Windows Analysis Report
W9po7Vc6bl.pdf

Overview

General Information

Sample name:	W9po7Vc6bl.pdf renamed because original name is a hash value
Original sample name:	c4aa1f5bdaeb179eec2ee31af7d8308414fd79925b381e0618498bcc39520b3c.pdf
Analysis ID:	1561659
MD5:	9a9a5b518fde106213bc5c187eda6a7d
SHA1:	b5d35a4c3aa2fdb10d893e154ad8a810d7c3f6fe
SHA256:	c4aa1f5bdaeb179eec2ee31af7d8308414fd79925b381e0618498bcc39520b3c
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: W9po7Vc6bl.pdf	ReversingLabs: Detection: 15%
Source: W9po7Vc6bl.pdf	Virustotal: Detection: 29%			Perma Link

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 23.200.196.138:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.200.196.138 23.200.196.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: classification engine

Classification label: mal48.winPDF@14/53@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-23 21-40-55-345.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: W9po7Vc6bl.pdf	ReversingLabs: Detection: 15%
Source: W9po7Vc6bl.pdf	Virustotal: Detection: 29%

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\W9po7Vc6bl.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1672,i,12757576538781070382,9876864705769082499,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1672,i,12757576538781070382,9876864705769082499,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: W9po7Vc6bl.pdf	Initial sample: PDF keyword /JS count = 0
Source: W9po7Vc6bl.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: W9po7Vc6bl.pdf

Initial sample: PDF keyword stream count = 22

Source: W9po7Vc6bl.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.200.196.138	unknown	United States		2860	NOS_COMUNICACOESPT	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1561659
Product:	CloudBasic
Start time:	03:39:52
Start date:	24.11.2024
Sample:	W9po7Vc6bl.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	9a9a5b518fde106213bc5c187eda6a7d
SHA1:	b5d35a4c3aa2fdb10d893e154ad8a810d7c3f6fe
SHA256:	c4aa1f5bdaeb179eec2ee31af7d8308414fd79925b381e0618498bcc39520b3c
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	72023DDC7732A92D1EF5368A8A252025	7344A02FC42D5850DAFA8CBDC23B7D4F9ADB0F40	3CC16C2D401DE77922804C4DB191C8A08EFB622DAC226AABE03C04FE7DD1BCF7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	72023DDC7732A92D1EF5368A8A252025	7344A02FC42D5850DAFA8CBDC23B7D4F9ADB0F40	3CC16C2D401DE77922804C4DB191C8A08EFB622DAC226AABE03C04FE7DD1BCF7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	953D21362CC5CA251B00CB261F243219	DC7EDE5760DD8C7CEC531825407A1435E40EC039	E368D5EFE7F5196B4F3AA0626710A359F8B8181AD033C6FF5D473FF844D8EF9E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	953D21362CC5CA251B00CB261F243219	DC7EDE5760DD8C7CEC531825407A1435E40EC039	E368D5EFE7F5196B4F3AA0626710A359F8B8181AD033C6FF5D473FF844D8EF9E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5ded88.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b55de4c9-dab2-451c-b457-76a92480ac78.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b7e3d768-9bef-4ab5-b8e7-e6141934011f.tmp	JSON data	19901AC3E296A2C84F7289F7B1083F05	CC2B416D31BD2C615F6AF604E56ED3083DE5D64A	761B9E0EDECF0BF9EC56AD60E6A35D7234C0A6CACC607BFCE80E3B0457B3D1D1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	10145236D51E17759FE53BB013102F37	561DD81787322D6D0E14F44211A9FB0BD16783C6	67EA662B67EA18BBEC49A035EA44C9C87E88B38F9352B218026EB82CD559AD51
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	562699AD5848801A0B557EBFB38EF8DD	3B6FFC8BD2210951E5DF35A870A6EC8B9978F22A	0D0C6EDA2DDF4DD9558636776D72D35FA854D4EC92B8BE844EC4256F78C48DCB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	562699AD5848801A0B557EBFB38EF8DD	3B6FFC8BD2210951E5DF35A870A6EC8B9978F22A	0D0C6EDA2DDF4DD9558636776D72D35FA854D4EC92B8BE844EC4256F78C48DCB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241124024057Z-170.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	42EE8C5B73836444E8D7E4045A26AE06	097EDA88A911571A86555764BA52B8CBCE794E8A	40CDB441F63D6DD929F4E0A551BECC2FC9AA3D48C39092448F87AD38B4E7D73C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	B03B429FEA3E4F99B0E7B6B87FFD9459	55DB31B88B5BBC05DC9D71E4988B283AA1E6EB06	6F3E75F292524ED3C60C4269996F9F107D6DF0A74617CC6277F47679C5FCDCA3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	F5C3C495777865A0A86599BAC1E42270	32C88B8E46F6EA835C865D1ABAAD6BDE0DAAA40C	54B385AF8DC14BA0A852630BD6396E3C13568C47DACB9B6B2E7B1ED34A063AA4
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	E488191B3F4050F6365A127A95803192	21F8CCE8F042A77A22D9F1BC05099185187DC6DC	00F9FDF87A05A0B375DD8E3CB9C1529B728C90EF2CF6075BF4B3BFE31EDE3A94
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	8B306164749143C79131BC59F6A4952C	ED66F8803845331B518F2ABD8E327948A904559F	4ACBCB1871C8E4118E2F6A9850861F97E0C682DCF169E0465CBBB098A1A87593
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7608	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7608	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	758B42992DDFC41CB5E57069C621B54A	D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD	55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	65E25FA7B321933E48CE60985CDE32E6	2CFE2A1B37D8551FC1D63B756F67DE3997D1AD08	BE75A4CF03E48FFC82BAAFC06A70A37FF8B91BD4FCA3F0EC1D1D34E25641E63A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	0B1FE1E1C888FF40EC50F2A8A6C6A9D3	B4D2BAA0F4194768D178B7AB98F8F4D5C48BA573	025AD5B1887A6EDA70DF1A19490435A80B07E2C925CEC607DDD4BEEB6B2F7C0B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	59FD0427EB4184E95CC7678E87AD1F4A	C8D8C5CB3E2FD67358A1CF7A0FE338E372C3B437	963EF82599D10AC550E6291C1F5292BAB5CE7972C71CA4F5439B95E32C338B21
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	0A33B417399D83989460FE5EEED6E313	A20931D7989EABCC0BDE85E2DCEC756B3306D079	BF6572FDDEF4A6CE71E9E6B8D2F84E6D08E089440052EBA3CC94A5B18486D687
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	68B2327D7BB3CFD9BD4758B2527C6080	E5EB2A05133D0B23955C44CB80339244DC418209	0AC3457364DE4A91155DE2C3D22E50C5B9730B7220F522F0FC06A3EDD67917FB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D5197D2FC14FCFC7E81639FA6B95C028	A3700F19AA57BFF222E01CBECB5EFA48B4E8A6A8	B4DA09067F6490F10DB1C2E6F753784E71328E1E1FBAB4EE4717C6A9EB2EB887
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	ED4E3E3800A7F18049165E8847869846	009A6D20489E0E4D85F2049437D9708C0D8391D2	BC0E908FC0611A9F8263F1CA2DE2CC18A949BDD48C289C7ABEF084EB76C524B0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	8678A89684448D2DA02F560167D8C933	A3A197916F18038993D67DA2A53CE0F5175C15AF	84BEFD9007060BBF38A7004554B3431770CFD8EE29B00A64684FFFC0394D8881
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	3BFED4E8744BBB4BC90B60ADD2FF7C22	8B3A82DF9A28B70F8A34901EA139EAB923FBF340	D2B101120F163FB813331A6477DCE9C01322D1FE9120D0F583BAA5ACCA8652A2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	2CB76FC8B097E8B78F92B1D50D454053	9FC1C223EFE33ACEA502018D2ED3BC9BD0EBE325	FBE38C8D22E12EDE7B3C3213A5ABDDD515F56350AAB5D9F654CCE7D7A3090E59
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	70934D026C5C58BFE21014BD7E9E504B	188FAFDB561081A961E10E574209A2A908926507	A36B462C5798D4F59B79670BC2DFE5BBF5C1CEB4F6BBEE29E65DE58AE9476C96
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	FA027DDE9C2BCFC414F3FC7A17E4A0A7	07C4FE514C178243564B39B5DFDB3122DE16C46D	E1723C701ABA4053D3DA78ED03AEFF62942F00BF02E6709997BA23E02AAE1328
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	5121992910F993742E20EB4824A1F8CF	4B4DC9D0FAB33F74A2BB0E32885208D3AA87AFDC	62799F529E908AE20817AD71489D2AF8A3A90863284FBFD82C89895F9ADFBCA8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	566ECF3E343FF5D3D4E6B61015C1A7DA	8B88948D7DF500E179D691978602E6466470949D	380C86B34013A277CDC6836E6A21039360F50E25EA987137CE9F6201A22AD35A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	F6C1D2628FD5F95950E31AC33061B275	F2EE37686BC96537391F925A7B105AF26A36E7E4	CA7C8B50CED83B89E4D592D72CE83D041808532ABB881CBEC9BFC64539A9A665
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	A949FE5AD1FB8CA47381F60AADF8EC6D	346527D7897BC99EDE99273B6E121C1C9EC4F4CC	C3152FE3EFD1225213F08662034F1CC85A4C9014495A08AEA7FE45297541BE64
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	DC658A9BDD34E2A1CC17B1121471E58B	765FFA56116F948C1510EC7B8A2E975DE9FE21C8	38C911E540B7ADAC3D3145961B0E9316FC752B4FDB1667DE628167D2624F5157
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	62187BCA5D05E1D3F097FA7D92023040	86B1496C014F59E9415982F780DABBB2AC492C93	16E7488FFF486589C6F4E8684BC34826692C279009EC99DCCDDA9936D564451C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	F65EBCB846A9105510CB0B8B2EA7CB71	C8F9DB8C82715FA9839AF93DE3763FF26B8E2C32	26D2ECE6CE957E69DC434F52028F6BB7F61830774879F082C43C0B2F49382FCF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	972195BBEB12DE78B676114BE414C28F	540049ACCBB1031F81BF145AB8788B1EDB2DA711	79F0338ABD9E7411C62104E688E25EABEBDAB016665BA2C9E36E71F6FCC03290
C:\Users\user\AppData\Local\Temp\MSId3ad2.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	1230F3C95BAA325BE7A475ECBF2C0577	4945F66938A0A10BE957F46E5C86539BFC63DB1B	980DB4FED15577847FFB8907C04F3804FC4AE8ED8BE26B768290E88F5460CF10
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-23 21-40-55-345.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	408D574087B8B7412BD628EA4BF792FC	9DC72F07CBF16E4A6A28B98E8FCA88408BDF1C26	684FAF38FBB62C1A0A52E78F0AB823F9D1134C174A2ECDAD765FAD0C86DFE766
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	383E5AC1F53BC110C92797237690C338	3DED58A504DAF6E72B534A3CC09E04B92487BC59	AA7AA44B6FB13650FB435D0B7210D0B1117B5E77CBB63B39B17DA6CE0BD1AE27
C:\Users\user\AppData\Local\Temp\acrocef_low\13ec3b08-cdeb-4547-ae7e-98147e2cd11b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\8bac7c5f-e68d-42a9-b8b1-edd76cc64df8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	13F55292D0735B9ABD4259B225D210FC	810CC5D545BFA11D2825F6E1DFA69176794DA7EC	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
C:\Users\user\AppData\Local\Temp\acrocef_low\ab42e746-ea0b-4de2-9733-eec2374a1218.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\c9c6def6-ebc8-41ac-b829-8de5a93e876a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
W9po7Vc6bl.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report W9po7Vc6bl.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
W9po7Vc6bl.pdf