Windows Analysis Report
240224.pdf

Overview

General Information

Sample name:	240224.pdf
Analysis ID:	1528221
MD5:	484710419547229bf9815338935e2b25
SHA1:	193f7a605a13e3b468654e3e1fcec663fd8de4d2
SHA256:	30d515fccee55b568b05514a6ef29fb6e32a75adb938651584a4760eec9a1cc0

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49707
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49707 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 192.168.2.18:49710 -> 23.22.254.206:443
Source: global traffic	TCP traffic: 23.22.254.206:443 -> 192.168.2.18:49710
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.18:49711
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.18:49711 -> 23.217.172.185:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: classification engine

Classification label: clean1.winPDF@17/37@1/11

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 11-03-31-899.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\240224.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1628 --field-trial-handle=1608,i,2588310587884783511,50133307269892959,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1628 --field-trial-handle=1608,i,2588310587884783511,50133307269892959,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: 240224.pdf	Initial sample: PDF keyword /JS count = 0
Source: 240224.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 240224.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
93.184.221.240	unknown	European Union	15133	EDGECASTUS	false
23.217.172.185	unknown	United States	16625	AKAMAI-ASUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1528221
Product:	CloudBasic
Start time:	17:02:47
Start date:	07.10.2024
Sample:	240224.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	484710419547229bf9815338935e2b25
SHA1:	193f7a605a13e3b468654e3e1fcec663fd8de4d2
SHA256:	30d515fccee55b568b05514a6ef29fb6e32a75adb938651584a4760eec9a1cc0
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	860872E9229604DA43C80EB6A9DC86CC	C6273E7562EFA34D330529BAACFC788A756C2972	03733E1B088F2BF7C65E0A9E134DD3AC054ABCBAEF296B99A35597A061879F55
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	C679A8280F4C5CDC1A6309CBB3455FDF	A81830232E36B2147B80F10C2E4B1470A0AAC276	4BA17A405E35812488ABDCC56C550167FCE08160641ACD3F4858CE4EA44CA678
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\77b53fc5-8344-459e-bb5a-7b1e196d1f67.tmp	JSON data	E420B86DBB4E7CDF7171DD9D37B106BA	E5014576B393B71EE5E1178DBCF7F9F7C6E3426B	FABFB64B18FAB4C0CE01876CAEB2DF8635574F745547457C15074DC2C89B83A3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	E420B86DBB4E7CDF7171DD9D37B106BA	E5014576B393B71EE5E1178DBCF7F9F7C6E3426B	FABFB64B18FAB4C0CE01876CAEB2DF8635574F745547457C15074DC2C89B83A3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	ECB3CA353AD687D9722E678DAAB196A3	6E0F2CDB7281EB29DC2275F756F844C13902C138	59A1530F1C37629D84D10F49FA35196E2E3FF54C9B54BDB4C6F2318371D2CDC4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	53EA0DB61666231257854BAD74D3CD98	8B0A27C9BB7354FBA7FAB7A0873BF55B03255A63	E34896F9A30214D6C4A7B783F1A37775B1655A537CED860276C4FED7B056646B
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	88B5289FAF20F8E6798A4E6A3A575E8B	C2B0D1B6736381DB777DF54F40DBFE4C48D2C343	767B232347E37781702E972093892774CBD60C5F9660773F2EA4B1C7817B6BFA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	EFE421768AA94F081F12FE9BDF75A118	DB8EC776426864D4DC0EBDC769E79EBDAC564FB2	57A9A99E840AEB33B470202A0E471ED800B7BB93F237C6354DADFB505CFD52D1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	6771C8D67757AC1B3362024FADF5D12F	45FDF98B4906822369D6F0B059564DEF48BF0565	6435E5CE43780915F72FB7D86FB3BEB1EC195BB315E98B9805B9A9AD91C4122F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	C664FC47943544058E882D6FF80E057A	3E9DB3404B53FEEE6A043F1485446961A446F4CF	7275F50370A58711CEF63585074148BE18E6B01F475BF4EE5767D7ECB9CD8B12
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	02E5D75FCA6CF6A49310BA5B372D8708	831A80A79E064D9BCC5C494A2C499D0EF504D199	7B3F5BF76019844ABAECCF6A3617C50781C3C6278F421D7D9AA7C184623307D7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	AD64822D931ACCEC423665181CFC87B3	F107654FAAC03651E6974B28C476553A6BEB7143	7DB93CE2126B49DAB5451776D86434FF3A17295433B07A16219A9F508B9C57CB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	3F317811A3CB3CFDDBBC83BA78D51F7C	5E1E3E9E1260B7102EA277FE61B3339C178564E7	D803D00235F285806535BAF293D47193E61803E7FFA7DC9B683B8294192C0FF3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	A17B1E39B9C9C205E846238424E2FA76	0764AAD8A31DE964BA201656782AE0C1C460B328	494FBE0388EBACDD6EC8D8D3172BA0C70FC93981B14E851A73F8C7B519644A08
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	A048C160BAF41120AA5764E8095C549D	145010A98BD1E7B38ABCA72951B0B263BA8B876B	C086A5A2CD79975A3DB1494AB8E37E7D3CFBD07F8F4DBC0C769ACBFFCBAFBAA5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	748F44A89E6F3F1DEE4D1F35C6646CF3	5886D40250F2264AB0BC04F08D5D78CC8C8706FC	30A3CED1B662C5746FFA7F6949395A0260DF67E0C35AA0CEDBAF0ECFC2D0CF6A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	159AB5268420279F21B73898568E6696	0F3C5019A8836A0201C53F749ABC4F865D74AD7C	D93D14C585DF4F8CE6F1ED18109FE22FC56000AE729C2BE94E8E8687BF55DADF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	159FEBB5A91BE1620195AB57F9C365A2	B957AF7BEC6F4D5434878A0FF6AF1BEAFC60DA31	BD42A59E9188929DBBA0A23C7B7B51E2ABDC84B186F39266911CE461DA97E174
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	EECDC9EBA06F986BF58546051880D272	6A51ED0AE615F12EA4DEE39D941FBB920CD4FBB7	A4C3DB15D6C8EF9FB7996A56483FFFB5A333D385191321B91CA6BAE5F9B716B3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	A29BAE36D4041D7E13F27D254D30CCCE	09E0487B3589A950A30E39EB7385F3690BC8C11A	9140E74FF50C1A9A92117AA4B8BEAF5810680A7B7AD3BCECBD82EF6109F49002
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	8111D4DE31E9473666040B9A09F593A8	BD755764D8C06700E0BD193E1225CE42E6866693	F76E3ED89B9E3202CB265895BFE0EB7A83AD99BF9CD7DC9666B99FE4F21623C8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	338D76AA634C67C0E2B0F43B3B99573E	891161F1D7ABB1648356ECE4322F94A833154522	38C45D96E2AB16B56B01D1772AF5834FB72B6D5C3AC1F2D6A985652C801CDDD0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	344D45D930F29C73403D2C96FF5B11BF	DA979C8C0C01456F572C1580C469BDDC0160DA12	B8C1C2C8C311BE9360022001FF73349F58B18D732288FA54BCC71E1B4BD25B10
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	7345233DAAB05D60A5863397E9117A4F	BC692D6EB2D6A9D9714334E69CB0D1E74EDA6BDD	0223F443512B68D866B3E59F0A43BBBD4BF44E37652626DED1F2AACD09E21B12
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28	DDD83E97765A03EE7F8242FD7AF777F3	DA0B2E764D3A815BA098706F5242694CD5553E94	42410C09513A52ECEE6F86BCA62901F324227A1E9E54DDB63AF3DFB6909C6550
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	04B83DAC48809E94824E21809D4E7F39	9EFCD9DBA64D2379675EAA42D1D5248C045F4C54	57CCA710EB3037AE06FE4397B81E78D61A07928B753E11DF3DB493FCE9F7766D
C:\Users\user\AppData\Local\Temp\MSIc7745.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	366B28432DB1AF9AC6022FEDF54567CD	85DAC543953066A0F2C4CC739A28081339062E15	D9A9C862B380709F0EFEDFA461264B154C1E8A5E54D054AA724D83DCC07D46E1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 11-03-31-899.log	ASCII text, with very long lines (393)	E89CDF7025B70E5A72FFC801BADFB345	2C55C26FD5231BEBD6531BDB7962D12BE288A1BB	2A90DFB97133E5C0219784D1C4A94C0DC45AE4787C40CFE6894A59D94C4FB88C
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	99DBB7D3D0AA3ECDD9F8607926811E45	75C7A647DF9242C33B94970C82C07CA629B11122	AEE3616EB06F73A6D1A8DAEDE8B9B41AC1EC2A229DFA93BE6CAAF7C0AFC6DBE4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	C42F505C2BE6BA8E6E19443A7EB73D79	11E71F6DA1F53A8E4D4F80001BC53A8C6674A3AA	53087858FED820124CB2FBE1A75C799FFA7613A35D42B3A12050AFE1D46C8133
C:\Users\user\AppData\Local\Temp\acrocef_low\109fc839-bd29-4a01-b77b-8e8723ef3593.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\37c0c9ce-ec72-43ce-a3ad-de7f6cf27811.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\8f191d7c-d0da-4755-a2ea-0130c183f737.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\b2330402-f73c-4644-a90f-23e365e548d8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	68F28776A696E8BD26CBC2ABDF08259E	DBFDB2CB458022E0F6823E13A063B3575BF9071F	5CE2D3653E8B1559CC45AC696EF2225A0B47F80B707970028C6180C721CAA70F
C:\Users\user\AppData\Local\Temp\acrocef_low\d655ad5a-9cc2-4a68-924d-f929a7b6ae7c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	956BEC2EB32005025184F904D9622D32	C6A9A8B3F7A7AB8122FB00457C0F83D4A77F21AF	DEFD4ADB96BA87467278B6B06980FDAB1EE460D971B62ED05A89FF32983784EF

Windows Analysis Report
240224.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report 240224.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
240224.pdf