Windows Analysis Report
239492.pdf

Overview

General Information

Sample name:	239492.pdf
Analysis ID:	1524389
MD5:	a2cfec32ffd39ea08633e5ea6b969686
SHA1:	b0f6fcc50b5ae5ec44fc310ec192c4e912da5aa3
SHA256:	98ce27481514e2c82eb1b8a3ad0e8afac196c2be193694e58c046f41bd634622

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.203.104.175:443
Source: global traffic	TCP traffic: 23.203.104.175:443 -> 192.168.2.16:49710

Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: classification engine

Classification label: clean1.winPDF@21/33@3/67

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 12-06-33-876.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\239492.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1628 --field-trial-handle=1568,i,592014452895726784,4519843502274583726,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 6CC464D3E81869363839542CEE0D9ED6
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1628 --field-trial-handle=1568,i,592014452895726784,4519843502274583726,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 239492.pdf	Initial sample: PDF keyword /JS count = 0
Source: 239492.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 239492.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
93.184.221.240	unknown	European Union	15133	EDGECASTUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
23.203.104.175	unknown	United States	16625	AKAMAI-ASUS	false
107.22.247.231	unknown	United States	14618	AMAZON-AESUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1524389
Product:	CloudBasic
Start time:	18:06:00
Start date:	02.10.2024
Sample:	239492.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	a2cfec32ffd39ea08633e5ea6b969686
SHA1:	b0f6fcc50b5ae5ec44fc310ec192c4e912da5aa3
SHA256:	98ce27481514e2c82eb1b8a3ad0e8afac196c2be193694e58c046f41bd634622
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\234f467b-4e52-486c-8678-f317518ac7ac.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF678ecd.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bc6c9161-9ee2-4e4e-b6dd-3836945c6593.tmp	JSON data	BE9EB720E6BAF6E32C52747BC4A5D694	7A2D7F99E210B66D76D7EC84261BD8E9C4232A98	B7FF442CB0021A8195184983F85C813CDDC4AB56B83E6B56CD05C1BDC907BF56
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241002160636Z-224.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	7E28C97A626D21CC31306CF1167E3587	19FCC8890271B6B38ADA72249A79C6B71821741E	BD94BD6954208A20A3C669C44C4732EA05A34F2B5ED0DCFA369BC1C29C98DCB0
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	271A0FA7B3E7CB163CB431F0D14224E3	622C70189B2978BE00621788549AB4B176F9499B	694FDFC3BA197DF9BEA8AD43802A1A5C4F9C0304CAE890C602D5B51F0D9E7CC3
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	5E9F6BDA187B5575F09EB8514BD61BC2	50F4FE1F90129DFD87A9237FAACA173043D1D831	18D8A6408E8962CF0797B95E899F1A9BABCF8030E890BF5C1E523E29CD12F8BE
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	8BE032C4C0E3CFD613BF927A99DCE985	9B939E2CEE1A71961B7DCFA8B1C09B66B45787EF	36033CB07D9A510DADEA53F54FC9BB32DD90D0D2A6456251396A0382CB8A2FCC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	C02E28B46656B8CE676A5CB8FEB6A35C	7F7E81A85DE51E7737D604738ABBC7BAEA964E85	231E06A6E6A13BBF4D95EFC854566C9AF954462E788068BD975B8F9BAA198B6C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	80E76D175043D49DB1C6A3F6DD08B449	1997F24DCEA792FBFCB7E79C9E4DF1962F7336DA	42BF2242458C66D232C4ABC2D6DBB371A786F5F7ED0CF31A6B5249F3A348E81E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	7D5E233E4414C0ADB24769858E48EA58	95F87824FC765589E2EC07986CD82026969EAD82	7E4DEF95F7BFC41A838A3640D946F59B03ED5B0BF12EF79BCC9CABF2E441A3F3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	4BB44CBFB8F53338087596BBBF6FAA4A	FA2BD3094C339579E2659B27E57B503B2F42B777	BB912F7983700EDADCB1B109BAD14D6C6DD3D41C73FD88A02AB6DF3FDC0F5DA7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	C050634B57F89B54207112346197C73D	484AD3384B0E73CF9D7172B125EC13F253DD00B1	314E827EEEB0E73BE790EBC89C5FFCD4F696154CF0D172801F8AA3E45D4AAFEB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	00F63C6444D2F6D30CF56719D3F52B66	28AE80EA4F47452B28A49A83C7DBB4F40BE5F1B4	6A9D36F0959832957B187D0F2E2BD6585A854947467D191498183B1987679E5F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	28BEEC00E6334184450A59D33485201A	506E8DB1A75EA8473A6381DBBEEE2FD9355E7988	1154B1A2DD7030D9E9277E2BCC4FB1233D77E9DD30F7AC03F332A9FC1AE3F8AF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	19745654199FBC008A709BC1B6E88B69	7A7ADAEF852B4F16909E6A1055BEF32ACB892BFE	299EA9B9896081074394140AE2CEE72DFDA19D12ED2995DFC8DFDB48DC3CBDEE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	8AEEBF62B2883923A8CD1DCAFF89E74D	0DB05AE6256BADB5A14B05745DFE782E3E9BD9C6	CAA17C725F7F67F71418751EB0AE027B46C307B7E867239102AC618B2B163912
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	3C87E018AF940998C6FC91A7A67B93F4	0FC8AD8E36B1BE3AC3CCA05D18E8F7DE459C679A	96042FC1D8BE5F1D700CA12808667F70F7128C066261C9B76ADF68A33F2FEA48
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	302241139B96605261EFEE7F124342BC	CDFF172E423B9A9E6174B49F2DC00CC8D5ED0A0F	AD080EB60B95AA5F7DAD523887943FC68C8E2CE9644885CDE8735C336F850DCB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	0E04F5A6F4D2912032B2408D166104AE	7B3BC42FC6C3F136E01433237B8CCB192197D403	87621698CDD0197B7A2E49DD7FFE720076D7EDA98A5C4A0BF8D7A4FC4C0DCE3F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	7005E2AD2A3A05CDFFC8CC6F29F34E0D	27D75DBCCFAA6EE95B02A565F686236C6BB63C18	66EAD7B63E21240E381F30143595B6FD9BA91812C4B3555B852FA17450D336DE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	A024ACCCF1DB0A26BB9C3B0C612E961E	991DBF74FF031AAB156C7C2924E3E82CE9333706	0E636309DA1264165305B443938172E25C5802B145CB2B2F019E85923E3FE392
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	6159B63F18E39FEF0E0CC89D35844E2F	A27C172EE22778095AB28C497A9F5295E3A2E8E7	F3DB7E3139AC5E265077190700256432EAA8C96A3FDE62C566740CFE06B7EE40
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	2EA93017304C4CDF863D017024E72A05	5089157FB94CB70ABCEDDC3D0347CE508EE8119E	D65A73697FE1BDF94BF109F8A512CA523FF3250C8C5E7CC1CF09E63960EEE266
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	179B17DDA66BA3EFA01A83A66A5BFA8B	5800DF5DDF14196D0C42C8BECEF24FD462E44F37	EE97DD39939188CDCBEF837A67188CFAA91370115EEECABB1D2B74DEC94A97F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	09FAA2BE47F779031EC0269C28E2A4F0	5E9C7B2651745CF1C6DEEB8B7671D9559F4BCBEF	8A5F358C5BC7449C3BA9BBBEF7019AD67DC1A5EBE298C922BD53FE041DB0B61E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	AB873329361C444F4CCB4D9B6440AE4D	97A090AEFD24E86AE2503A8558D717230EE5DCE7	58A8AD4DC31873A0284F21E5CCE281C7439063C399C8F8D4503FA72BEF1BA46D
C:\Users\user\AppData\Local\Temp\MSI67ba8.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	82BC8F80BADC55712D76D405A73EEC2B	3696961E2A84A8F047C4E908674A477072CFD88C	DC32FD811C308D0A7AD6C637CDE6300CB99DAEF6A23C33A79902CB5DF7DD10D3
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-02 12-06-33-876.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	3A8CEE56B895634237D3B0A59B402088	5F8303DBBECB88B27E8B4D04C5F70BE1C9718D77	FABD6813BB24AD940DC1F106FFE0414E271C556BBF80B2AA27589511317C2CA5

Windows Analysis Report
239492.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report 239492.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
239492.pdf