Windows Analysis Report
CP_364539955_120008407885_20241125214538.pdf

Overview

General Information

Sample name:	CP_364539955_120008407885_20241125214538.pdf
Analysis ID:	1562728
MD5:	b92f373d0afcb9fd6202764e66d0797f
SHA1:	38660ac0303e150a4ca045d302cd744a6c2d4441
SHA256:	2536a428d0328bba24034e33d42f78ed104ef73bd500d7e8d26d5e7b69167661

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49707

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: classification engine

Classification label: clean1.winPDF@15/41@3/61

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 17-37-07-223.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CP_364539955_120008407885_20241125214538.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1624 --field-trial-handle=1588,i,10714921631825781532,2246996546830277587,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1624 --field-trial-handle=1588,i,10714921631825781532,2246996546830277587,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CP_364539955_120008407885_20241125214538.pdf	Initial sample: PDF keyword /JS count = 0
Source: CP_364539955_120008407885_20241125214538.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: CP_364539955_120008407885_20241125214538.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
217.20.59.37	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Denmark	15516	DK-DANSKKABELTVDK	false
23.218.208.137	unknown	United States	6453	AS6453US	false
23.200.196.138	unknown	United States	2860	NOS_COMUNICACOESPT	false
23.195.39.65	unknown	United States	20940	AKAMAI-ASN1EU	false
107.22.247.231	unknown	United States	14618	AMAZON-AESUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.59.37	true
x1.i.lencr.org	unknown	unknown

ID:	1562728
Product:	CloudBasic
Start time:	23:36:36
Start date:	25.11.2024
Sample:	CP_364539955_120008407885_20241125214538.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	b92f373d0afcb9fd6202764e66d0797f
SHA1:	38660ac0303e150a4ca045d302cd744a6c2d4441
SHA256:	2536a428d0328bba24034e33d42f78ed104ef73bd500d7e8d26d5e7b69167661
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	AC1720122DB4EF567276206CC4930DF1	4D91D955C03B54F8F4A3AD8692E34D7EDF02862D	00A90FCB6DD232EEA00BD3F99DE74DC35D04CA47F8083DEC395BFE9688EBF284
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	394BCA0DA330CC8F061EC972F679A683	1C7D83F5B71B3EACEF25DF4172C644BF1A39B7B8	67AAF95A88FE3651F3BD7B736E2A9B242BB9BDB7390366B813763707FDCB149C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\888149a3-a912-4395-afb9-da26b79f6461.tmp	JSON data	12ADB1232423CC01A89F16A7A55F2FF4	64473401B59CC510032C6D561C004048FE3D70A9	69053F9246DF159178935D7AC21C8F39E138849FD736DF591ED1A796CDAD9E8D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	12ADB1232423CC01A89F16A7A55F2FF4	64473401B59CC510032C6D561C004048FE3D70A9	69053F9246DF159178935D7AC21C8F39E138849FD736DF591ED1A796CDAD9E8D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	932E754C1E9BDE4FA3239C437554305F	12A7071FDFAA525FE1AD5DEAE9C7E62CC8433C01	137DC283E446DCFE5D46560A5FAACC15869E0160B0ABE4D11689CFCF5DE11E66
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	F1D260159DA6C41C820E5C9D79275F9E	9886B46E50A9B31F763C409A380014C4777F1E21	8599E15021EB6E248F71487D68ADCB440AE03C7E0AE6A35CE366E22580A7BD42
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241125223709Z-162.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	27F9CC70EC187D52288F5D64EA1774CB	D8FA46300FB0E74799B42EF303A1BCCB8894284F	24DEBA8CF58B01A6D6C81B9A79C977533C972FAE31FC5F460FC4BE3977930102
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	0C7D28326B2E1246E9FDAC2391F11BE1	B7D83524CC7FBFAC64FAA9AB651355420CBEE718	8BD64E0EACC2624A74DF2502813185B97A405CFEEB444C57B2B703D923968644
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	31D17B620C7BDB1878539AA3225C4E90	6B03A16D20329296D592E92E19596C76DEC9AA91	4E8A264D607E1AD5AC935E9E9AB17F62833579CA670BB1EFF703F7F1C19A089D
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	6ED0CC32EFC55784A616140961039B78	8BFF79FA364193E90349A847FA89C5108F359F2B	96DF4145C91A2157807B9809AE5DBD6FAD7AF8767D3E463F8320B3C3D52F2B84
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	1D81124015D7A1BCD40BC3C339FF7AE5	F9EB949D8653A334B2AEF4252098C65AE78D508F	3EAD41C7908C3DFDD36946B563CF9A0149EDCB665234C0F019A8516C2B4D7A17
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	8AD257804B69102E84BC0F8DF37C052D	EC5E708323CF0F76A4AAEE97305AA7991487B3DB	94BA2529A17298A34CB389E35BCD7D29AD11896D95E2F39A3440B8AE9A643F93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	7DB73A719829A5FC7D58C9A30ABA6604	048DAFB642EB973562FD80E311037E4EEB122B19	336182F6F9594FD433444DDC4F1A8A810C76640799A0F1AE3AB360BD192BF9C8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	A411F809A9F12641377BBC9DD5358908	FE2C58EED8A65934985B553761B362A1A31D99F7	AC3284FC069F8BEBBED509174C5A50B791676983F13D63705B3393B685893A6B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	31FFCE48DD67C9365EA6A1AD751D5CB2	1709FEAED7CAAE1E9491B68F3E78C0D5CC0A19B4	2620BEE898122B92259EBC6A031AB6B6DF6F861E65E2D298942DEF7FCECD834E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	56773199AA9C99A47BD2EF1C43F0808C	1767A18CE2B7CCB1A41766CDB292732B785B1657	9C71280BA5E8861EB00B46F221AD6A8309A44E3A67E71C40926525DC9D3F8149
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	E7167BA38E70C4DAE9E510E71EB026C5	EC8C728E4D7D9E9B6324055B3491BF265E951B2E	42D770B48293C5F0C0BF2EC4C1E0232D58A70FF7ABDFCD62260E79E2FA392165
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	FF799733A6BCCEDA6282F5B351FC40F0	B6871D2F83609CEB78726CB0F97AA28AAC1291B7	99933A559111644C920E938F41360C6A75137C9E94C357AC746B90CFAAF8485A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	16AA24030C2E00369936E9DFA06A8994	B858AD572D97B422DD10C17A8DAD234EC944FEFC	A2B73E6E69583BA1E4BB3EDFFD0CA84354F9A5DD0A7B04EC84A836CE6B64B021
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	7279D7D2B20271C577BBFB2DAADD8956	C7B18E76404DC18B041DE6D86EBD08567D9399A4	E0B7AD7393D4C2F65FB2C648F8D27B2C6AE0AD8569516837D4422D458E4879BB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	70DCF1FE45A0E86C91DEDDD03C49B8C3	E67B12E8489D68ED621EA61429F0FEAB5A5206A7	E412B4F18038D5F724FF7A1AE2B7E4B14DBBCFAF67920C4F2D04D0298828A506
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	04E8A30A86E8AE84BFA91C97FFEBB875	9B53DD0C6B003541F1851A9A8DAC53F9710979A6	1535F9381F58A6713FDC0E40F839DCB74BF8C2D09E55FD74918FBFF97EF8660E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	8DACBF3689ACBA21652D1F9770A95393	579ACD75D9C3E8DE93CF7E01CEF2C064E82A7B53	1ECB87DE7E765185DCE4B8A5F06C66459FBAC6760EFF12479C9F72ED0344DFD7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	6B9A750DB13E0F67366FFA5AE527EB6A	DFC023D6CA45782C9264ED94312857E2648EAF19	D82F7095D9EA54690F911DC588F0C9ACF988EC89FF54F8FF9C68ACDB5955AC64
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	B7D3775CEBD3243A01C80B7C72E31113	622F6A41DF22128E9A975CE40FAC445C6B95D15A	A705897A7AFBA8D542198C7112AD28A25AF06452438DDF0CE2945E2AA743FB24
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	E99F6AFA57A0C31B1554FE11E8DF6891	76434319B61328FB22118C7123410845E1010BC5	4C18D00AAE9E845B17AC2C33A9D890A74CD32D1011C10FFB7312705ECAF6BE37
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	0575C5C0F1E638858EB551C54C4DD9DB	365ABA82205A0EA36D93717254D5F17038E64D83	5AD22C1ACBA95264F69E462AF4B7C4DF8A093702E168BD86338A0AA6B39E3FA2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	55F18FB515F07241F5E0D83BD337715F	C02587D45F2FEC5C169CF9389C5C4AC896667378	A1EBA97BCF40FB0FE58F41BCB16BAFF47077FAAF1AE4E61DFFFB4A30FDCD7668
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	49A98B8385BEB9BAF3F3F90AF89FF1AB	BA958F049BB4B3824D47CDB265C4908C4B64FD84	BA0C811E88FA2A1FF135580270BC840D8723BC05F700C022CB4769B0E3B99A1B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	237C743AFB5351993E13F5DC4F365830	88EE18DFA6869C720E7B01EC689211D73FBF1ED3	DFC69A58C8501A004628432B4D8EF0854A0DB6D89F903C379CCFEB45DF4140F4
C:\Users\user\AppData\Local\Temp\MSIe4791.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	0C0AD3B2F25AE872B5DE52013817828B	C3C5AD5E4B8AED4A40F03A6DCC2A98E7F9A1862A	B547080FA0945381E152860DB577E95C8B0187838EB2936EE71169CF1E32A464
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 17-37-07-223.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	B553AFCF67067857268EE37003FF127E	5AEBD2FAFB1FB009FA10286FA72734AE2B1ABDCF	86652054F8261059B92DA61598BB03C5A9A77218AFEDB0C6B71541FA5E8BB366
C:\Users\user\AppData\Local\Temp\acrocef_low\41ed017e-9d61-4567-9b33-1bfbbbb2cdc9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	E8C0E02FD4DCB83BF3EC95A987292D88	B2FC5004CA22C6EE65B66AD6AF29F7EDC745A3B4	C665BF4A480724AE9C6ECB6450C3AC538DF2102B7988E25675516772687222B5
C:\Users\user\AppData\Local\Temp\acrocef_low\75074d42-d18d-440b-8062-0774249e7c4c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Local\Temp\acrocef_low\cd75b178-deef-4692-b58f-4cd38e9acb90.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\e054e2db-07bf-4c63-8360-0c9c9d6b65c0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
CP_364539955_120008407885_20241125214538.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report CP_364539955_120008407885_20241125214538.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
CP_364539955_120008407885_20241125214538.pdf