Windows Analysis Report
Fawn SR.pdf

Overview

General Information

Sample name:	Fawn SR.pdf
Analysis ID:	1546427
MD5:	21b8872312436e51fd92f4b352475db1
SHA1:	7d43e86b53a4e2accb4cccd2eab407e11b2fc40a
SHA256:	aec16b70aa501f232237963786262b957012796870aa51a59d86814673542ffd
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 96.6.160.189:443
Source: global traffic	TCP traffic: 96.6.160.189:443 -> 192.168.2.4:49745

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:57101
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49744

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: clean2.winPDF@14/47@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6236

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 16-47-42-952.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Fawn SR.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1660,i,4725044180020461910,8330491623448977777,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1660,i,4725044180020461910,8330491623448977777,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Fawn SR.pdf	Initial sample: PDF keyword /JS count = 0
Source: Fawn SR.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Fawn SR.pdf

Initial sample: PDF keyword stream count = 30

Source: Fawn SR.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Fawn SR.pdf

Initial sample: PDF keyword obj count = 53

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.6.160.189	unknown	United States		16625	AKAMAI-ASUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1546427
Product:	CloudBasic
Start time:	21:46:42
Start date:	31.10.2024
Sample:	Fawn SR.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	21b8872312436e51fd92f4b352475db1
SHA1:	7d43e86b53a4e2accb4cccd2eab407e11b2fc40a
SHA256:	aec16b70aa501f232237963786262b957012796870aa51a59d86814673542ffd
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	AFF73755C236F9380BC3B21116B0726C	D685B9E67A080385A52C231E58BF179F47AC210C	B9DF214259DECD2326116CEF1D3972A925B9C0CE99763E1FE93C04B7738D59C3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	AFF73755C236F9380BC3B21116B0726C	D685B9E67A080385A52C231E58BF179F47AC210C	B9DF214259DECD2326116CEF1D3972A925B9C0CE99763E1FE93C04B7738D59C3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	F2D67B7DBEA61B996508D6128A2B644F	E4F9EB45FBA4805D4034B2DAD270F6D498B1C26D	F669BB3AE3AC8E657B19A9524E88F8FD3537B6DBDEF48E21B5BA47447FDFE4F9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	F2D67B7DBEA61B996508D6128A2B644F	E4F9EB45FBA4805D4034B2DAD270F6D498B1C26D	F669BB3AE3AC8E657B19A9524E88F8FD3537B6DBDEF48E21B5BA47447FDFE4F9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5c96052f-48a7-48e7-9612-f8f3b52f1c65.tmp	JSON data	754B519E0F9A489C4D64F9167BCB7C8D	12A9ED553FABA78A968563524B30EF7B117FE682	B6A6DF2B96C3512D75907D54B57ABABBAB49A4D49CADE816A4D21ECE0C4C5B00
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	754B519E0F9A489C4D64F9167BCB7C8D	12A9ED553FABA78A968563524B30EF7B117FE682	B6A6DF2B96C3512D75907D54B57ABABBAB49A4D49CADE816A4D21ECE0C4C5B00
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	05308E8F00C7B7D99F4F2017A6B64941	85D3A2FBED30EC52319D82EE91767E9079AE1E1A	D5C1A5FDBE7DF6F94BA94602C92B1179D4D09C108E348BD97A6EC89B25339364
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	E16A7ED4A56C399452E1A13DDE23DFBF	3E652ADA44D93A064C232A2386D1E321573D3A92	0FE3BCF57044208510E94B4667BBF0DA1E356908588B3EF701D36614E1BBFC3B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	E16A7ED4A56C399452E1A13DDE23DFBF	3E652ADA44D93A064C232A2386D1E321573D3A92	0FE3BCF57044208510E94B4667BBF0DA1E356908588B3EF701D36614E1BBFC3B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241031204745Z-160.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	05B28C6921C5231B348D484C02C24927	1E56FD5CCA547180F03982F33A35B4D975C540FD	D17A9F06A7BAC3BB69B27D6684C18CD79F6EA4DB77D010A99BA8C4314B09C8F6
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	6E78A3CCBE34E2C39684643A6A2CFF30	B83419BC4F4C59CACE77532302F5EC14A94D97CC	9E00CB10A3DB02BE9B5C8AFE626ED8575A4F56320E462871EF9D93D1C44E2423
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	952D0426AC883FBA8E2999B9C7A9D957	09E9444C649D59BA44C2DCA22986891E65D75E44	1561E766C82BDE815F66435747FF280FBBCF1A57237AB90991B5D2098693305C
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	F436D57AE76E82A11CF1A2266AE99F7E	F8EC0A98C71D29D8263832688E594D44D5B23D43	D095CB345577BF36F76EF4321B211896F7915C113A5FA5653D0EBF8E753C838A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	C14DE2790C1B38A537CC9C3002F244E7	D58A82A61449CA6C2FFDD7C2852CC56667488203	BBFD5C974FF9E2BB235468AA44DB4EA3D37146FE1D671E07CFB9040F12917729
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6236	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	CF53C35F864B0D5199EB34F170253FBC	3C06BFC098A743EA361964B71F9B3A6CD04A5653	B395409CDDCFB546C8E55EC1AB2B650BE5D15C0D60B6D3577A1F01071C7C2A55
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	1423C17563E5EEF19506617BB5108129	086F20904671C2304AC1EB024F48DA9F042F3876	86FF1BEB1326E07F05D348D301F5F6DD83430B563936EFB8E666DFD1017D731E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	7CAFF08D60D62623C722257FCB7DD813	D6B6E08CA33EF216F2D4469D5580534BFE30520C	B730B38FC58E3519F449F295E600466C623F690FA826EF4B1A79183770A4A0FF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	C8FAA60C65E6A331DBC0C09EF2179508	256F760E13C677311B71C66330775045479F458D	55F626EE1DED5BE7889BEEF76FDF960413D4626BB202833A5C9FDE19B44E8BDF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	FA634A372EF2513A6F1AA35FA61EEB5C	26E6BAFF463399842146BB4AC000DB491C6B0884	352140C393016796F8FE0CC91ADDCC09E5B9196841D861C5092D964588D2833D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	089281BC1D4C674B581C462139FB91E0	C29F0BB034D67A07E7C9378FDE4E76D9E106B9F5	BE96C6BE04D00016584C0B7287551C498896165E64CCB2D5D0442C16BE0B8981
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	0CF3BC5E3D4F51896B4203580534BB4E	06309D95685010316A076DA96E276249B194CBA1	23DDA1AD52E292E37F270AFBB0261C7C631DC48522B8AF8BCC4D9952AB2C24C8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	6A5EE5FDF56FBD518B80E88E534965E8	83FD5757A3A80C29EE6FFF5DA015732992DC94F1	6537D30248C007840460DDEED691C86F7BD850998E9F000F3A3362452CA23D41
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	558BF7C8BE850CC851506AF779B30DD4	7F795E0D65046796CD5C018ABD3D475407D2B150	E1D1367AD0266AE3F619DA10B45EAFC60D7E1C227CF0B98AA801BD9ECAC4014A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	C89AB06256B40A45B3C98F1F348A1FAA	A22915B4D33B1429B04A38D5755621B931FC16BB	D373241556B7E5813873EF503BE50F4EBE5B94B6241DC276390086188D08F990
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	F67F6C71A6ACB444BC9F9CD23537751A	71CA244F8B77016C2DA10FD879CFDBFE4D6E379A	7B298656365881FF4989C10EB805C45439B873FB5ADFDFD77D52D2D6F3F3A9D2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	9BADA3E3DFFF7D63C0D11A6FE0741149	19FA80CF9EC4C2371EF41A490FC590D3A61FE374	3A0B77ACE7EAB5507F6BCC595A06DE7B18B406B08D18367C0B588F2D78E8453A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	0C161B9ED1ED3D9445EC2E073A74B2C6	F0DD8DA374F95A640DF574B68FE9AB46510B4B0E	971114A330D1713B2B9D72627FDA6423BEDE7ED100155F2F0975DB180986CE2F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	89E0D811EC3D37646A5A374F39F3DD02	6E7BB9CD263FD6BE5DF59501E51B50CA9AD46F70	02CAE7D47C165E6B802794C76F4A35B84AA10FE40A45855C598A74892ADDACAF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	488D9CB25C4AC0534393D9BE6B559BF3	2B57503A0C005C8A431A2533190E567E3DE4CE42	9D2CFF75EEA592E73D7909499FC96DEA368FD7BAE1365108D879D12F7554E61E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	A4C9AC9B62E2418A53E28BA9FF4F634A	BA9C22D2587CF508BC0587C4DF7372EEEA43B225	E26FEFF4787710B90CA3D17FE77913AB2A9DA454B1AE3FDC8BBB8F04E7119AC6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	132E185B422A6225B0B7842C0F132409	8F2A6DB3DE9DF0B8FBF2CC9396A753EEB47F9417	DAA455EEE00FF5C6EF9E6E0914C74A7BF8DA265588F34D9A2549C039F47D22BD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	00FB18C941E885701CDF7011AA2EF1D2	7FDF2E4F170EA39C0E942787181700EF70E7A469	24BFFB73516432DEF883181513BE89CAD17AABECC7320DDA151BA1F4DE1B76B1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	56BC3FC57EE5BE29EDC320A90B3ECE07	98E684A847A5C98FF8E1A90264F878C72DD410DE	16A7005B194FBE655CD2FA843D9593904F154356E71A95F32EB864C5944C3E67
C:\Users\user\AppData\Local\Temp\MSI77383.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F6E8391E8027FD482D14C310EC685B1A	30539D5FE3A653FBB2EAA4D6C2003349A61C4FA5	CF1BAAED084999263448ADF7F5BB1DF15EA5CB6BA494B23AA2EA925382A2DD42
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-31 16-47-42-952.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	C50EC65204391533E685BEDD86DEB4A3	9000A99BD3A35690B7F13BBDA479C9DFA0386C40	3EA1A1D9F266FBCCAF0B4CEB7D411B0E8A649B5B9493FB648CBBAB4DC59C4B4B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	0EF8BD61B36425870FEA89F9B8ACD7F6	457426557804814C4B4AC9CCE92B32CCDE1BF168	5FD085CA9E1D239D87CF0909F417E18E637535AC1576DE3A7C102AB945FAC639
C:\Users\user\AppData\Local\Temp\acrocef_low\2f9cd2a7-35f7-44fe-b321-739efdad29c1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\431dae1c-a192-4b4d-aa75-d5d4f45b2b1a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\5178f885-f499-4328-ad0d-14830c323f5a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\ae20c580-6cc4-43c6-b0e2-0d2a745f5e7e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
Fawn SR.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Fawn SR.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Fawn SR.pdf