Windows Analysis Report
Payment Advice.pdf

Overview

General Information

Sample name:	Payment Advice.pdf
Analysis ID:	1546389
MD5:	eff216e55b8a3c51f846949e180d4ea2
SHA1:	78037f2493c0d5add9e29a21fabd057a0ce93536
SHA256:	afa730da16e3e0fa0a2945810173e506c0f0e493dd470970dd0d2519d1ab4798
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

PDF is encrypted

Potential document exploit detected (performs DNS queries)

Suricata IDS alerts with low severity for network traffic

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49748
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49739

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean1.winPDF@14/44@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 15-37-31-751.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Payment Advice.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1724,i,15721545753982683772,17854325307601287913,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1724,i,15721545753982683772,17854325307601287913,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Payment Advice.pdf	Initial sample: PDF keyword /JS count = 0
Source: Payment Advice.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Payment Advice.pdf

Initial sample: PDF keyword /Encrypt count = 1

Source: Payment Advice.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

PDF is encrypted

Source: Payment Advice.pdf

Initial sample: PDF keyword /Encrypt

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1546389
Product:	CloudBasic
Start time:	20:36:31
Start date:	31.10.2024
Sample:	Payment Advice.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	eff216e55b8a3c51f846949e180d4ea2
SHA1:	78037f2493c0d5add9e29a21fabd057a0ce93536
SHA256:	afa730da16e3e0fa0a2945810173e506c0f0e493dd470970dd0d2519d1ab4798
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	E294E5AE1F6C54CFEFEC4640182C4D21	A689146347CD1B98A4407094DB1577066AA0A3F4	E6085EC6241E2DFD03CAA644A853F16CBD49A2CBD034A2CA559A3B79ED2D0134
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	E294E5AE1F6C54CFEFEC4640182C4D21	A689146347CD1B98A4407094DB1577066AA0A3F4	E6085EC6241E2DFD03CAA644A853F16CBD49A2CBD034A2CA559A3B79ED2D0134
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	0F15061EF9D3B041695B56CA9293382E	7AB82AA898A64F6ED4387A88D9687FA64D0262C8	4C2EFCD4A5C5B2D671767AB424C8349D5160803E75D9AFC133A1673BF17DC956
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	0F15061EF9D3B041695B56CA9293382E	7AB82AA898A64F6ED4387A88D9687FA64D0262C8	4C2EFCD4A5C5B2D671767AB424C8349D5160803E75D9AFC133A1673BF17DC956
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	551569AA672887A71AD2EFF422CF5AFB	9E459C9C270A9E510EDAD0F21587C45DC1646C4D	B0EF889370BBF0A6DBE9F981F0E7E4CC759F147FEF3DADB2CE31E3324BF81A09
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fe770ce7-1f85-4bcd-b485-89e681b62655.tmp	JSON data	551569AA672887A71AD2EFF422CF5AFB	9E459C9C270A9E510EDAD0F21587C45DC1646C4D	B0EF889370BBF0A6DBE9F981F0E7E4CC759F147FEF3DADB2CE31E3324BF81A09
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	F137ED55B2F1B20676020806A8782C47	302846A38633005E916AA7E337692AB059BD3283	FB3C89E17D0BD5BDCA6224F89BF60F77C2BA9A5FFC50E5A69615ECF48A66AE24
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	266F59B35CA69767B9134C1B5B725745	5B935E317961ADC597D0F7E9EC0C54D7066D6192	2949FDA35E0A91346F241ABC6FBC2F7855732D8254654463B6C49857D504DBFD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	266F59B35CA69767B9134C1B5B725745	5B935E317961ADC597D0F7E9EC0C54D7066D6192	2949FDA35E0A91346F241ABC6FBC2F7855732D8254654463B6C49857D504DBFD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241031193734Z-245.bmp	PC bitmap, Windows 3.x format, 164 x -126 x 32, cbSize 82710, bits offset 54	71A917249B61C32FAFC72FA578C54462	1BCD665568102CF4CA3E64E555C89E78E46CA426	F783411E383F12F4462A84C06E5A4D6EA5B8F21C903494A66E2F4002426549B6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	2FECB6E80AFD06BDAFFFEC27BCEE2700	034CDA6B6C13F01E151709AAABAECBAF5B854C97	CAA897ECD26363A5E5A3FB476F41C330E8E330A843F7141E354A9458FAD920E5
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	6F202E6E2A85139A6F1FE115C3A72297	1F31B5A94B9FE25075C75BBB825256F6B2917554	F5B41C271971E58264C9004758F91A385F77A09679B24F8DE67026632D7316D0
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	347294732F9CD219E1DC5AE1E8EB58B8	3050B4357D7B0270C3CFC2F4E854358B7AEAC761	A7A1320C3285F9AC5D1AE715D742113EA8F2436DF0CC8C62269B9BDA9945C1F7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	758B42992DDFC41CB5E57069C621B54A	D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD	55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	762AC1028CC61DAA09C3577EF595DE5C	03D219F34423BD1B08916E508F70229F55ED518E	C21D44445A43070962B8FA0B2EA3BE41FC4430B4F62EFD4BD011B7B4C95CDADE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	77EB907F7070D192E04F8A6546FA2046	F4D6B37DF7F7BC78D5F11C326F725E318F8F51A2	4B0A81A2E42D320D78822EA1CF0089CE0ACB536E431A5D3248DC11C610D41DD9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	AF86ACB016882A810DC7E8B99D52CC77	8E782DDBD3BE68BE00338E78E7B0121EE04B07A7	344B1ADEC779D738FB4FAF7583BEF4568532156A57CA48A8D523FBA28427281C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	2E9A9FECB012C8BAFBB3E5C191B253AD	C3C1EA5A16C94855F849918C72118BD9A9934807	48B2B47DBF8F042C32E670C675EE4FCE4A09219FB56CFD2EA988841B308D6134
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	7153F53AA46B35EC297A96B5B4D5CD34	BB4AE2A73DD991F83C3EDEDBBF9DF8E2920868F4	0DD501E939998BEEFC23A1EE49488E97148CFDCE073E0BD1D569897CBDC18FCA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	FF39BE39CF52D104ED7AF178A7E6709C	A04CE1781EEA193CCF208FD5E902339FDD7CC8FA	C5FC15C3B67CCF10A37E024C6C589A05A223D51F823E18D7E75B58535AEB794F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	C110F06C613575ED61A25E995AE5DF77	1B55BD1E0E3EEFF7AE2FC45BED5CB9976E133A1A	11D61A926EF555DA0C0DC949AE6A9E0EC01504C992452395B93ACF9044743E32
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	A452C2CB271FBB596FC41A25B97D9A0A	5D0EB066E5B9DF9F03CE3812BB1C9C9051B8B263	BF2C6EADA67B5DC0B4C419EB19328551940F8CEFE3E3BC8A162DEDE294029629
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	839295DCD223BD483B439F365B1398F6	AE46266A58FB315D2E3D79F06637281B82989EE5	8A4735E1635E0B07F20F1466893D0BB5801A8B92F16D681F4CC61781D118D46E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	AE01738FFC7AABAE6AF9840093F92461	F413C9F7B4604AED18BC8252B91BC33C59172482	86648AABC061144C5143D92F6046EFF49423D4ED64255F5C7BF054A3A8DC1DC6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	C5278A1C68D36251AEE450C9EF960F97	04890775F28D9B6A7EDF32DCDDB7083BEA7673F1	9AA4FC494858A5FC5BE689B7DB1C1EC62E698B2ACB745A72FCDB8689CCA5747D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	3B7DEE3B77371247FD83CBEA40C542F1	71411E936D22813A00BB918757A86390423DF459	5279E6F6110E2FF7F8144F9838C98F73BEAF5CF384B85CC71BCC63163DD26AD0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	800EC9E5E2B7E7215D7E466C0CCCA1CC	11162B13B2063F6F9CA374E5552ABA768CAC4C04	121AC4907D05EF759F65151C91A12B78F6EF652D252247D3D1A815FD7DF7B229
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E6EE55C528EFDAE77FBAA433930DF0EB	E3C473A74679A7C1CC6C10D314233A7A370942DA	42DFBF5A4F43E7804D933791261730114D1CEEB1EF88A6669D662E9BDE5A9F67
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	1282CEBFECF4B359068AF5062CE9B7E1	35AA61B41184E7F6B6672B42FDF921ABBB913264	BA54760DFEB581D5763737FAB9C2DA033EF731587F305EA51584F10DA0427331
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	87ED5468B993613482F6CBBDE80072A7	41DBDE918CF5E0C6E289BDA97BD04C52A172ED3E	B5F838EE714EF78051EF781F0475E5873346BF1606034542132F2A75F6A9555D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	990C1713299E1E7C8C80FC5D041B588C	106B7C714D0848133D2F9A3A3FC6CED87D3934EC	586EE146FBB58AA7D79C16878E533321A0708EF37F6476C4CD404BD220256E26
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	F4424ECC8E3B12DA241F81201F4ED6A0	2F98D1C34CFC7F89EBAE1C3EC9DE6F9C1D8ECA99	120AA804A19114EAAC4BD621BBFD877EE2C3134EEEA83171293B7C1D0F8F1FA2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	2095FC51F75FE26327D463CB7CC29C23	D52961AFA1CD7401080A8BAA8FE31D5625CB26F5	6BAAA7FAA10E58277F17A303D2B7915EAF7669D7111B4AEE424D667504949F35
C:\Users\user\AppData\Local\Temp\MSI91200.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	2D758700028E5D8D72ECAE78D1830355	CEEFD209CDEB772DE3C5B45373495319CB315C1C	424B8D12C515D582FBDC4279A9C6E4DE10D85201B74529D5EDEA27A7A39B84EC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 15-37-31-751.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	A298BCAEE2EAB622A53B3744EEF40DBE	72DEE1DEC3C21CE812D689DB483210429C71CB9B	CF005DD6906F160B758090CBC70B5333E0E92735128EE48B8B7FF4D9B1CFA30D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	6B80CF2920D45334C904CC7E64985644	89DFDED664EAE09DEB69B107C082DED093B72CDB	FF826D4453A1456963E5CA581A6AA844DAB3CD7473099E1ECF8C5BF92A8FA523
C:\Users\user\AppData\Local\Temp\acrocef_low\38e17980-e03c-497c-99fb-f1000624161a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\648653be-be5a-4e2f-9f32-730b642f9001.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\a8209e2f-c8cb-4dde-a8eb-d84f0eecfe9b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\db71330e-f7b6-4eb0-a34c-5f83153689be.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	A8E5C37206C98D1B655FF994A420FFB6	827237782AB5971EC205C3BCECCC7950BE9F84C3	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486

Windows Analysis Report
Payment Advice.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Payment Advice.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Payment Advice.pdf