Windows Analysis Report
526142.pdf

Overview

General Information

Sample name:	526142.pdf
Analysis ID:	1561508
MD5:	bcea5bd8718053f4699a0c6b17481ca7
SHA1:	7e037add42f3ec8835feadd9852c4550646bee7e
SHA256:	d21711f4372dc7ac5aa7d124dbff9382cb3b35cb38d5a1b3c807bd2d414e46a1
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49715

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 52.5.13.197 52.5.13.197

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: classification engine

Classification label: clean2.winPDF@14/51@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-23 10-08-45-360.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\526142.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1604,i,2889311111756859078,1169954142003541719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1604,i,2889311111756859078,1169954142003541719,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 526142.pdf	Initial sample: PDF keyword /JS count = 0
Source: 526142.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 526142.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.5.13.197	unknown	United States		14618	AMAZON-AESUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1561508
Product:	CloudBasic
Start time:	16:07:47
Start date:	23.11.2024
Sample:	526142.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	bcea5bd8718053f4699a0c6b17481ca7
SHA1:	7e037add42f3ec8835feadd9852c4550646bee7e
SHA256:	d21711f4372dc7ac5aa7d124dbff9382cb3b35cb38d5a1b3c807bd2d414e46a1
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F771E855085585BE5E837E12EDAF1D47	31E4FAF5976B5A73FCD99E54FED0E1EDA7518555	702B19D65B88E6D197A10592A320506DC61621E3FEE3EC4D98D9628654D3A57A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	F771E855085585BE5E837E12EDAF1D47	31E4FAF5976B5A73FCD99E54FED0E1EDA7518555	702B19D65B88E6D197A10592A320506DC61621E3FEE3EC4D98D9628654D3A57A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	FF5195EA285ABD3825A45D622EE73455	3FC5B8466DD1EA055638F049ECC09A61028982CE	6F31009ABE77D3D00119FE1395D86A2C3D9BB60E6FFA0792453B6AF3861F5DE0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	FF5195EA285ABD3825A45D622EE73455	3FC5B8466DD1EA055638F049ECC09A61028982CE	6F31009ABE77D3D00119FE1395D86A2C3D9BB60E6FFA0792453B6AF3861F5DE0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2dac56fe-de7c-4089-82fd-e04d92c88755.tmp	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF53e57a.TMP (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f4a8553e-0452-4de3-b017-d600c776dc1b.tmp	JSON data	43C2AA883FA585D6693C9C6A784687D9	44B53D933A2D7D3F11321D09ABB497AA5E9AB468	5228AA9F7329EC4B82CBD9937894A659E0034DFAAC52A243FBC43870310B9D19
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	40C93D918F92743CFF3CD44EF86169F2	29F9B7A31B1D7061C016068B7A55CC49E3B8424D	348BD10FFB1B0008F9E4E1BC95D56ED61379BCBA82369FE2157E9349AE7E9737
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	56860A1AB7D9B3EF4BEEFAF63247EBC8	AE83F094CC0FFC1DB7D2959838BF7977DD1682BB	CF3F4055AF60202DDDE068AA3647D73A6D101E5F72A597BC7A59F54D6D358313
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	56860A1AB7D9B3EF4BEEFAF63247EBC8	AE83F094CC0FFC1DB7D2959838BF7977DD1682BB	CF3F4055AF60202DDDE068AA3647D73A6D101E5F72A597BC7A59F54D6D358313
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241123150847Z-164.bmp	PC bitmap, Windows 3.x format, 164 x -115 x 32, cbSize 75494, bits offset 54	5F1FFB5742EF94638858F6DAAECF3BA3	B6B458FA7D19E44741D24E2DA3C16EB1B399E662	53BF7E37DE1A651529EB0B0DEB99F6B516F781D91EE0EC9AB3DBFA20D3730C27
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	5A385A854D6865B9B00F32074623037D	15F6A5BA05D10BB03911A7E34D6D7908C0B93A88	494C50987C63601AD3DC9B7F2E26CC34B760DB1AFCE9E61E0751B4206FF727E2
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	7E1183E25CB1CCE2DF4DB7DC1D130B16	E8AD92AD4EFEBC7A3EB2FD5DC3694779CB69DB65	5472D4D6A316CD05AA5D21ABA663E443D198BB16E2493D5C428E27185DB6CA33
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2276	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2276	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	BAE090D23B1C0D4F6DC247F0080D349E	8A7AAD52A54F9A3CCEF3CE323F6BBD5B2B530461	D7D3096317CF32DBEDF75D85390FE89A96170D44C09B2F6D164036064F506AE3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	16AEA08C5F565D15EBF6EE3B9A96E3F6	1A92EE9D3A9A0009392DF3B1DF3C4A666AF998B2	D6081C6CC788A64A9D4C2961D8F1855108C12C243858821B3C0E1866AB3E071C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	881F0FE1E2139F3A857A13D1C7240C78	2407DC1FB7D4FE72CE62A822100FD3C54BF55D12	977A64CEFC182DF226A8A682E9D018006D324BBD5674AA60FE55E0ACEC699D35
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	3B120C22BFC111451C19D3462891E30B	20E145D60CE21A584CA32757CCCD8A2C405419FD	BB07EF8E4E3FF038D279AEEC80FC118E1DBE9A5CA55339DE12DF99DA026B30E0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	433F9F340E79F421F5C2D9BD16FED65C	B064E79C197F5DC7FD6B6A1BB708B8662C62638A	D3D5EE809D181202D11A2C605AAC9E10C36AEEF1DB73F909D50115F15DF3D343
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	3E769EEEF0B509C0A2B37CE5F1F8EF4D	3E9C821AEE67BE7E34FC92E261945506F28BCBDC	9A13BC74193B410073560A991C03C46F8F837668C06A8132190D1D67A21C4946
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	74E0F312D8075A5C7E02C9A1213A5AF1	9DAA7706B0C203EED2D3D9946DCCFD35B55DC7F6	8F139727643F5BC2CFC936CB70EDDEB7C2F09DCB624F53CE3D2C437B3D479A61
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	097BE97F177B6834212581BB1673CED8	91E7B905CBD414DB1B16B0680A23FF5246AE57A4	66DBF3125B308220BD54B608C9377D5A9FDFC06CD0DCF3F62FBB28189E62BF5F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	861734B036B94E15C7FA7C7501D4896D	990EC4B0BB8327C9EFAB29A622A9C497EC71FFB6	A7EA0078AF52BD8EA8EE07945FAFDF0FED31A8343C647A69DAF5A718C120F22E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	8C52119D6C3EA22C1F6330BE61D29DA3	ABFFB632881748182919B630AB58B8ABF2E7D3F1	BC5050F9A7FCC0A966D26E5A6A721D508DCF4DA32FB3641283A16330AE55F51F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	888D62FF705A1D624E29CE4851ED0512	B09FE60A1EB402272D38396B7DF526A1A58F4DB5	91105DB30EC22EC73DEE0292282559FC44107BC8D314ECEA07E6FD6A83270E34
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	9C3D3DADFC5618AF7021D5FE94909CD0	6A30A392A6DA5C326833A27A504F47989A4794C0	9594C1684B74CD2734E603AF3F08050BFF6C300DD3D4B34542EF183F30782B08
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	E1083BEAF4B3F2CDAFAE77CCECE88484	B9BA7DB14A1FCD9881E9E53CAD74951B27CFC9A0	953BF1790AC77F5954CEE8AFC0B5BC1219F78F6465C0DB03F6742A8550CE18F6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	EAC1D3378919778070DEAE3062A2BFE2	2E7DD5FC9E53934A0C77459BE73A24E7CE5D3913	9F538F799724B98968416C7AE40AE5CB054FCA27A903F926ACD3BC8DF4D6ECCC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	1879261C6508613B7D03CBB081B971A1	047CEBE454B669F5712052E9ADFEC75861398206	39E3DC4166B6D63058B0819229DC40D0F0D9C8F72DD708EA69ED9E597FE3A066
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	2437054294D167FF46CE9ED29ACB26E6	E3B663A61A3C028227DDB2771ECB87EC2545967D	8DF944C26D3819296880A0AE921976BD1C008DBF70C11BD215958D787544649A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	8D4604BE9462A40E36E0850EE72F510B	5ED943AA138103AA7E67D7C10C9DFB9328EA9B1E	10B5B1A931E3F58469D594D6F641FDCCC7F98B3A48504B475D5347C156D90372
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	CD29443CE8F60B9AA1E334F106773280	8FAB3116EB499F47F57D6A5B865070FC5729A58E	1E65E799EB5201960930B20DCFD39136C13481D8275B32FDA6FCEA8E81A9EDA4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	1724B547EB478E7FDAAA2FFA424AFDC2	4C61A75EC71689A1F7942919B4E654ABD3B41837	FFFFF97C1A4D45EF0409C97EE12D7B30BF3BC086B3E4DC27D7AB3AC88703D717
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	F8A5E4190113B993F0ACD7D9CA7C7C80	6F1F72B805B640433F99DBB72DDF7D6A627C8DCB	FF8A7F76E552CD8881FFAF953DE2210B0B5C9D48B3A6AF78F9EE6A128DF618A3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	7D9754EC055567444EAEA810CE60CC93	811D0B76CF9AAA3529018A1C702ECBDCD72D042B	1E594A8E1C0ECCC4A7362B92DE020F57606CA9D9E78E2383D2379BC3C852E20F
C:\Users\user\AppData\Local\Temp\MSI32ead.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	B06F3E4E7C1B9CFB7097B82541A2EB50	B237EE4A38980AF9BC9292D5F353A44A6BD52588	E20699CAF028A936827E646686BEA5E6EB2B9C28DCE0FFFBEE167EB43ADAC083
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-23 10-08-45-360.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	76143AA79A1F3C298F23380031167C75	29C4E4A2386FFB8153C07EFC4F9049C61DE884D8	9F18961A3EB5D46F51346A0B8EC3416DB45F7DB8F4CF0408543D6E3DD0281209
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	2DF775050880DF9C5C8378C01936BBC6	53809CA951115AD1651D37519077F7F85F68C563	D4AB12C0867EC6A96DEEBFAC3283298251EE708A0C4C49A663196B93DFE83E2F
C:\Users\user\AppData\Local\Temp\acrocef_low\23e931e4-1314-497e-9299-5284eacfda5c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\5d7f8977-629f-4bbd-8f51-b00ead01fefa.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	E139E6D53A958755742760CD4A4456CB	C259B619917152498BF74F65E11D03B50E4F80F1	542A482DF531973AFE108199E6DF1200DB2590E2E2F7B73C5CD428066EF9138E
C:\Users\user\AppData\Local\Temp\acrocef_low\7c390453-1352-4532-834c-011a673a6750.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\d8df62c2-c0e3-4f14-bcac-47dac7362483.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4

Windows Analysis Report
526142.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report 526142.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
526142.pdf