Windows Analysis Report
Invoice #23078.pdf

Overview

General Information

Sample name:	Invoice #23078.pdf
Analysis ID:	1523654
MD5:	05aa80f62a47e1a4dac83054c835e3bb
SHA1:	d1597f07270ce840bc75687fcc70e7c3d7fe649a
SHA256:	97f7f2c3f99fecfc9139f22b3309d16691210a72d607e84cade5aae0a812ce66
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.4:49759

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.56.162.185 23.56.162.185

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/42@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 16-20-34-583.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Invoice #23078.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1744,i,16956642348696961776,15655649527562002610,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1744,i,16956642348696961776,15655649527562002610,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Invoice #23078.pdf	Initial sample: PDF keyword /JS count = 0
Source: Invoice #23078.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Invoice #23078.pdf

Initial sample: PDF keyword startxref count = 5

Source: Invoice #23078.pdf

Initial sample: PDF keyword stream count = 773

Source: Invoice #23078.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Invoice #23078.pdf

Initial sample: PDF keyword endobj count = 1977

Source: Invoice #23078.pdf

Initial sample: PDF keyword endstream count = 773

Source: Invoice #23078.pdf

Initial sample: PDF keyword obj count = 1977

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.56.162.185	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1523654
Product:	CloudBasic
Start time:	22:19:13
Start date:	01.10.2024
Sample:	Invoice #23078.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	05aa80f62a47e1a4dac83054c835e3bb
SHA1:	d1597f07270ce840bc75687fcc70e7c3d7fe649a
SHA256:	97f7f2c3f99fecfc9139f22b3309d16691210a72d607e84cade5aae0a812ce66
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	78CC519C25922A5639A56D537A46E595	02807F2C7D842053EC3619048E55223E3BD777FA	AECF2B4F5BEAA5DF87661B935CBCE69D800852133232899C0666D1CE22E5E979
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	78CC519C25922A5639A56D537A46E595	02807F2C7D842053EC3619048E55223E3BD777FA	AECF2B4F5BEAA5DF87661B935CBCE69D800852133232899C0666D1CE22E5E979
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	AACC854099654815B3B6809F4DA13EE4	C1E19FED029CCD2ABBE39557AA37EF913CA3CD45	09226BD01215005731710E45C7BEB740366F1041384B901F833D4C5D0E0F2B98
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	AACC854099654815B3B6809F4DA13EE4	C1E19FED029CCD2ABBE39557AA37EF913CA3CD45	09226BD01215005731710E45C7BEB740366F1041384B901F833D4C5D0E0F2B98
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	72095C884E844720EA6B537F229B57CC	2E6CA6207F92289C5F8125431470081FA30F4256	A08A7F6C98AFECB9208A6DB728D83126529B3CE8E7914C3E5F72D0A5F9917F67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c536468c-432b-452e-b305-a4edc4e15403.tmp	JSON data	72095C884E844720EA6B537F229B57CC	2E6CA6207F92289C5F8125431470081FA30F4256	A08A7F6C98AFECB9208A6DB728D83126529B3CE8E7914C3E5F72D0A5F9917F67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	DF600CFE70A002FB2C000E7B0B0BCA74	4415905284D35ABFD6CB887E6409D62E58460AF4	62A1E606D640DB38222501FD2DD8EA2B3FD53AC1CC3A8156E06AF089CD469E87
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	25A790D35A2591537A53D601531FAE5E	35EDE3870D431B5E2C4FBC533F6858F3B1586164	02D1E74456419BF1B5A7674E8C7E7548B4D27C801273628FEACAD435BAD12FA2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	25A790D35A2591537A53D601531FAE5E	35EDE3870D431B5E2C4FBC533F6858F3B1586164	02D1E74456419BF1B5A7674E8C7E7548B4D27C801273628FEACAD435BAD12FA2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001202037Z-178.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	4F23F8E55E1FB0B81A7BFD1C5CB98313	64C7F429678D47416771BA7A4346A287E2B3A1B3	AB549DDB947E1C10501AD880672B5FA6112C58E359100F8E2F49379B478582B7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	5A68CD7918ED30214787EC68FB815410	93BAFDEF4DD06432A4AF34D2FDA6DBB79E815980	D6BE7381B8EFA6F364FF1F26501DF780501ACDE3968DC6714A6757097F6A87A7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	3FECDEF7800F5D273E233F176AE3BB4C	18F30B64A6A3459D4BF452FD13392959B9683B1E	E7816515ED313156C463C4021CBC66C39E9992A20C1367814A94A02BF06CF465
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	6CACCC85E7D2FE2114387A8A8E13FBE0	A2328C101BD1BB4E06EB808E22C0652D114C68D7	EEC3F79A649894808E95F17059E821606EAA53974CD8C8E27B404FBDA25357A0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	84490514E220E781FE8769B146EC48D9	C08EDAA7627DCB30FADFF81E2C195C1388AE9E2B	09A4108813A3DA32E52972D592BFDAE9BBA745F099C1C3CE699C1D5396513F91
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	CD22F20C67643F5C29B87ACD4CAE7F4E	BD74F0330F2A9A516E3987278E5F8604032FDA7A	6BCA10083A0F1C1527CBB6FEC092D91CFA68F66B6DBE75B3D750D4C129647F83
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	40C5DE3A7E9FD242FA04FE5EF6979CC6	D64C38A3E460F636A637500D52607CEE52E5D8ED	C16814FDA4693C46AF48AD5254C57D9B23D5809E287B5A9DA0C7E519878F2E82
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	CCCD792E79EF7698E142D8522299FE0B	15055BA4D5DD5ABC5C4A395B078AEF2B9B61255E	998EA82A7458FE342DDB185F275970E7AECA41E0A39E0E58F65B02892475558B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	118058A5260BC84C037AC08ECD7B3DBA	D8A9CE156ED0F58D563536B5BE94CE2B24B2911E	E323D100F74EC2114D38C8207A3368774AE7AE96C0F8CD9BA8C74A3C414D325A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	B338C028998F8101DE2AAEE71AFD8692	6111560BCA470ACC3A54EE57775E654DB8B78FED	181E480AFD426F1F746192BED24F44CBBF8F9432148A006E9152AFAE65A9A72E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	78BC43089C406125A123FDACEA1DD470	503D6FD675994DEC2A66037A5AA38EAC010EBE6F	03BEE7A25B9DA1B3DAC0F289BF0C6B13E4E146CBBA92C99CE75A84F443D9659E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	A3E44E0F217D6BB2113F73BDF25B0371	08E92A49BD7CA19CE6616F31434D2A7A4880E9E0	FAFE2BAAEFA23CF26156515E2B1807415F3FEED95FCC64F13D665EA7B9122F81
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	3632293993B95E36FE4D233E5ED61D2E	968D4CF0A90D1256720D3FE1366CCC9617419824	A384A4D7EA449D2D1B5ACEA377935BDE3AE61101E1CA4684F89F9A4549EFAF27
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	90325378EB2D8C7425258E6062D4C063	DF343A829659D5E43AE237C5386E55DFEBAE6F7C	76091EB142A38CB8ACD39A7C92F7886D3D9F81CEC9C7395297C0F6E0099989A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	5F3CE6D24D53CD8BF960022053CB1755	D4F2F8D4116974FC91E7E05A128DB8CE89356C86	CA9E33CA213013B4D4F7CC7C021D4CC30AD8E11BABA26B364F1BF79B2EA2AF5D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	37855BE728E1F88C0D27BD0F493C83B2	D13FA243A2E0397F838958D41E0584AF5C21CEB6	8FA75F2D3322FFABEFC3747B0F6F3FFD2CE1FA581BD8FC5177792013CC9C7958
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	1C1D1B4D3775A3F73AA82F80967E3AAF	71F16063AC04FE288BA314F55F37BF2ED481C224	D4131779B9F973CA7345CBF9FEE6C897D9F05B38D5668EFF300013C4F37D82F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	B96B6C8B1B25233CB59A0D7798692007	DF742997207715321B64E0F9ACE1972EA767E4EE	549DA993C0BE5B296528E86026442A4C970B1C23282B83C3254502CA27912177
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	60DAF829543334CECEBEB948155C51DC	117DC9E64CD38C31F803690D096243E4EF0F2AAC	03B038E61B937A51153048282DD934571AED6F54DE2C9B84364B261055E934EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	6C0AD9723A4F25CF743C2BD6C93985AA	EBD3905899740AAAFC33CB729438B8E4A0C71358	9A7213BF1B3AC55363402EBC1127E4C6366C7B478D035B4256FC250F13CC198D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	942E15035CAFA5EB5E7FBBB9A71AA24A	A32099206AECE5159F1008CCDC83833F8FD42CC9	32795F1A9D98070AC2932439E9AA44A9FF87F023857B751DFF658226FFBC59D9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	791637F2224A9B76D954CDFB17AB1A6E	8E3EEBDE0B884DBD89BFD4FAE8DA54C43C4A46FD	37691AD663CB4FD19A3E650DDC588D228FDB3BDABE712541D93F197847A000FD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	0744EDC506224A970A9C30B3CB924E18	39A34135349737FFB25210740FAAD06228CA3AC1	AEADB4CD33C8DC5ABB25089B7629AC9E9060226C3EF29A98EAA35546622BECD6
C:\Users\user\AppData\Local\Temp\MSId01bc.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	7229DDFE260074172148F13103B4DA01	369CBFF97C4A9838347A0FA191A1B78AB27535BC	DC0C28431D0596AAB971073DF7038D9B6EEC4C29ACF59268EFB1C71EAB412EE7
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 16-20-34-583.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	B8AA7FDD695A4761A3FD95BFE3F28A80	79EDCA9305C2C506F65725AC4F1E8A0F607E71DF	6E8A1DBB20D5CCB1BE8BB54B382597FB087F0BECE38ADEA2B964571CAAA70CA1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	8F6A39EE1D53B1ABA653C6C3BEF11850	ABE7239E1C65CA2A91DAEBDFDDBCDCFEF667CA6A	B8D07599623CC10A1377BF8FE1CB8F40B59E57DBE25817C28CE9523CFDF00D18
C:\Users\user\AppData\Local\Temp\acrocef_low\4f5f386f-dd85-44c9-973b-50bb65ed4449.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\6cff2a11-a1cb-48e5-a228-c74b2848c8ad.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\8b76b0c9-628c-42bc-935e-c7a14fcab065.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\b21ace82-b710-4e6e-bd89-00c0e54430ca.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4

Windows Analysis Report
Invoice #23078.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Invoice #23078.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Invoice #23078.pdf