Windows Analysis Report
Leistungsansicht.pdf

Overview

General Information

Sample name:	Leistungsansicht.pdf
Analysis ID:	1523482
MD5:	17cb9d85c7d15ad6c25f989809451761
SHA1:	c5a930f43eead1dcbbd0cc73957e7f3beb2a9e2d
SHA256:	76200be8716ae57fd9ee97389c4d087446594aaa093e680a1c4d01b7b6ff3e28
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

PDF is encrypted

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.6:49729 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.6:49729

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.200.196.138 23.200.196.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: classification engine

Classification label: clean3.winPDF@14/28@3/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 10-51-26-384.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Leistungsansicht.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1724,i,542157055565685941,14404819011696683976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1724,i,542157055565685941,14404819011696683976,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Leistungsansicht.pdf	Initial sample: PDF keyword /JS count = 0
Source: Leistungsansicht.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Leistungsansicht.pdf

Initial sample: PDF keyword /JBIG2Decode count = 20

Source: Leistungsansicht.pdf

Initial sample: PDF keyword /Encrypt count = 1

Source: Leistungsansicht.pdf

Initial sample: PDF keyword stream count = 914

Source: Leistungsansicht.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Leistungsansicht.pdf

Initial sample: PDF keyword endobj count = 916

Source: Leistungsansicht.pdf

Initial sample: PDF keyword endstream count = 914

Source: Leistungsansicht.pdf

Initial sample: PDF keyword obj count = 916

PDF is encrypted

Source: Leistungsansicht.pdf

Initial sample: PDF keyword /Encrypt

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.200.196.138	unknown	United States		2860	NOS_COMUNICACOESPT	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1523482
Product:	CloudBasic
Start time:	16:50:21
Start date:	01.10.2024
Sample:	Leistungsansicht.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	17cb9d85c7d15ad6c25f989809451761
SHA1:	c5a930f43eead1dcbbd0cc73957e7f3beb2a9e2d
SHA256:	76200be8716ae57fd9ee97389c4d087446594aaa093e680a1c4d01b7b6ff3e28
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	7E5228F55B412F247236FB131D86A749	5924B83AEE3BDF412D57BDB7B6497B2FB43DD727	2CF0770BC02A7576D3144D4E091AE4AB1010A0E73E9CC88F4BA71FE1A45F5D09
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	7E5228F55B412F247236FB131D86A749	5924B83AEE3BDF412D57BDB7B6497B2FB43DD727	2CF0770BC02A7576D3144D4E091AE4AB1010A0E73E9CC88F4BA71FE1A45F5D09
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	32085AE921605A53E745E5A04238616C	55017BD66179F5C6240EFD5486D2084EEE488B4E	AC4F1FAFFC6FE7B92A95A0206CEAE41B641FB842F2444E7FD7BB094E7A52D25B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	32085AE921605A53E745E5A04238616C	55017BD66179F5C6240EFD5486D2084EEE488B4E	AC4F1FAFFC6FE7B92A95A0206CEAE41B641FB842F2444E7FD7BB094E7A52D25B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	5A18856A6F62CDCD66D922BF73240611	59910BFDE51D050F7E2C0BBDA4B2A2E4CF206738	DBA51FB88B08352D0FC600D1F9E83ABC0A6EA2BCEBA3CF678865D4BB484625B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a9cd5be6-efa6-4fc2-9722-78e4ae0c451f.tmp	JSON data	5A18856A6F62CDCD66D922BF73240611	59910BFDE51D050F7E2C0BBDA4B2A2E4CF206738	DBA51FB88B08352D0FC600D1F9E83ABC0A6EA2BCEBA3CF678865D4BB484625B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	F2B0DA2E04A1D5685C1FCC6155B1D7B6	DC178426E3CFED42E1B7FC9193FE18E481AB71F9	A810042D1986D13B0BB8C718D02B350EADA98D7E6F5775A482BBCADC3931D627
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	9021A546D41A70F55290ABB07CD56033	A1D27B49471315D3D6870CD9F743FB68AE2F03B9	942D06A070EE1A4C32DE8AF48B5C5543D62F476C1EFF537486FDD3A874174CE6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	9021A546D41A70F55290ABB07CD56033	A1D27B49471315D3D6870CD9F743FB68AE2F03B9	942D06A070EE1A4C32DE8AF48B5C5543D62F476C1EFF537486FDD3A874174CE6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001145128Z-209.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	8AD5FB1144A1FDF61B16E52558C592CD	3C0933D781941350A7F888674F7B98720B5703B8	B08741D888ED130EC61B6C6A4F15E1178F9F7ECBF374A6DF1CE1DE6C6405A294
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	B96F09B47A31EFFCABE701A9C0548189	6BAB3C7BC9FA1889A670CF09B94C62A471340850	98A0130D4A6E1DAEA1DBE4E0C0FFABC46E4910B3A627AB783816778B651E90AD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	027FBF94248EC5E6C823C2FF1C60C22F	6D4B3BD3D6E6130C91CB1FA0B6EEBC7D1B99DDF8	AFDE77281DDCB51A1EC5C83FC3FDA08F6B7EA96B93C883B25CE939A1FD143CAF
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	999EFBC2B7684EBB1E39B26D10E23E8D	FA4B26683CB6D7115920433C4F67A2C54D6A6F64	0A53EEDA6EF0F189D37330F37958EB2F52F810D3D54F2D024E0B5B49611771F3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	12D2F045C5038F11CF19FE2D7CAA171F	5F9CBB04C6E79D838E8FCB207FE6406A3A829578	5C5E44DA9C4229497A1FEED80BE94AC52CA6A408D067D9ABEE26AE1FF89BFDCC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	8CF79C6C2F5D921AAFF830AD9E8C1331	3508A8EC2AC6B1BF07494101EE8073DC4B050B5A	DB615C0430081D9B85CD153C4FAC5302F52D090B052637F6FD03ED4487D5C879
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	991A1D899EB99DB9F9B96FD4D5F26944	32B3795125A63CAF4118320FB1C92990D7093893	99C3E130182136560C734D9461CE1E076E474DED8242705DB89F4ED04E851315
C:\Users\user\AppData\Local\Temp\MSI2e9d4.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	26B1670EE207C877E7CAD94495D81003	BF2216BAD5FE60604506E28E615771F52825F6EA	E464012E5E63E26550F1E19C8B29CD5F6655109224BC7A19F9CA732163D18259
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 10-51-26-384.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (392), with CRLF line terminators	680D9FAA3475D4ED44AB2BD5210C7C1B	9E83C0B836E49B9FF5684BA1DE2EC154010B3F8F	688FD9917493375A6AE52E429CF3C4B4F244A29C41B738BD8049F3D7CBE78F47
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	06A133CA340E0885A69D047EABD30771	F27CAEF960B303943ADAE9A6BE697DDAB6EED43B	2CBFAAC43FF69C78D86B830F9430938F06C8A2E492555C745845BC1BF8FC8003
C:\Users\user\AppData\Local\Temp\acrocef_low\007b7297-bf09-4823-9da8-6e80201e5a35.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\4725409a-4889-4e5c-8064-a5112f7548de.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\843fb714-a842-4ad1-928e-d5aed9943e22.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	5543B35CEADFDC4687E8A5935321BDC9	545A39A2EBFC69D0CD56E1018E8F365ADA4F5793	35D8C0C28C986ED26CCB41F55E9F66C70CE705D247A90259314A378DD5E68ACD
C:\Users\user\AppData\Local\Temp\acrocef_low\c1ee7c19-4f7a-4bf4-811d-c9901312b4e7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486

Windows Analysis Report
Leistungsansicht.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Leistungsansicht.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Leistungsansicht.pdf