Windows Analysis Report
240224.pdf

Overview

General Information

Sample name:	240224.pdf
Analysis ID:	1528214
MD5:	484710419547229bf9815338935e2b25
SHA1:	193f7a605a13e3b468654e3e1fcec663fd8de4d2
SHA256:	30d515fccee55b568b05514a6ef29fb6e32a75adb938651584a4760eec9a1cc0
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 23.195.76.153:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.195.76.153 23.195.76.153

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/46@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 10-57-48-155.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\240224.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1588,i,5033004123190415020,17179557172345066960,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1588,i,5033004123190415020,17179557172345066960,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 240224.pdf	Initial sample: PDF keyword /JS count = 0
Source: 240224.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91rkyte5_8m7fee_5b4.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91rkyte5_8m7fee_5b4.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: 240224.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.195.76.153	unknown	United States		2914	NTT-COMMUNICATIONS-2914US	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1528214
Product:	CloudBasic
Start time:	16:56:50
Start date:	07.10.2024
Sample:	240224.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	484710419547229bf9815338935e2b25
SHA1:	193f7a605a13e3b468654e3e1fcec663fd8de4d2
SHA256:	30d515fccee55b568b05514a6ef29fb6e32a75adb938651584a4760eec9a1cc0
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	1EC777F914D4B1D662AB8D55CD772F57	FF8D646B68C2A4DFED6975A710D9DC9615B10B6A	CA7FEC642879C05EA85C5473A00349AF230FC4B97EC152A3209B2572EBB6CA5C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	1EC777F914D4B1D662AB8D55CD772F57	FF8D646B68C2A4DFED6975A710D9DC9615B10B6A	CA7FEC642879C05EA85C5473A00349AF230FC4B97EC152A3209B2572EBB6CA5C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	BFA32C1CD4144D9B295EA664FCCCE47A	380A705CC2C7F448892F4583E1AA12FD88D4F32B	2E70C93D2F23848AA6B0E418E947D057FDB2EED6E9C9EEFBB5E2207C03625D13
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	BFA32C1CD4144D9B295EA664FCCCE47A	380A705CC2C7F448892F4583E1AA12FD88D4F32B	2E70C93D2F23848AA6B0E418E947D057FDB2EED6E9C9EEFBB5E2207C03625D13
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6d6c5e04-f645-44bd-a46a-2e5be2c6b621.tmp	JSON data	408EB4648AF04BF6DEABCDA5BF8C71B1	C47285CA37B2B7B770CA438456171A3B9FE3C58F	30DC5D0F155D6442FF3A55561B05692D6C740D3F2F1962E30EDC997EDA66D648
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	408EB4648AF04BF6DEABCDA5BF8C71B1	C47285CA37B2B7B770CA438456171A3B9FE3C58F	30DC5D0F155D6442FF3A55561B05692D6C740D3F2F1962E30EDC997EDA66D648
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	5178AFC24DFF61232987BFCEBF8605CA	53C907F1C633DC88D37244AF7258A3D581AF4B76	2379A52D7EF2D7C9CE8F099FB3EFCED63DEBA619E8C3203DF0271153AD5692FD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	8F6302FDA5948EA1303A7CD5299557A4	2385D48455737C53AF055DFA6152F9E99346811E	35BEEF2959230B7311741C10AD48C2846D840DD88FCC7929C9F3C76FA57EEA7B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	8F6302FDA5948EA1303A7CD5299557A4	2385D48455737C53AF055DFA6152F9E99346811E	35BEEF2959230B7311741C10AD48C2846D840DD88FCC7929C9F3C76FA57EEA7B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241007145749Z-166.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	03C3DAC54F2C141888FA957E84095E9B	927B930E344B8B029B90C874925947DF6D0D01F3	8111C5BEDF34759FE6C0F04E4A3B962C1F544904B27DDE18C1023158C49AEE88
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	F56AAE1BF6D7DD0BC4521B6CB1425EB2	2B1412B8BD0647DB813AAF31AF446C411B74092A	C32AA4BFDA028ED1E0656282625D862EDB05C7DFCC0C2A2543132DF55FA88EB1
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	8EA561D8FC3CD58D776E83F3E15CF348	62E11077251AA207FF0496DEDE23BEA53D85BF1A	8557DFD6131864045E8197B9B347985374FD00914A9E1BFF9E6445E73AD10B58
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	6FC97E21BF582BAF7BE3ADD034AC2500	0B0813893C01E0B6734E5360A31C63E86DEA5060	1CE30B5320BD6E99A994EA3EC7B58ECC6D7B89F0D44BEC5A418E954CBCA5213E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	F44C978EF90399AB705F65971C65DE50	D2357C8924D2C9F81EAE75586BCC617B65ECF810	3508E066DD80CE32F9E5A36D0C95997C0455CB241C47A2589AA0CA0D2BBAC6AC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	F3024E6F244663911031E1313382E979	494AA71F1F006E45795590FD9054D8A74812DBA1	8718A4645B1871E5706719E96EFC5C863DA9C5650A1B831DFEE023BB69F6A710
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	09F55248A1CB05C65672B44BDCEA65E0	596F29D0E6E3AAB52DCB39D4CEADD0A7B7DA4309	25F68DD55D76B39783A1E3D36A9C967F7485132482F5228AB5943323D24620C2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	341EDEEE4B51D56AC923FA3E3026DAE5	F22789C4EA7177AA7822E69F403344DE7B2DF598	5CB179EED4F3E081FE1D295040673B8F088DB7C469343F3E02682DF4BA83D225
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	4C9AF87F040F28F81B9AD96B3ACA5877	2F54768495315AE5DDB7818F1BFA7F5DCE5D250A	323B0C82E5DF5F5E281C752DC6FB9C6A175AE75FBE96F2519D6B0A982830CD61
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	6640CC6E5A43CA78D4B70A7CD2A191F6	6880C3885215B4B560DF7C176C6BB50D4F0AC7BF	17A7C678BD1533BD578FA921322450E70FC08A482E76755950D53DDFE92119F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C75A84E69BA2B2C00DA6648113BB5B8E	F990A389AF7E60CDBBA183F0135E9DC0B15A23AB	50558AB6EF4594A70FC9EA223A430893922E4EF75AA17B964C6154CE33158260
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	C4A6A0754C24A40920800AF8DDC13AD7	382FB66F9CDF8EF0D661AE657936D1169B55E1E1	7CEA7CC647671F897BE1AF26CE651B834F177DBDC5AF85B2943CA51C9535DC03
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	D65A5A58C735887E3ED1A536FD2DE42A	BE92B0F65F06C29BA6289B88ADF24B2BB629498B	AEE96A8322021E7E60DB93F5DD28258C45ADD7F7001E3478D704F48CAC4FA282
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	F57BFD5EB2EA1EEFD5E65724392F8122	AF88A6D2A9EC1D8D57DC597FCC382DA87A44E7DB	9A21476F02056C1C989A1F6867669EBEA4B73CABC78857F872949E3E81778116
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	066EF38E94343E143F1F08C99943EB54	BA5D846CB94103E0AD38903CEE3CDEBF98121A23	72A675B741912F67001EEF94B663727E85067E688FE89A29841B874632A211D0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	3825C7606A9CCFD0598B5A7AB5E8AB30	EFBFF0A13B74AFBB0C426A12F55EE17BBB12817D	96B7764AB6D172EF432AB327CCD21BB86B1AA62575DCC9B9057C0B2AC3830271
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	727FFBE02D0A1364FFF247BAB6F1B20C	35F371380AADFB21083A1BC61110209BFDD6AE4A	E7F7C4799A1F29339163B94429F477552444C3967AFB98F30CBDA99E61836A55
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	E351B916DB0436196A109ACB6BD3CFC5	B0116697FE6E5115928B8A7081E194F791195DA9	CF01D6892E465930D66B6A04A3FE35F59D47277A3E6EA9E589378091ABA26574
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	965A9F36FEA63EA662BE81D028A41F2F	4CB8F5CBC143A8C01D213876EE8709D609E309FE	E5BBAEB8E5011AB9E973DA958E37262B6F9DB5BABB129CD5A9F116087BEB1FA3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	3C80A2583353539AAE2776728EF95440	F8395F42D394634CCF34B523B89A85AF124836DB	EEEEC19313E90A6FA83C7B3A8187B93B5A3D050B6A2D6525AA8325C9EA9B46AA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	08A0CC44AFF844429FF5A674092F37CE	C90F1847877EC89959D25FD9B22B72E398CF8B22	312B2B312A6EE8731673D5E6FAA150B1DAD0900C8FA54149F59C5FCF2028C2BC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	080FD82989124A43D36AA20EC3A90297	5FEE1C9543AD31F2D72DE9D74AB4234BF860890E	5D01A2CFAC37BC9D1377A2B376AD53C9396ECA887C75C920755F99DA24AB7BD8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	C5837A7C352A85B404FCC1DBF0015ACB	2FF439CC7B0D281AA6ED636182B9F78465B8425C	786E4995DC6DCE4ECA3A60B20FCA972D31CE61C2317E8807C67B6979696E11D0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	ACD194F5795627864E70F48C335BA3BF	DFF13D753AF194AD2FB08656CEB4BFA9A8FA2BC9	0B2D28EE9546417042A67EF92520FA579F99A3E1E0148603D563AF1AFD4B9B37
C:\Users\user\AppData\Local\Temp\MSI4e4d9.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	019B2E4D0B26A47B49056FEEEAB3ABB8	1173554601614CEA11CACF244DA11C6A3E88036D	D13A44749BE2706D7F8D94C6606582227AE8615AC2C9AEC34F7D85619585698D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91rkyte5_8m7fee_5b4.tmp	PDF document, version 1.6, 0 pages	2BECB669B68F5679F34554DF0BA5F4C3	574185470AA8B0A56D0511604131D5DB8055F790	79DA7DE35669CC82D497911F0AAFD73552D6EA11F0F858762D88219C4342CCEF
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 10-57-48-155.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	7ED1D7031025B65FB0168DA0EBD3A606	47497922D7827137904645DAD08D8DBB8C1AC01D	AEF2988EF4EA7BB31ADA2E991F5FD0D67E333C4EFBC3A5B3B81B91EA8B8ECD5A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	1BF7E81DC57CF271715A28DEBD8143F8	AA6CB717380801BBFDC80BD59205C7E6F424833A	C06070E48F304284239F713F60E268F613454BED0BC1FFAC96B06F9D8226E572
C:\Users\user\AppData\Local\Temp\acrocef_low\2aafcc4e-8f5f-41d9-a39e-d2a357dc8ab5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	4CE4F3C683F8475A153D49CE9D564CC0	CACCCD048618D9061E659D23D0A41245017247A3	431E27ABE645101F0A6D54C2E219DA84ECB98C964D9EB76D4CB16A9C83108F31
C:\Users\user\AppData\Local\Temp\acrocef_low\4c7eec8c-34cb-468c-86b0-ac073c0507c0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\94a84b75-c1e9-4e34-8383-2db082fe8958.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\ec6c1628-7279-48e3-bf6c-80f9667cf92c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CA6B0D9F8DDC295DACE8157B69CA7CF6	6299B4A49AB28786E7BF75E1481D8011E6022AF4	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7

Windows Analysis Report
240224.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report 240224.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
240224.pdf