Windows Analysis Report
Inbreukalert 108853.pdf

Overview

General Information

Sample name:	Inbreukalert 108853.pdf
Analysis ID:	1531474
MD5:	8502fcad5d4442b2b5d7a45d4b077674
SHA1:	8a8fd3d77f0d765ce72ff3405fb6ed51c000f8e0
SHA256:	75a5dbf11322e80312741c8b0ba8a5a4f0787d86103e09f45f6aaae379057ced
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.5:49814

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.47.168.24 23.47.168.24

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: Inbreukalert 108853.pdf	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814

Source: classification engine

Classification label: clean2.winPDF@14/25@2/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-11 03-35-59-594.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Inbreukalert 108853.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1680,i,14188585612647693084,4468660862608693226,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1680,i,14188585612647693084,4468660862608693226,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Inbreukalert 108853.pdf	Initial sample: PDF keyword /JS count = 0
Source: Inbreukalert 108853.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Inbreukalert 108853.pdf

Initial sample: PDF keyword stream count = 26

Source: Inbreukalert 108853.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Inbreukalert 108853.pdf

Initial sample: PDF keyword obj count = 50

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1531474
Product:	CloudBasic
Start time:	09:34:46
Start date:	11.10.2024
Sample:	Inbreukalert 108853.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	8502fcad5d4442b2b5d7a45d4b077674
SHA1:	8a8fd3d77f0d765ce72ff3405fb6ed51c000f8e0
SHA256:	75a5dbf11322e80312741c8b0ba8a5a4f0787d86103e09f45f6aaae379057ced
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	DF815D450617DAF3927EA6BCF459C66A	C355B0FED0ABF2C72BBBA9DBFE8A810A8AE623B2	B7F5A80CE9D88DC245850FE48E1B2B2D0DA825BF07C26D8EB3D2E5D97BBE690A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	DF815D450617DAF3927EA6BCF459C66A	C355B0FED0ABF2C72BBBA9DBFE8A810A8AE623B2	B7F5A80CE9D88DC245850FE48E1B2B2D0DA825BF07C26D8EB3D2E5D97BBE690A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	4951DB94357D3503E2F36BD5F1067B70	7217F3A1876700E9B27681E143A8297E9F34D59C	91C37C740DC6B75699C925B2A16807A55AB9EB807123BC598F982EF88A51B275
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	4951DB94357D3503E2F36BD5F1067B70	7217F3A1876700E9B27681E143A8297E9F34D59C	91C37C740DC6B75699C925B2A16807A55AB9EB807123BC598F982EF88A51B275
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	8846EAFEEC0A14768711C3A6B7661524	0376538DD9A00E3414066943ECB8B97A6EAC15A9	48A6FF91C90D0DC58534103A50FB729BB75FB4547D99E1DA6B4F308D63D6BFB1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a1acbc5c-db7a-4188-b3e0-c533993ce49a.tmp	JSON data	8846EAFEEC0A14768711C3A6B7661524	0376538DD9A00E3414066943ECB8B97A6EAC15A9	48A6FF91C90D0DC58534103A50FB729BB75FB4547D99E1DA6B4F308D63D6BFB1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	71B9497D5D595E60A70F1E4E94A1A486	1B5A9D6AB37B5F44606B12EA5739A65D625882E6	3F22BB6DDB5C481FD093E961F87504F02EC7FAE4C7ADD9FD1478CFCB156613F3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	4197B0C50B41B1EB7CB383FD222728D0	B6FE0CBC8DD0B0300D3F7326CDB5F635983A35C4	0B8EEE5C4F3A9C4682BE33A7C67A1E6B9D72DB308388E4AA52F5A5B7E371C62D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	4197B0C50B41B1EB7CB383FD222728D0	B6FE0CBC8DD0B0300D3F7326CDB5F635983A35C4	0B8EEE5C4F3A9C4682BE33A7C67A1E6B9D72DB308388E4AA52F5A5B7E371C62D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241011073602Z-186.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	D283228F68BEB826E6402B3E2AFEC7AE	9C3CCFE4918DEE2B3DCFB76C4035F5ABED2D882C	EFE9EF8DBB8B555FD54FB884D77E38721D6D22C3CBA3D2F5DD1AE94830C9A6EE
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	EE11D9C30A37E3F56175F3EE0543FAC5	E365E611D28E48163A03387A01DA4514D511EFEC	06C77E7A32BF02CF515275133B442345621FE04B2F37FCC0197DE0FDA6D35C0F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	792B4777E5D2ADFD12829915B5B2BDC9	86FBFF6786718A6878F6337DE67F4A479CC6E5BB	C7B205E4A7C8C308422164FFE1FDEB123AC0F71A5A0CF0C4873C7D4F550DAC7F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	756BF7CCFC3A898373BEF00E8F330608	9201A2DA4180537E72756CDE0874F98DA5FAF747	F01A77269CD8C06D22FFD3A15F9E9A1B45BB54ECF1E31928E377B56E95900CE4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	87CA819294C6A2D44C4DEC859C839E2F	522EAF2D5A0FF5E89B6B2F70340B71C7F2915A82	C194A952E412AF750299D575D73FA30DB66D647971BC7B1B550E925F8A4D93A9
C:\Users\user\AppData\Local\Temp\MSI87e0d.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	69BA06AC54862ABC1EB9341CD785DDFE	5D746EAEDF2737DB6D075D4A433CA8F836E75232	C2A4A27A5874AC62106E21A5ED9C207BDC1B8CF1C5C4E2B3EF99342D1C58C3F3
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-11 03-35-59-594.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	511A480A5656B8F4C10B562419DF5691	6E9A1067A897D09064EE625465D7ED8350A9576B	535797EA7E132F0DB02D0E987237E8F12E8FFBCAFCEA182A0427B75C715321B2
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	5EA9AB16B7DB8A3A40DEDF21596C5888	D6140FC99F713590A14C2D6303C8627277A03B9F	CFC8CFE75239F9D084FCC06A178A4BCA9DCE9CC77BA414EC8A4144B8F40F838F
C:\Users\user\AppData\Local\Temp\acrocef_low\3b30d150-14c9-49f6-aa11-530af16489d1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\4477f52f-acbd-43b0-8cbf-2af092e52719.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\9c690918-c3b8-4d22-806a-5b203a2149dc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\e999c698-ac7d-4a41-973f-ead9b66e25ef.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
Inbreukalert 108853.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Inbreukalert 108853.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Inbreukalert 108853.pdf