IOC Report
NEEmRGwBAG.pdf

loading gif

Files

File Path
Type
Category
Malicious
NEEmRGwBAG.pdf
PDF document, version 1.4, 1 pages (zip deflate encoded)
initial sample
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
JSON data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cc651615-5923-4172-ab2a-55c29463e147.tmp
JSON data
modified
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241028104354Z-155.bmp
PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
SQLite 3.x database, last written using SQLite version 3040000, file counter 4, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
Certificate, Version=3
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
data
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
modified
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5532
PostScript document text
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)
PostScript document text
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\Local\Temp\MSIbea32.LOG
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91v5ciz_1fbdbi2_49o.tmp
Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9w9o2ld_1fbdbi3_49o.tmp
Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-28 06-43-53-007.log
ASCII text, with very long lines (393)
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
ASCII text, with very long lines (393), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\1d52eaaf-ac8e-45fa-9330-663254fb07bd.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\6be9c9ca-7025-44ea-a477-ddbd1c23b6bd.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\c23626b4-c8a7-49e1-b07b-817ec446f01d.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\f3e1787c-5ae5-4216-bf1a-3cb64374b1af.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
dropped
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings
ASCII text
dropped
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl
data
dropped
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl
data
dropped
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 09:44:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 202
JSON data
downloaded
Chrome Cache Entry: 203
PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 204
JSON data
downloaded
Chrome Cache Entry: 205
JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, progressive, precision 8, 1680x1080, components 3
dropped
Chrome Cache Entry: 206
ASCII text, with very long lines (65461)
downloaded
Chrome Cache Entry: 207
JSON data
downloaded
Chrome Cache Entry: 208
JSON data
downloaded
Chrome Cache Entry: 209
JSON data
dropped
Chrome Cache Entry: 210
JSON data
downloaded
Chrome Cache Entry: 211
JSON data
downloaded
Chrome Cache Entry: 212
PNG image data, 709 x 237, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 213
PNG image data, 709 x 237, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 214
JSON data
downloaded
Chrome Cache Entry: 215
JSON data
downloaded
Chrome Cache Entry: 216
JSON data
downloaded
Chrome Cache Entry: 217
JSON data
downloaded
Chrome Cache Entry: 218
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
Chrome Cache Entry: 219
HTML document, ASCII text, with very long lines (4821)
downloaded
Chrome Cache Entry: 220
Web Open Font Format (Version 2), TrueType, length 47264, version 1.0
downloaded
Chrome Cache Entry: 221
JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], progressive, precision 8, 1920x1080, components 3
dropped
Chrome Cache Entry: 222
JSON data
downloaded
Chrome Cache Entry: 223
ASCII text, with very long lines (1066), with no line terminators
downloaded
Chrome Cache Entry: 224
ASCII text, with very long lines (3768)
downloaded
Chrome Cache Entry: 225
JSON data
downloaded
Chrome Cache Entry: 226
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 227
JSON data
downloaded
Chrome Cache Entry: 228
JSON data
downloaded
Chrome Cache Entry: 229
JSON data
dropped
Chrome Cache Entry: 230
JSON data
downloaded
Chrome Cache Entry: 231
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 232
PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 233
JSON data
downloaded
Chrome Cache Entry: 234
ASCII text
downloaded
Chrome Cache Entry: 235
ASCII text, with no line terminators
dropped
Chrome Cache Entry: 236
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1648x1080, components 3
downloaded
Chrome Cache Entry: 237
Unicode text, UTF-8 text, with very long lines (65415)
downloaded
Chrome Cache Entry: 238
ASCII text, with very long lines (3768)
dropped
Chrome Cache Entry: 239
Unicode text, UTF-8 text, with very long lines (65415)
dropped
Chrome Cache Entry: 240
JSON data
downloaded
Chrome Cache Entry: 241
JSON data
downloaded
Chrome Cache Entry: 242
JSON data
downloaded
Chrome Cache Entry: 243
HTML document, ASCII text
downloaded
Chrome Cache Entry: 244
JSON data
dropped
Chrome Cache Entry: 245
JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], progressive, precision 8, 1920x1080, components 3
downloaded
Chrome Cache Entry: 246
ASCII text, with very long lines (65461)
dropped
Chrome Cache Entry: 247
assembler source, Unicode text, UTF-8 text, with very long lines (6820)
downloaded
Chrome Cache Entry: 248
ASCII text
downloaded
Chrome Cache Entry: 249
JSON data
downloaded
Chrome Cache Entry: 250
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1648x1080, components 3
dropped
Chrome Cache Entry: 251
JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, progressive, precision 8, 1680x1080, components 3
downloaded
There are 84 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\NEEmRGwBAG.pdf"
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1676,i,11425198669066236123,16450259438300404404,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2116,i,15328674476385843745,1406063215858999797,262144 /prefetch:8

URLs

Name
IP
Malicious
https://fonts.cdnfonts.com/s/65008/ClashDisplayMedium.woff)
unknown
http://x1.i.lencr.org/
unknown
https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198)
unknown
https://fonts.cdnfonts.com/css/clash-display);
unknown
https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198
https://fonts.cdnfonts.com/s/65008/ClashDisplayLight.woff)
unknown
https://fonts.cdnfonts.com/s/65008/ClashDisplayBold.woff)
unknown
https://fonts.cdnfonts.com/s/65008/ClashDisplaySemibold.woff)
unknown
https://fonts.cdnfonts.com/s/65008/ClashDisplayRegular.woff)
unknown
https://www.fontshare.com/fonts/clash-grotesk
unknown
https://github.com/oftn/core-estimator/blob/master/core-estimator.js
unknown
https://fonts.cdnfonts.com/s/65008/ClashDisplayExtralight.woff)
unknown
There are 2 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
91.107.202.212
unknown
Germany
1.1.1.1
unknown
Australia
167.235.20.246
unknown
United States
239.255.255.250
unknown
Reserved
142.250.185.164
unknown
United States
172.67.184.158
unknown
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileSource
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sFileAncestors
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uFileSize
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uPageCount
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sAssetId
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
bisSharedFile
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sFileAncestors
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
uFileSize
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
uPageCount
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
bisSharedFile
There are 10 hidden registries, click here to show them.

DOM / HTML

URL
Malicious
https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198
https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198
https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198
https://app.blaze.cx/link?li=671ee3647dc00d7a53f3bb9c&c=7e9547&sk=7bdfe5d198