20.in-addr.arpa

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443

Source: classification engine

Classification label: mal48.winPDF@15/27@4/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-30 09-31-15-663.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Snc2ZNvAZP.pdf	ReversingLabs: Detection: 26%
Source: Snc2ZNvAZP.pdf	Virustotal: Detection: 18%

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Snc2ZNvAZP.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1508,i,13964882230613793224,8197444070815095348,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1508,i,13964882230613793224,8197444070815095348,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Snc2ZNvAZP.pdf	Initial sample: PDF keyword /JS count = 0
Source: Snc2ZNvAZP.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Snc2ZNvAZP.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Snc2ZNvAZP.pdf

Initial sample: PDF keyword obj count = 56

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.56.162.185	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
windowsupdatebg.s.llnwi.net	87.248.205.0	true
x1.i.lencr.org	unknown	unknown
18.31.95.13.in-addr.arpa	unknown	unknown
50.23.12.20.in-addr.arpa	unknown	unknown

ID:	1522685
Product:	CloudBasic
Start time:	15:30:08
Start date:	30.09.2024
Sample:	Snc2ZNvAZP.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0618acfa112b625533434c552da4789f
SHA1:	936549949236c17330009a1a2490274fcb836a98
SHA256:	6a638569f831990df48669ca81fec37c6da380dbaaa6432d4407985e809810da
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	EB6124A28368DF7B3C141F1B93ECD40C	0162D8842ED8F31BF3EB1D9F93D330895C5B26BE	4B8DD6CF3045C1D05EDD9A5CBA3966E6796ADB9BE02A0BA9C9178D3B7D90E7F9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	EB6124A28368DF7B3C141F1B93ECD40C	0162D8842ED8F31BF3EB1D9F93D330895C5B26BE	4B8DD6CF3045C1D05EDD9A5CBA3966E6796ADB9BE02A0BA9C9178D3B7D90E7F9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	1649FEE822B27573FFDD30BB77DC125F	DAB1710DC6043D87BCB43E59166484FC0BC595BE	612B02832B03D4A9841CB000A4F86BD41B200F76A59BAD4FDA2BE744BB5C98D8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	1649FEE822B27573FFDD30BB77DC125F	DAB1710DC6043D87BCB43E59166484FC0BC595BE	612B02832B03D4A9841CB000A4F86BD41B200F76A59BAD4FDA2BE744BB5C98D8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8eab5d25-df59-4b22-87c2-2763ecafac4b.tmp	JSON data	22A70DD1593FEE263DC175ABC61D2706	F6C9ED97E5721D5DF98D083905FE300209D51737	832C21D9DBCD77BA3B7E52ED7742A7EAF45AF1A5252B23DF006924DCBB2F23AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	22A70DD1593FEE263DC175ABC61D2706	F6C9ED97E5721D5DF98D083905FE300209D51737	832C21D9DBCD77BA3B7E52ED7742A7EAF45AF1A5252B23DF006924DCBB2F23AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	427771239E05B9EC7FF5594E11956A4E	B52A32A969CCECCB47D6FA28891AC8B621EE58CA	505FE0B468C07A2BBCBA51AED9DE303FDC2D6FDFAE3A31584FB4877D2A762793
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	A87C4ABB76BEA10886E5F8B2752C91C4	FAE56B3F7BA608389A5391A789DD42B7EB2F916C	69BC13E06294DC88F215D7DBD336F41AE4B15F0EB159E43AEC7C3FDC8A6E9695
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	A87C4ABB76BEA10886E5F8B2752C91C4	FAE56B3F7BA608389A5391A789DD42B7EB2F916C	69BC13E06294DC88F215D7DBD336F41AE4B15F0EB159E43AEC7C3FDC8A6E9695
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240930133117Z-162.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	E317AB21DF717AA81B96FAF5DC1B7B17	951088DF72E8217EA0DFA82C62623153F86D7267	C029EED18F5827062A659CD0CB2EF65BDB97918638DE86E8B4496C1C8CE626E5
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	4C70BD37AE8467597F8ABA4D7B8B50F9	7E49697C710C07D85C7F06049B96A04E5A165425	D168CE96C1773A9740370B947768A8B3FB8030CC7A4B48DC7C031E913C8AE8A5
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	7EE0A696A2196781FEA88DB74D7A4C75	19B5CB23BCABEFD9630E3DAD798A18D76F6BED37	F2709A9A07E5DE6F8FBA023BC56F8AF50A728108B74B7F2A47BA5314C0F3EC23
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	5C430AFE953D7A85E7F0EA9E1E820238	E3B17FBE108694B1A17FC005F16D1D69DA8B79DD	9F234B8D3C9FD47E01F5F22F5F013F656E0E1F62BBF17A5173CE2A9E57E79AA5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	4DF389B122A052A825F279EF63DDC8DF	66907CD7EB7DD45E778600E9EB4AC911FC8F5D29	8752D670BC7C5E04AD56E94F04BE50C25255905F3F433E50506C7928F484A94C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	5A52F665304F291E7C63363B47235AB7	0B7F67FF861DC32BECBCE7C9461A34612EEF60D8	7A0318F0BC1E91D6613DD26BAA1BFD3AFF97F6095399D871FC14998391918C2C
C:\Users\user\AppData\Local\Temp\MSI3125d.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	81F3067F72FA97A080A9DA4DCC2BE235	474AF4F8C75D4C44618B481EF72022C64DE76D19	DF6947CEAF54B53A0137A93BF6F13655BFF58DECFB3B8D7C8BA0C2EB8D19D9F0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-30 09-31-15-663.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (392), with CRLF line terminators	38E3CDAD7029B838EA0DE6E255E7CD0B	D669AE00A83C15FB4745AD33B7ED1023BAE7D3FD	F5F8319CED0C0AE0793D8C7360A1A15BA369159C53F4CF8F712683797A455105
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	D197165179B0F4BC8CB8774E56D9F47A	CA5DE3BDCD5C86F2B030CCBCD1B4658C080D0C08	D5B44E3C6BB5C300FF089A85577AB7E2AC6FC63B8EECC741DBDCF62E4796A6BE
C:\Users\user\AppData\Local\Temp\acrocef_low\1101007e-d489-4d11-9e0e-39a85598d9ee.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360	9118F75A14E6F0569B9E0A0575A1F536	39B4826A013612F9DB0F09C64FD3A392E74DA113	92D79BD93488EBA7061D7839078DCBE5BF331287B696703DAF1A4D7586D486B0
C:\Users\user\AppData\Local\Temp\acrocef_low\4679fbcc-5058-48db-8c02-c7b604a088a6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1111944	07C722EDEB2A1639D380711F2FB4E022	5F1C4C0EF8B9C061212335F860020218A8E4C2E4	BD873E5A50392F405BDD0C7B8C74BD0E75D90A16378C40CF356AD2C672C1C1A1
C:\Users\user\AppData\Local\Temp\acrocef_low\b56f9557-28e8-472a-b747-8abbd32010f1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\f76ac5ea-696f-4c6b-b31e-b92b80e376f2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	41034A6B023B6BB9C723DA146E190954	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D

Windows Analysis Report
Snc2ZNvAZP.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Snc2ZNvAZP.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Snc2ZNvAZP.pdf