Windows Analysis Report
20241009_081551.pdf

Overview

General Information

Sample name:	20241009_081551.pdf
Analysis ID:	1530834
MD5:	f484e5a411a8fce3b83b52394a38e5fd
SHA1:	9ae19978c161dec8cc2bf731b0d66704be6a6214
SHA256:	d701f941b2385fca99c95a47f71e6271f4a3866541236410d147f4e62ebe051f
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49746

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.200.196.138 23.200.196.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: classification engine

Classification label: clean2.winPDF@14/47@3/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7428

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-10 09-40-33-623.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\20241009_081551.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1732,i,17494166975454114938,2148100432959137793,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1732,i,17494166975454114938,2148100432959137793,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 20241009_081551.pdf	Initial sample: PDF keyword /JS count = 0
Source: 20241009_081551.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 20241009_081551.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.200.196.138	unknown	United States		2860	NOS_COMUNICACOESPT	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
x1.i.lencr.org	unknown	unknown

ID:	1530834
Product:	CloudBasic
Start time:	15:39:36
Start date:	10.10.2024
Sample:	20241009_081551.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	f484e5a411a8fce3b83b52394a38e5fd
SHA1:	9ae19978c161dec8cc2bf731b0d66704be6a6214
SHA256:	d701f941b2385fca99c95a47f71e6271f4a3866541236410d147f4e62ebe051f
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	02F67E51E958ED7D1B1A2A4841066D84	797C0A6E4696156081A6B78898E75346178EDBC2	1F86EAF1D5E9BC3010AB31883BEA77E642E7DDCFFA782AAFBB7731D9A6FE996E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	02F67E51E958ED7D1B1A2A4841066D84	797C0A6E4696156081A6B78898E75346178EDBC2	1F86EAF1D5E9BC3010AB31883BEA77E642E7DDCFFA782AAFBB7731D9A6FE996E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	25B3130F46FBF3F2A0195D1D29B28EA8	A95574F44B57B7792B41BD90C8EA9E0B8AF2CDDE	92D539737D45015CC72A7EBAADECEF7713B52012E69B6F91DC0FAD54780321BF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	25B3130F46FBF3F2A0195D1D29B28EA8	A95574F44B57B7792B41BD90C8EA9E0B8AF2CDDE	92D539737D45015CC72A7EBAADECEF7713B52012E69B6F91DC0FAD54780321BF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\10088c24-08a1-4786-9be6-855685d9b420.tmp	JSON data	12482945A07C22BEBDC686DFCB9578FB	DA688E36E31FAA631387E962A5678A2E18FF498B	F41FF62D4F6DCC62BAA6741E4D44BF2FAF5127A9E72F9CC5833A9ABA845DF7C7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	12482945A07C22BEBDC686DFCB9578FB	DA688E36E31FAA631387E962A5678A2E18FF498B	F41FF62D4F6DCC62BAA6741E4D44BF2FAF5127A9E72F9CC5833A9ABA845DF7C7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	C8392BE7F796283E38141EF91830FCB6	FBBAA3C699048EB8A28080162DE31C939703035E	5AE33D9CA6DB799FAF38F7B6E9970C9398FE992663C653C03592D5D1B602BAAC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	6114E3AF8689E76A66B2127DE0A94C26	42F798E8513F7DA0D24C24406DBFA11043B4CE47	FBF0526D6F0A163A8BA7232A03D4C21EDFC811FD451C345E497D08D1813E73D7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	6114E3AF8689E76A66B2127DE0A94C26	42F798E8513F7DA0D24C24406DBFA11043B4CE47	FBF0526D6F0A163A8BA7232A03D4C21EDFC811FD451C345E497D08D1813E73D7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241010134035Z-160.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	82EC8CCEE6171802269A85B62824279C	95092DC7410574ED8B18363ED5B1D483352EA72D	C00C33D9C2353E371D6B9194D7FFF208F54BFD642B31684FF0809A3CA3BF41A6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	712F88A0CF5ED0FBE9149FABE90D6AB5	CA5CD1E1C1B0CDF85205CA17F3976821B6E9EC92	8BDA8FF19C5B3A0701255C323DE895A645E34C87BBD0A50F1AF11775918BBD86
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	20598710A42B5A8621E572626D588FE6	0562C6C25CAB90950BB9052285F4EE2A907FCE93	9C7ACEE09EDA534D30073414B9F5616E3B615565E34E0CB48EF5CBF9F99BB218
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	DF7920B84C79B38B2AE5E864CB93F623	F42B8CB509309B75C6D4A99A228A2956FC423605	B53701CFF06DA99943980A3C40DF97A2CFFC156DBC65B69980F586FE7BEB4354
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	5914AA1FB723B347E3027A56343E1E8C	B85DC97F4B288E94505EA549A438B648D05ABC4F	0B600C6D0A9810E370725004D76638E2C2762A4B684D4911610E369FEFA9B0B2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7428	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	2898D1FB4673F8689951496A2E142084	F070D0FF4AD1C1F699881F86637ED1D03BA5787E	7DF11A5BEFABFA09980BFFFA1484509771B5572F72B3525DA6B05CD66D924BB5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	440D92D6FFD3109DE0C5B0FC68621475	084199725815E467A6CDFBE8DCACC8496CB12647	A68B5D430D143E5A73FB8FABA90B0EA2B7F150782E9CD9AF81E162D733C871C2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	E7BA65F38BF86042CA4AB75C12D935F0	B5BD92C651F20A95CE2FB3DE2B733A3BF09108AC	665B76F2222F19644B733EDA3E886914EAFBF7454B00BD701B7275BC30CF5CE5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	F45AE30D29CCA796BD127FF8F8FD6335	DA93CC33D385F751B18330A9046EEDEA95BDDB21	95CDB334B1343D77A9A7D81B87B1D4E957BCF5179E37025FE0B4FE2A2D63599A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	5D9B4FD7BA4480C7E1BEA5F5E500BC70	C422B884AF12F1C0FA2E30FCFE9170D9DDE53F4E	95B98E0687AC1362C627FF26057D426D3C1C0B7A53E85624BEA261544DCDFF5F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	94143AB66B725943D8E70534C3E5634F	C1F8DE3FB4DD9C2A300BDDBDA2B8191136ACA747	26E9711535A40478E3CD9CBC6DCBC01E45C594326F216341C8A067336A6D8C36
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	36546C4390BCB71BC8DB3E560BE7ACA8	BD627B080CB3CAFDC67B277E9106403FB32E6A5F	EBE407463A53A28BE44165A802FCFBD83A40FB8E5B404ECC92958EB99B1CE168
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	3173202F5E2A80B53B5076DE9A450438	8E77823C1DC7F3FA2BFADE00CE915436EDFBA8AF	908C6DE1C08F0A4B5959BFBAB9BE1B50CB037A55505AF1B324577E63D1197857
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	8CC5D6DB0A45CB81F46ECAEC69EE7399	C614DAB9DE0F7DDFC7E298CF3AB1A2CF9197DC80	F52D31970B623E83BA252B4E5FD780C65F37E3BABAED4AFB0E38B7C5206DA326
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	588120E823F2FD590394BC80F5F04A65	AA824003CE060D16C43B81B353552655ABE67B35	1AE5B1816A54F3B8DCCBB941BB11A18F27AE53E758B684E97B27F058A9F4F26E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	4699163293A8B467CDE41FC9A5830051	494BA23AB0809D16FDAFE917AB0F95ADE3D0D1D3	82826DFAE9C330575736049BD593F257D275E585B9D0CDA8D10F9D0E788DE867
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	E137B487C32D2EF1D80B6A869463A32A	E33E4D8DCBEDD04BCCF159998C6C99FE9C57E1AF	EB900A67758D6F434E37E241DC63D0A0B2AA32F6875702F3DA9534EDC9D81DBB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	4B00F99185329BD7ABB35BB8261C73FB	F27E06DB7594F666CE6F4CA2203D80C55629F65E	93104927D712510E4E430511AC6FFD58AC7A84A8FF9DFFF534D0FC248F7B8C38
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	7A0B22DDBFD120CBFE1DDC625C0AC948	52C6944D3595429D4114D0AB72606B841A499FDC	7E843E31276A609C7BAB06D95303B0FA7BA60CBDFB4A4595DF2F067E7B02A598
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	DDCF38F4E89C30FA155275ACCB96ABD5	8D764CA3C59AED46515F0DE2BCE5023548212228	A76CA2BD7156CEB312CD9B6DAE80A917193F7CC8C0C91CDA38300E39C7FA3297
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	8A20612F1CAD33EA518190BB54C818DE	B1C024EAA0AD0FE8ED80752DE1FD28622099456F	12A856882834B1C96B067354BF829A52C657F108EC68161A0AAE29289D64FEA1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	CF3A5BE3D25649B09E361E16AF4AE345	75DDA82AC02C137C057615EEE030A6FDDAAD1D4E	6C646AB068D70D6CFA5AF8C79A06FD477C098FD627CDB414489F04F30F078E70
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	4EB15F8CB068013B89A9C1C78C31C088	B9B7901F8A3C59305CA9D485AA0A13B52748ED72	3972F72F12EF6EC3B33CECF7F7324FE4006B4D99A0E14802AA296458C09766F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	19400FEC50FC9EA7006A5A953B419BA7	F948899938E8722E816A90B89E33D03F0FF16453	0DF5E3AD5045C1A7EC9533383F5D5CCC43B743F9D7B2DC77B4A5E42D5FFDE335
C:\Users\user\AppData\Local\Temp\MSI6533e.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A394588EE45B3845E10F721564FE9F42	DA4168EAAFDEF924E75894BEF743846942794BAF	B277E8170EA733B449EC1B0CB5963B366EA9D45DD8DACCD454806DEF8AA42ABF
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-10 09-40-33-623.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	0D085864D3A290653C2FF2D4EAB9C76D	D7CAC734DFFBB94D0FD9A4E0749567E7AF9F6BD8	ACACCDBF939998CEB55C7D4C3455102A1EBD2CECD03CFD418156C2AF89A548D4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	A928AC756023109B9D046AE2D722D877	881E6F79765E97DF632DB8E21181B0DE9F695255	73F37485AA9E66958B2972B945A9E5ECFE3BAB26F25B38972447687DE983AE82
C:\Users\user\AppData\Local\Temp\acrocef_low\54d16b9e-fab2-4ba0-b6c3-8945316bbc84.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\d0db4d27-22b2-4a05-945e-8d7a7981dc35.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	595D52F056D9D1FF19D516F23C677369	463739610C6108B2A704D1483FB4CBC88C026D47	05CC4FC8F7F02ECBC2C67933B998CC5A281DBD2CA4205460731AFDBAE42BF72A
C:\Users\user\AppData\Local\Temp\acrocef_low\d4790999-cea7-42b3-9898-48f9be10beb9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\f6f1bcd8-0d49-4751-9315-0d22935dc37f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
20241009_081551.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report 20241009_081551.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
20241009_081551.pdf