Windows Analysis Report
Usc credit Union Bank Letter- copy.pdf

Overview

General Information

Sample name:	Usc credit Union Bank Letter- copy.pdf
Analysis ID:	1528502
MD5:	b0c27a59f6b7246a6ccd99bd675d66f6
SHA1:	478c5f6502d7e529e13a5a6c902eb00765dd594a
SHA256:	93235fca9fbe77a4dc06e55dbc89b657a852a19045d1c04b7d7df7f09c6adb36
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443
Source: global traffic	TCP traffic: 23.56.162.185:443 -> 192.168.2.12:49730
Source: global traffic	TCP traffic: 192.168.2.12:49730 -> 23.56.162.185:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.56.162.185 23.56.162.185

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.162.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.0.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/43@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 18-19-51-434.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Usc credit Union Bank Letter- copy.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1556,i,8437841704339123093,10600651356444801376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1556,i,8437841704339123093,10600651356444801376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Usc credit Union Bank Letter- copy.pdf	Initial sample: PDF keyword /JS count = 0
Source: Usc credit Union Bank Letter- copy.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Usc credit Union Bank Letter- copy.pdf

Initial sample: PDF keyword stream count = 104

Source: Usc credit Union Bank Letter- copy.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Usc credit Union Bank Letter- copy.pdf

Initial sample: PDF keyword endstream count = 104

Source: Usc credit Union Bank Letter- copy.pdf

Initial sample: PDF keyword obj count = 107

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.56.162.185	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1528502
Product:	CloudBasic
Start time:	00:18:46
Start date:	08.10.2024
Sample:	Usc credit Union Bank Letter- copy.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	b0c27a59f6b7246a6ccd99bd675d66f6
SHA1:	478c5f6502d7e529e13a5a6c902eb00765dd594a
SHA256:	93235fca9fbe77a4dc06e55dbc89b657a852a19045d1c04b7d7df7f09c6adb36
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	B3C0109F3B6476BA253792B1DA91684B	EDC387D02B4087FC40E559801FCB6093715F514C	AB78D6735D26E65623174901CC9EDC5AAB9EBAB8AB09009C124F7A7C09808D50
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	B3C0109F3B6476BA253792B1DA91684B	EDC387D02B4087FC40E559801FCB6093715F514C	AB78D6735D26E65623174901CC9EDC5AAB9EBAB8AB09009C124F7A7C09808D50
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	72852A505CB137C5BEDCAEC70EC72B37	1395948F707180350F38F18649129E0AA0971643	9BBE4EA959C81C5D80E3535A933761EF07F89090AFAC1216BB41FD85205078ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	72852A505CB137C5BEDCAEC70EC72B37	1395948F707180350F38F18649129E0AA0971643	9BBE4EA959C81C5D80E3535A933761EF07F89090AFAC1216BB41FD85205078ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	DDAB5BAFCF18A1EE8D48E2DCD81D4304	84BE5CEEFD41BF4193751104B4FE7060E7D2CEF7	BE2DAF8CD23A0E07AB44BB9AE89B7504F2D7E684393FC8FA35C6E05552F41C8D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cb32f0db-2877-4726-92e1-ec3eff87d4d0.tmp	JSON data	DDAB5BAFCF18A1EE8D48E2DCD81D4304	84BE5CEEFD41BF4193751104B4FE7060E7D2CEF7	BE2DAF8CD23A0E07AB44BB9AE89B7504F2D7E684393FC8FA35C6E05552F41C8D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	172B35BF98CF40F027F0B42B16747851	9ACA24AE43EAE79B1C95181DDACC5D40AFFFB315	73A5A4322A01091DFAD4ECAB7EB176FC83D48C67465EF28F93559AE6644F9AE8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	E44891A5043ECFCEB2A89951C7B17541	685629BFBB6B97684B40A14EAFEFFDEF3AE9263F	CF809FBA31AFA90EF7E4AC92FE6984819F04913AF20648D1A5D1E8703DB997EC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	E44891A5043ECFCEB2A89951C7B17541	685629BFBB6B97684B40A14EAFEFFDEF3AE9263F	CF809FBA31AFA90EF7E4AC92FE6984819F04913AF20648D1A5D1E8703DB997EC
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241007221953Z-204.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	855B1B69058F487CCCFC29757ECF53C1	F212E8690D811C93492EB9F2EC2F979BA8AACA41	751DD61E955D7F5EBB0500D3C7381AC645B6A10E80D138B4E8E04D7B7E9AEA23
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	2967512E5EAB9FF4B9D5F1A4DAC0A93E	50341F70C7750560D70D0E98CB70BDC6E24B37B5	DE480D75CC87910759E2816960B1C6C491BDFA217489EF0A7256540C8D813010
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	2AC2243103F189CA0E4A7551E4633671	5BFEE24F7A9ECBE81A1D7B2C5E3FB385DADDE085	DAF08526137A06B258BA4B75A1E42498598CDCBCDAEEE94CABCBBD1C938B9A5A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	A46386D77778D7EE52FF0BFE780EA4B7	AE763FD935C4AC96F83C320C2C9B3E0E8A2419E4	DA8641CA4DD27C390796368E3D22A060FAA23E815287C93502E5F731D1E0F354
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	AC4D831D284E1A0B031212C23457E437	81956E4DEC35B1BB75D7DE5C9D2CF2B68C1C6416	B91563F11F3D99A8267709DC454B7591DA1E1409742DECBF5DC79F3E2589A469
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	AE49849ED413CDD8E9EA8D0496FA3C1E	4B6B9A1CB3DA711D3FFC898A83B92C1459265308	97BAFAF10ADE397B36007629F8550D1C9678F5A8279A87C34CFD5AB94E677D45
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	85C1F59CABB57E9FB567D6A4784E73FC	89F5AE741621389D00D0D5FE05E79E03E29083CE	6C5DA5ED68434FA3FB330A7A12F6C3A2BA3BE8C1CFE4BDD8A677FE3E8AA6BF6C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	314554D7004E094AA5222D177E06B6FB	BFFF60D3F5626316DC5B34274B341ACEB02ED63C	B53EA807EA9ADECF847C03CEDB504D2BA830C1E6C67D45B089A478A3FFBFB982
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	FA1822D8DEB103C8F69632F61AF592D9	919A5466B6BED3956FB3AC597D0CA1CD9E914A55	F3EE6A1B6893DFA6152A3E8388CD2FCCA03D1B99FFB93AF2EB7E969B6DFDA9CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	033EE2B579DB08C58C95AD0FC53B7844	F33594A2FA7CFE353A542D9E2F0F910B4D5248E0	3E46D91D858F397956AF473C0992F6928014B2A98523489996B283FF09F523AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	B023CF6BFAC9E7A5C0C4FBD7AFBB4AEF	D74334D837A5B4459F6117A6995DA5C35BF958AD	30C66354C533C1C4D0FA7D5483AE476FC6785E0BF631FE775709A3284488CE60
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	E886D5A04975CEA1F7778B48256E49A9	955B432E02B99DA469BB8DAA25DAFA31DE68D22F	56E611C4446C52B6197C069CA09C2B6A2E6AC0CD04BDABBE8E3600C7FFA49573
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	596A3185491EB61024D02DD11390F021	7CBAB9D1B20442FA61D8E77D4FDC81269854C673	A8B365A8002E4FBA5EDACD8901374AE82DB5C6E28D4F533309333F069338419E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	2DE427B24555B8619E951FA791F84F8D	4057B9E0F773D8EE889F300C5CDECF5D10EE330C	9736795690C0376E6A049FCB0090A9235A30C2B11304B9DFC4A976350602AD78
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	F193DC6275A14F58B5664044F1D78FB7	A299E84B066FB64AB1985AF8EAB6E03AFA0A0CE0	C31D7C9FCB121A84C639E9B348052D0DD9320CFE4F50D526FE181D9486A1AFED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	E9F0A4F3DCCD7DE5D03C8A84D931D600	AFF4D39AA5CA5AE2271C1F6D5A9B67E4D200EE1D	16C20363069CA02BD18B603F6829132657FBA65A7C2399A39642437FECE1D5C3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	788BC7FE968782492F4B06338C79EA39	2A00EB2479C6D9D589ABB7D4F4298605C77B3A7C	A45AF0D5477A8134FC1B94A082E66A487A3D3438BE1157AD5F57224DD26EAB23
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	DF6D7E6E31C620E0337E201784B6F655	E4AC7E4B3E4872AD7B1536F7D7BD6DC88742E699	94C5FBA42682BA5972F653D0C63642DDCCB70076B58FA5DE0790F00C99C5DED3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	FE283D410509B0E787126D25953A79C9	E518E80BB878F529FA0B2F1108E272DFF6A154F3	6A9F4682CC350116D702D8A8C8976F1D743A6C1C4CD4537BAF0B53CBC33A3A40
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	4B291318278CCB8C6DEBF18A9A0E0089	AF81202795FB4CDC885EF8E1F78630ADD00BDA04	71F039DE928148CE57621500B8C06FD24CC15EF47B70E230F10EE1F63D58D7C6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	DC4416A35696D37F78C47A1A849541B9	10A28141107FCCEA58FC628D2CE8EAF5AC279FD4	03B7A6D9325106CA857F888314DC6C7EA40FD0A7A03F8C3E2F151A022347CDBD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F49216D523C63E6BE516D5BF06CB20F4	29AC02FA51AB1699D996BECD2F8E2C0EAE974186	A3E392D02D7B15763499E6CA34DC760DA01034B8792A6CEC2F5DE90F44524C7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26	CF5D2CB5474449222B9A4FE5FE719FDA	BCCD9F671FABD695AF8AE174A70EA1B1D0EBE9E5	7D24EC371E166421C86BA0703C8FAC4957A537B54E9F5A3B295FB07D1FDDA857
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	7E0A8EE7FF9A2276882FA6511CD50410	93B9247C02A41DB2010FCDACFC7C62AD0C680DB8	F251B83B31B7153CC22F374EB6C7E277E084F23C8B642D2CBDD97DD86CD13ADD
C:\Users\user\AppData\Local\Temp\MSI6db29.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	05122187F5D2A456CBAFC47D4D11EF17	BD9B91EF1ADDDF4A003D5BA11177691BE805E653	B2963C9286F8BF7069F41F3A4A4517C06D342ACC26D89A2B3E5B9307734A96E8
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 18-19-51-434.log	ASCII text, with very long lines (393)	39628FA3AE1A78F558A4947A4847C830	083A80F18FBEA378E9944FF9B6B74FE68CD56D92	E634D52BBCA86894E6CF9CA673A8FA4035AD705990F27198651E88F969FE73AC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	7EEE6A344E2B04F84E70FCEC83DE2952	91D322F7F52FA0B26399FD53F196D5D776C318E1	CD533B596DFDA50906DA8C12989206106257E0834DC2E1F76D82B632DFD18B1F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	B274030C4863EDCDEFF2F32209933D04	3C099E7CD72AF644585039583CD3C47ADDD64AE2	6F91929161B87CCA3B4EB710A35BBA3726E291C846B6CA905007F5B1652670C5
C:\Users\user\AppData\Local\Temp\acrocef_low\318cf416-ae50-4137-b6fd-3811948a1d7d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	59456AEBFE40D51DCD738AF1B2D65A03	953094EDE30485AB6E071F8A0BF64D9BC1C34227	1C21F3042C5972DE59996ED10C08D9072E9F2643F65ED69355CD5B2E7735067D
C:\Users\user\AppData\Local\Temp\acrocef_low\801c2e00-bbe6-4ce9-b6c5-1154db712dcc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	E139E6D53A958755742760CD4A4456CB	C259B619917152498BF74F65E11D03B50E4F80F1	542A482DF531973AFE108199E6DF1200DB2590E2E2F7B73C5CD428066EF9138E
C:\Users\user\AppData\Local\Temp\acrocef_low\db004f45-d2a5-4736-866f-57b672b3fe76.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\de611fa4-3222-4ae0-8539-bd0d1300e015.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
Usc credit Union Bank Letter- copy.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Usc credit Union Bank Letter- copy.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Usc credit Union Bank Letter- copy.pdf