Windows Analysis Report
Sales_Contract_Main_417053608_09.2024.pdf

Overview

General Information

Sample name:	Sales_Contract_Main_417053608_09.2024.pdf
Analysis ID:	1523384
MD5:	2d0f41331b328dd46fb292be227c31a6
SHA1:	8fc717994273423987ed1afe7a562e11eba6e181
SHA256:	5a65a93363e76041ca62a4870926413c99b49f72c5e8650c7c671691f066c450
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found potential malicious PDF (bad image similarity)

AI detected landing page (webpage, office document or email)

Suspicious PDF detected (based on various text indicators)

HTML page contains hidden javascript code

IP address seen in connection with other malware

Classification

Signatures

Phishing

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: Your document has been completed VIEW COMPLETED DOCUMENT Hi, All parties have completed Complete with Docusign: Revised Sales Contract Main 417053608 09.2024.pdf. t' docusign Powered by Please, Do Not Share This Email NOTICE: This e-mail message and any attachments are intended solely for the use of the intended recipient, and may contain information that is confidential, privileged and exempt from disclosure under applicable law. If you are not the intended recipient, you are not permitted to read, disclose, reproduce, distribute, use or take any action in reliance upon this message and any attachments, and we request that you promptly notify the sender and immediately delete this message and any attachments as well as any copies thereof. Delivery of this message to an unintended recipient is not intended to waive any right or privilege.

HTML page contains hidden javascript code

Source: https://bqcjkdkt.melbourneschoolofmusic.com.au/

HTTP Parser: Base64 decoded: {"version":3,"sources":["/cfsetup_build/src/orchestrator/turnstile/templates/turnstile.scss","%3Cinput%20css%20qtFLbZ%3E"],"names":[],"mappings":"AAmCA,gBACI,GACI,uBClCN,CACF,CDqCA,kBACI,GACI,mBCnCN,CACF,CDsCA,iBACI,MAEI,cCrCN,CDwCE,IACI,mBCtCN,CACF,CDyCA...

Source: https://bqcjkdkt.melbourneschoolofmusic.com.au/

HTTP Parser: No favicon

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: chromecache_255.10.dr	String found in binary or memory: http://code.jquery.com/jquery-3.3.1.min.js
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_255.10.dr	String found in binary or memory: http://gmpg.org/xfn/11
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: Sales_Contract_Main_417053608_09.2024.pdf	String found in binary or memory: https://bqcjkdkt.melbourneschoolofmusic.com.au/)
Source: chromecache_250.10.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: chromecache_253.10.dr, chromecache_246.10.dr	String found in binary or memory: https://refreshbills.rtorres.com.mx/vd/

System Summary

Found potential malicious PDF (bad image similarity)

Source: Sales_Contract_Main_417053608_09.2024.pdf

Static PDF information: Image stream: 6

Source: classification engine

Classification label: mal56.phis.winPDF@45/54@0/7

Source: Sales_Contract_Main_417053608_09.2024.pdf

Initial sample: https://bqcjkdkt.melbourneschoolofmusic.com.au/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 08-58-20-752.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Sales_Contract_Main_417053608_09.2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1588,i,12071405801265568168,14382545226259116171,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://bqcjkdkt.melbourneschoolofmusic.com.au/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2000,i,15099606229995870722,15434085164107095948,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1588,i,12071405801265568168,14382545226259116171,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2000,i,15099606229995870722,15434085164107095948,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Sales_Contract_Main_417053608_09.2024.pdf	Initial sample: PDF keyword /JS count = 0
Source: Sales_Contract_Main_417053608_09.2024.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9f0j0p4_155qn9n_4vs.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9f0j0p4_155qn9n_4vs.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Sales_Contract_Main_417053608_09.2024.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Sales_Contract_Main_417053608_09.2024.pdf

Initial sample: PDF keyword obj count = 51

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: PDF document	LLM: Page contains button: 'VIEW COMPLETED DOCUMENT' Source: 'PDF document'
Source: PDF document	LLM: PDF document contains prominent button: 'view completed document'

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.185.12.194	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.41.168.139	unknown	United States	6461	ZAYO-6461US	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bqcjkdkt.melbourneschoolofmusic.com.au/	false		unknown

ID:	1523384
Product:	CloudBasic
Start time:	14:57:22
Start date:	01.10.2024
Sample:	Sales_Contract_Main_417053608_09.2024.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	2d0f41331b328dd46fb292be227c31a6
SHA1:	8fc717994273423987ed1afe7a562e11eba6e181
SHA256:	5a65a93363e76041ca62a4870926413c99b49f72c5e8650c7c671691f066c450
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	BC2992F26EC5D1B2182EDF25BEF6BC15	CE15A266B5B11C7B275F7D9F4EAC1A78E6E470FB	13B9B4280A93BA889312492167B16CB3355527374355DA0E42CC852E882C3A75
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	BC2992F26EC5D1B2182EDF25BEF6BC15	CE15A266B5B11C7B275F7D9F4EAC1A78E6E470FB	13B9B4280A93BA889312492167B16CB3355527374355DA0E42CC852E882C3A75
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	3A2BD942560666AB2770F5D27C11E67E	F7C49405720595D6F3672F453F232BD3E5E3E85B	145C742E80529082A80EC3E2C51B9BE0EE14C3736BC50D9931618FAEC05D390A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	3A2BD942560666AB2770F5D27C11E67E	F7C49405720595D6F3672F453F232BD3E5E3E85B	145C742E80529082A80EC3E2C51B9BE0EE14C3736BC50D9931618FAEC05D390A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8be44d87-4283-4e9c-ac8f-34ecef3b55b9.tmp	JSON data	5EFA374AE3F122C942863E94F4772B3C	AC4676F6DE944CC9346D89360645CB1F87A60175	E5D1742AE8B065D4BEF43626AABDB32A1B5B12610B0CD44165987A9B4D15735F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	5EFA374AE3F122C942863E94F4772B3C	AC4676F6DE944CC9346D89360645CB1F87A60175	E5D1742AE8B065D4BEF43626AABDB32A1B5B12610B0CD44165987A9B4D15735F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	15494466EC9E361A203F090451380A04	436AC571DBA7E033CA067B62C5DE8CDE66B6D9EE	84BEFF3270406161B456B96B65A3E8543DD3DB5C44E41895B2238E52F924E8BA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	DEC98EB0BFF9EBB4CBB5C748F44DDBB7	F92AA60956B71CE7BAB1C3F8C9186215199A3A01	E3D595480DAA1A3C6D72EE3BEC622654518F04ED4C2223D970153A2F962FF5A0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	DEC98EB0BFF9EBB4CBB5C748F44DDBB7	F92AA60956B71CE7BAB1C3F8C9186215199A3A01	E3D595480DAA1A3C6D72EE3BEC622654518F04ED4C2223D970153A2F962FF5A0
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001125822Z-156.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	6F5E6AE521880CEB3BA0490202C12ADC	E4FA037DA1B01418DEA9B4DE8D22A7F121847F61	02F1FD8F47D12C31CE276F27A15D7794B7420918DCB97192D927F3E50D40BD0D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17	0F4258AFDDB1F41CEB86BCADE80D943D	A3D032C5662E351827115E6A537489DF600E1DFB	1E1529C9C76D01977E7418A1B3EB79A5F251C156BC51F85F0BF72F58416B3CFA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	C8B2C64630293E1B83A3C30EBF51764E	CEEEB0408BF04BD13052F0FBACD83198D1AA9FFC	F3633CB0FF8A6B599314C65ADA30C97AEB7655FE4F407A42A688745411AFE0DA
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	F901FDF2765F176B85ACA9443CC3EBF8	F3F1D94738B5725805A83F188D0F33050A2B5A9D	72A5FFE1A9EC393A6E62CE572CF363E248049753DA5D5554936EE80BD3572ECD
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	DB5461762D19805B78A6F8FDC8B6E76F	59453CEDA2ECCBC0E3CEAB12006E9BF7ECC80397	9A78E2A6508CE53222BE3B3EC7B51FE37B1347B79090990E276CC829C0CDF34C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	48EB345166D37CB236045D01385E3D9E	38918CFB4085832D540D3B7F2029E8F35C35210B	460DC4EDCD449CAAD112EBBEA6CADAAE325E796C1474E4F4D5F56A04C4428834
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26	946DC13B536E118318F1BADABC50D1F1	1B1A7C06B954CA2E680BC3042F6F3D87F756D82C	93AEF4F3D47B4CBDD3EA58BC5D6B6953C7295D12E546B20053EE2BD5F1F899BD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	25A2EB74886465B0BAE0A0BF3CF886C8	59EFC76EE67D8CEE21587D9D6FB4E01AE0E253F5	499E2CE101CF6AADA5888065F9CBDE27A28088503042F4CE7D060639BD60B02F
C:\Users\user\AppData\Local\Temp\MSI4a9e5.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9C607E1CC9AB887765F1638CF6E6FAC6	27E67E16551004FBD46C63EAB643128A974FCFD2	43BA6F29FE7D06710443AD694A909E452A5A5E447340248783B0FB509B2CC1AC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91yk2ig4_155qn9m_4vs.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9f0j0p4_155qn9n_4vs.tmp	PDF document, version 1.6, 0 pages	04845E45E021B2A853755270F239D7EC	BF410E84316CD77F42434D6D8082E651E3D0B314	5E2DB6D1E6AD2994B9D0F9F4AEEBC186CB784A5A4C55E1E12297E0682E313A65
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9tyfbkv_155qn9l_4vs.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	BA1716D4FB435DA6C47CE77E3667E6A8	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 08-58-20-752.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	5C8C0FF3FB5E41872D6F04284A3FA868	87919AA17951C82B33D1E0A36169B61EDEF57A53	6FD2CB093189221D8FA705301DB4B17692D4171916404DF84E16E08749BF67E0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	750E124D6E9B7AD44E04BC112177AC98	FD65D5E333CA38D28F3EFAC42780D68F37081BD3	1DA1A592726CC8B6576289C89BA4BBC9B5877F508D73B9EE27A26C1E9F7D65A9
C:\Users\user\AppData\Local\Temp\acrocef_low\20aa448f-ff1f-40b1-8c1e-5b17e6788cc8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\6923ff12-419b-4cda-8fdd-be3d11168de0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\fa5d318c-9100-4abb-8f5a-d25c7d7bdd14.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\fd598082-cf22-4b3e-a9a6-f0401c326a37.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	7113425405A05E110DC458BBF93F608A	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	5274D23C3AB7C3D5A4F3F86D4249A545	8A3778F5083169B281B610F2036E79AEA3020192	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
Chrome Cache Entry: 245	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 246	ASCII text, with CRLF line terminators	9A09C94AF080C29B4A89DE4595B2CF82	10F83A914F88E029C11D855E7081C90EE53792F6	5115FC69B29994E0722FEEABBA4EDD11576616FFBDF02B380AFAD7427D69FCB7
Chrome Cache Entry: 247	ASCII text, with very long lines (47261)	E07E7ED6F75A7D48B3DF3C153EB687EB	4601D83C67CC128D1E75D3E035FB8A3BDFA1EE34	96BD1C81D59D6AC2EC9F8EBE4937A315E85443667C5728A7CD9053848DD8D3D7
Chrome Cache Entry: 248	ASCII text, with very long lines (47261)	E07E7ED6F75A7D48B3DF3C153EB687EB	4601D83C67CC128D1E75D3E035FB8A3BDFA1EE34	96BD1C81D59D6AC2EC9F8EBE4937A315E85443667C5728A7CD9053848DD8D3D7
Chrome Cache Entry: 249	PNG image data, 43 x 86, 8-bit/color RGB, non-interlaced	5AE190605CC778F62065478C5F6EC15B	204641C97C5891D549BA9A1B7D811861EC514DB5	1FFF2EDC532CA3F7CEB0A5A7AC81F954A1F5B95EFE2B48B916F25B734831434C
Chrome Cache Entry: 250	HTML document, ASCII text, with CRLF line terminators	90FCE18E5EF426EA4D79AA9F3553FB96	2FC864EA0F46AB0D95AC9FE00A01E4280D780FFF	59EACA076136932EC883A42164BEB703DB25C1616F2D6759A0AF2A620C170157
Chrome Cache Entry: 251	PNG image data, 43 x 86, 8-bit/color RGB, non-interlaced	5AE190605CC778F62065478C5F6EC15B	204641C97C5891D549BA9A1B7D811861EC514DB5	1FFF2EDC532CA3F7CEB0A5A7AC81F954A1F5B95EFE2B48B916F25B734831434C
Chrome Cache Entry: 252	PNG image data, 76 x 43, 8-bit/color RGB, non-interlaced	E4A3C56458B8E5DAF0515B852F5E4EB9	E80B7DF5BE789A4860967D892BC7508A5C4E403C	B12068B5496D6C2F8A6E224F08B5157A8E8E4EC5AF7B57A1F113DF4CD0F6E3B3
Chrome Cache Entry: 253	ASCII text, with CRLF line terminators	9A09C94AF080C29B4A89DE4595B2CF82	10F83A914F88E029C11D855E7081C90EE53792F6	5115FC69B29994E0722FEEABBA4EDD11576616FFBDF02B380AFAD7427D69FCB7
Chrome Cache Entry: 254	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 255	HTML document, ASCII text, with very long lines (358)	A8063BD37D3C8FB3176A6BF140558A4D	E32CF4B407DB3D3773DED13FF64B70FDBAD7735F	BCCB23D41C2CC69CF0C7D22C4314CA8181A513C6999B73E45307792830F4E482
Chrome Cache Entry: 256	PNG image data, 76 x 43, 8-bit/color RGB, non-interlaced	E4A3C56458B8E5DAF0515B852F5E4EB9	E80B7DF5BE789A4860967D892BC7508A5C4E403C	B12068B5496D6C2F8A6E224F08B5157A8E8E4EC5AF7B57A1F113DF4CD0F6E3B3

Windows Analysis Report
Sales_Contract_Main_417053608_09.2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report Sales_Contract_Main_417053608_09.2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
Sales_Contract_Main_417053608_09.2024.pdf