Windows Analysis Report
su11ra_2_7197.PDF

Overview

General Information

Sample name:	su11ra_2_7197.PDF
Analysis ID:	1528868
MD5:	f418c65a16006215441d914ced24ebc7
SHA1:	79fff4093937c404b1f09e4f9f843924b4118d66
SHA256:	87b1e9ad626280722625a0aaaacf18c2514f663fabe961fb953e30ec945141f2
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: classification engine

Classification label: clean0.winPDF@14/25@0/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5256

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 05-00-34-504.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\su11ra_2_7197.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1536,i,12242700170008053216,9860424687919460678,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1536,i,12242700170008053216,9860424687919460678,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: su11ra_2_7197.PDF	Initial sample: PDF keyword /JS count = 0
Source: su11ra_2_7197.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: su11ra_2_7197.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1528868
Product:	CloudBasic
Start time:	10:59:36
Start date:	08.10.2024
Sample:	su11ra_2_7197.PDF
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	f418c65a16006215441d914ced24ebc7
SHA1:	79fff4093937c404b1f09e4f9f843924b4118d66
SHA256:	87b1e9ad626280722625a0aaaacf18c2514f663fabe961fb953e30ec945141f2
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	9ECC4FEB7873F2567E4D7EAFB22DAA3B	9E1B49345051119768B35151F3292465225101C0	F483820C824227078039CA00E341841A3A5409F8FD7D41D20CB7F3660DA3EF1E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	9ECC4FEB7873F2567E4D7EAFB22DAA3B	9E1B49345051119768B35151F3292465225101C0	F483820C824227078039CA00E341841A3A5409F8FD7D41D20CB7F3660DA3EF1E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	A9B2E57930E944A2B1D6A5B7566941A6	72F22EEB80E16413AF5708E6E570205D87ED7E87	8CBDA572FF4A706978FC082B15F7BE2C5DDEDEF57F8C2A91C2DBE5CAB89F1564
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	A9B2E57930E944A2B1D6A5B7566941A6	72F22EEB80E16413AF5708E6E570205D87ED7E87	8CBDA572FF4A706978FC082B15F7BE2C5DDEDEF57F8C2A91C2DBE5CAB89F1564
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	094E8186E78F46D22F313430DAD475E0	57B88C51F5BA01F780FD5F95B7969E461A32A75E	EA2B66BF2AEB3CA9245E81717D5D4F4E645DAB5F59124D1A1303E31434201E1A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bf60501d-c7b9-415f-802a-a5ba62a4e903.tmp	JSON data	094E8186E78F46D22F313430DAD475E0	57B88C51F5BA01F780FD5F95B7969E461A32A75E	EA2B66BF2AEB3CA9245E81717D5D4F4E645DAB5F59124D1A1303E31434201E1A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	E5228906CF566D6A7A3FF9EEFA14D47B	059AB58A82980A18A0552F2A04B18C67F652C791	019391B8DA9BB8C693514B2637893409765116E2FAD72D9EF362482F42AACFD1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	672EC37A2AA9AADD33FCB4E040A2189D	E97398BF4E9BEA1077AA08D41DBD4AEBC3FDA311	030BB0D6676E47AF5C0932DD87EF6A413B97CCB74B975E06875114F4138A7F28
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	672EC37A2AA9AADD33FCB4E040A2189D	E97398BF4E9BEA1077AA08D41DBD4AEBC3FDA311	030BB0D6676E47AF5C0932DD87EF6A413B97CCB74B975E06875114F4138A7F28
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241008090036Z-165.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	F5989E0B9772BF953EAB0E529B44D2F8	AE50266E825B63CBE45823D31CD227BFA365A4C4	198B8B1D61ACCD5192B4A999FE203721C4E3BE8D62A8897A96148B0A882C9280
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5256	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	D75DE9F85ADFCB9420E4A4D985041A53	57B52E5B05F1652B08446FE126C054B81C6E8F57	C45E4367C8D48BF4E5E5C50D2C4EA42D802ACFC997652CFDA4C130C25A236471
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	DAB03E4A3222C5EFBAB4E7DF79BDC8AB	D380D3FA0DE97E8417BE38AA9A837D3E5C976FFC	8AAD032E156638A2BD77EDB173AB213E7F6DA02E3C2327ACBB44D8ABD9397B1F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	F6DCDFF8D01057B3518BAD84F724F756	967EE8B289E33EE504AB81507ED3176A0C6A7854	A761B1EED6DD79D42806EC02CEEDA559BEF4F47A02329CDA7E9D1ED3E01315FD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	B2446E06366577D259DC25ED8E86A15E	647C6B72DAF887A946B2319E9EAE9B1CBEE760C7	0EF59BB04A19B1DAED736B7B5412E4CB2ABF7C122161756105438D290518C9E8
C:\Users\user\AppData\Local\Temp\MSI1b72.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	2D0FC7E1EBADF1336B950A0B058A0DC6	AEFE2E4A44D62E9B6988348173B93583F4C9F84A	C2734751F13E26F0CB834ADA5FB3411C27C53CED309F997F6185BBF41DE3C98B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 05-00-34-504.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	7FE663137C970957EAC900621FD4E540	51522BB1B9C0C4ABFEF83DE7830354EEC5903B52	3DDA9DD21D70A9F6B2E2C5942D6F4C5930C0D60C41B18D108A2DD8783AED51A9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	46906577EDB206E2B97CAE05F6D88553	84F83221167913ADCDF735F43E37F6EC10992555	E88F8DC7305CA70298159A148809DF8864A71225C1EF723FD7913EF6B9888632
C:\Users\user\AppData\Local\Temp\acrocef_low\2ca3d3c9-134b-43a0-9537-ed7e12eefdf8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\58b2d694-316c-461c-845c-8cec067ca4a9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\e2a67946-5253-46a3-85cb-ec2cb7fbf6ca.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\f0419d90-a732-4c05-a860-4dac267b29f4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	3C671FDF7C9B2C94F91645F11DC9ECD0	56CD18C4AB744302BF5147F3B21EEACAB18ABA1C	16BA6A372F18C7A16158832163EA7053DA3E8F177476C024DA42E2995BCC13BF

Windows Analysis Report
su11ra_2_7197.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report su11ra_2_7197.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
su11ra_2_7197.PDF