Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Copyright_Infringement_Evidence.exe

PE32+ executable (GUI) x86-64, for MS Windows

initial sample

C:\Users\Public\Documents\1p_stc.js

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\Public\Documents\infringing_content.pdf

PDF document, version 1.4, 21 pages

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\62c9f349-4d9c-40d1-bfca-a8591e137e70.tmp

JSON data

modified

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241008000806Z-161.bmp

PC bitmap, Windows 3.x format, 114 x -152 x 32, cbSize 69366, bits offset 54

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

SQLite Rollback Journal

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Certificate, Version=3

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

SQLite Rollback Journal

dropped

C:\Users\user\AppData\Local\Temp\MSI90399.LOG

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91obhrej_12rngfn_454.tmp

Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ot1ngx_12rngfl_454.tmp

Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 20-08-04-931.log

ASCII text, with very long lines (393)

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

ASCII text, with very long lines (393), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\2eeb6302-3fa6-499e-bf27-1efc7ee1b1f0.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\32adfae0-4802-4115-90d3-8dd5ad976667.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\6070af0f-2f50-4c69-a1a8-00a82439e04e.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\eafaa857-6f4e-4f69-8df5-18a673b00228.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081

dropped

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

data

dropped

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

data

dropped

There are 39 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe

"C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4788
Target ID:	0
Parent PID:	4004
Name:	Copyright_Infringement_Evidence.exe
Path:	C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe
Commandline:	"C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe"
Size:	2215688
MD5:	DE2B7EC32D3A5C530E5A1AA6F2B27B16
Time:	20:07:55
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6f37a0000
Modulesize:	2224128
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Initial sample is a PE file and has a suspicious name	System Summary
Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)	System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
PE file has a big raw section	System Summary
PE / OLE file has a valid certificate	Compliance, System Summary
PE file has a big code size	System Summary
PE file has a high image base, often used for DLLs	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\System32\cmd.exe

"cmd" /C start C:\Users\Public\Documents\infringing_content.pdf

Details

Is windows:	true
Is dropped:	false
PID:	1408
Target ID:	2
Parent PID:	4788
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	"cmd" /C start C:\Users\Public\Documents\infringing_content.pdf
Size:	289792
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
Time:	20:08:01
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff72fc60000
Modulesize:	421888
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	2544
Target ID:	3
Parent PID:	1408
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	20:08:01
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff66e660000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\infringing_content.pdf"

Details

Is windows:	true
Is dropped:	false
PID:	2276
Target ID:	4
Parent PID:	1408
Name:	Acrobat.exe
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\infringing_content.pdf"
Size:	5641176
MD5:	24EAD1C46A47022347DC0F05F6EFBB8C
Time:	20:08:01
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff651090000
Modulesize:	5693440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215

Details

Is windows:	true
Is dropped:	false
PID:	6492
Target ID:	5
Parent PID:	2276
Name:	AcroCEF.exe
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Size:	3581912
MD5:	9B38E8E8B6DD9622D24B53E095C5D9BE
Time:	20:08:02
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff70df30000
Modulesize:	3620864
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1676,i,12330115841079905350,6086354628428383365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3700
Target ID:	7
Parent PID:	6492
Name:	AcroCEF.exe
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1676,i,12330115841079905350,6086354628428383365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Size:	3581912
MD5:	9B38E8E8B6DD9622D24B53E095C5D9BE
Time:	20:08:02
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff70df30000
Modulesize:	3620864
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://cevcsca2021.ocsp-certum.com07

unknown

http://x1.i.lencr.org/

unknown

https://www.bu.edu/academics/policies/intellectual-property-policy/)

unknown

http://65.52.240.233/data/1x_stc.js%

unknown

http://65.52.240.233/data/1x_stc.js

unknown

http://65.52.240.233/data/1x_stc.jsZ

unknown

https://copyright.columbia.edu/index.html)

unknown

https://drive.google.com/file/d/0BxyQzf2unIzKM0FMZ2pydklwMWc/view)

unknown

http://65.52.240.233/data/privacy_policy.pdf

unknown

https://docs.rs/getrandom#nodejs-es-module-support

unknown

http://fairuse.stanford.edu/)

unknown

http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w

unknown

https://www.certum.pl/CPS0

unknown

http://repository.certum.pl/cevcsca2021.cer0

unknown

http://65.52.240.233/data/1x_stc.jsk

unknown

https://rdoge.ru/test/config.json

unknown

http://65.52.240.233/data/1p_stc.jsh

unknown

https://creativecommons.org/)

unknown

http://65.52.240.233/data/1p_stc.js

unknown

http://65.52.240.233/data/1x_stc.js~

unknown

http://65.52.240.233/data/privacy_policy.pdfr

unknown

http://subca.ocsp-certum.com02

unknown

http://copyright.cornell.edu/)

unknown

http://crl.certum.pl/ctnca2.crl0l

unknown

http://repository.certum.pl/ctnca2.cer09

unknown

http://65.52.240.233/data/1p_stc.js8

unknown

https://rdoge.ru/test/config.jsonS

unknown

http://65.52.240.233/data/1p_stc.jst

unknown

http://65.52.240.233/data/1p_stc.js~

unknown

http://www.certum.pl/CPS0

unknown

https://rdoge.ru/test/config.json_

unknown

https://ccsearch.creativecommons.org/)

unknown

There are 22 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

96.17.64.189

unknown

United States

65.52.240.233

unknown

United States

Details

IP:	65.52.240.233
TargetID:	0
Current Path:	C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe
Country:	United States
Countrycode:	USA
ASN number:	8075
ASN name:	MICROSOFT-CORP-MSN-AS-BLOCKUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

172.67.158.129

unknown

United States

Registry

Path

Value

Malicious

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

LangID

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.FriendlyAppName

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.ApplicationCompany