Windows Analysis Report
whatever.pdf

Overview

General Information

Sample name:	whatever.pdf
Analysis ID:	1562729
MD5:	49000a69db20e7941f2920dc1cbc5112
SHA1:	a649cceb446ff91519c12e9ad822ac614fe25847
SHA256:	2291425fa2c209b2841477887048721d207ece76b1527d763b55acc7cf01251b
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 23.195.76.153:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 23.195.76.153:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.195.76.153 23.195.76.153

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.76.153
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443

Source: classification engine

Classification label: clean2.winPDF@15/53@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 17-41-02-958.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\whatever.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1500,i,12905710345105868703,1686702495363007112,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1500,i,12905710345105868703,1686702495363007112,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: whatever.pdf	Initial sample: PDF keyword /JS count = 0
Source: whatever.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: whatever.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.195.76.153	unknown	United States		2914	NTT-COMMUNICATIONS-2914US	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
x1.i.lencr.org	unknown	unknown

ID:	1562729
Product:	CloudBasic
Start time:	23:40:08
Start date:	25.11.2024
Sample:	whatever.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	49000a69db20e7941f2920dc1cbc5112
SHA1:	a649cceb446ff91519c12e9ad822ac614fe25847
SHA256:	2291425fa2c209b2841477887048721d207ece76b1527d763b55acc7cf01251b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	08FC691601FF5036BA1A86322E8AA51F	55E6CD1C2425A368EC1070DDD00A55C49F004EC9	CF6A6235A1A786FEEA0A4A0B4D8CD757DCE5BA6C81B9540933DB6398A8C751D8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	08FC691601FF5036BA1A86322E8AA51F	55E6CD1C2425A368EC1070DDD00A55C49F004EC9	CF6A6235A1A786FEEA0A4A0B4D8CD757DCE5BA6C81B9540933DB6398A8C751D8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	95CB02BCF38DBB3832C07F642EAA8E1E	92B79905D3FE84AC667507620CEE166D218D0D45	F01ECABDEE89DEFE24D27870BFFEDE1A50262D66AE4D205E53465B057C7CF13F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	95CB02BCF38DBB3832C07F642EAA8E1E	92B79905D3FE84AC667507620CEE166D218D0D45	F01ECABDEE89DEFE24D27870BFFEDE1A50262D66AE4D205E53465B057C7CF13F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\576d58f6-76b7-4b2f-800e-733b6f544198.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3cdea4.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e0e617d5-46a5-420b-9ffa-db3dd906d64f.tmp	JSON data	554E819780E7AD02A7232829476714FC	BFCD9E24CF35E8520087EFDB7CC7C3BD809CD345	033EEC8D458A70BFBF7B9D6CD5A1BE1657A1EFC058BA3B8D2476592FFC5E3BD6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	EF49B7D4081B12589B2D978A41678230	2C1ED4229EDDD9CBCA61FCF7ECC6810E8894049A	39D4996A31054841E1DF672172023CF4A24C84B74BA73306D6909EBAA3171083
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	E3B911D03098EA2DF0996ED459A2E61B	A1705336EE3D569AB3A5832B3C8D03A3049143DE	52840193AC6102779B8C3FBFFA1D28A140CCD20F22A73184A78D03B62E78B7B3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	E3B911D03098EA2DF0996ED459A2E61B	A1705336EE3D569AB3A5832B3C8D03A3049143DE	52840193AC6102779B8C3FBFFA1D28A140CCD20F22A73184A78D03B62E78B7B3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241125224105Z-151.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	15657DF5CD901634F5172FBFA68562BB	95F5596CB44A10AD597F7BBE5A8703FBD96D0CFF	038F361ED5955E9685A224342C8B73E43DB5708E49953CB0EFC205F0ABE6A065
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	62E62CAA4AAAFC4E3E08A5378E119172	BCC9F38A341E356E6064444692FD71A01E14887A	6A3146843D60E55D30CCCA64115121B84AD32E5B9CD5A5AB1BA8E632D5510AD0
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	EE98D8BD602614D81BE1E657AFC0C336	523E82D2D7036B83DFCB27D292D75A4CB4A3F1AC	8DAA4C8EAE49ED9059BC7620C2D9BA2A5B36E97D2CBED599ED6613BFC59A9C01
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	379E9582B695F4CF5878CFA1D3E910A5	0ABF91033F38AE8047FA5B26AD5D205113B7556A	C0048275FBF435D6F0027FCC76BECCB7B5A73168DE5E766DDE87CF80379BECBF
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	86A3F7437146F24A95E70D354150CD1F	161287FA51CFE1D55FA3C6EB1F648F63E29A8856	036D3646DA4A6B30461A5B780CCD9CDCC31C46ACDF6B78132C61157983A6089D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4956	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4956	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	85D263103403DA40239B8FCF848201D0	BAB9556AAC883917B1441A593C72B0AC4251BBAA	F0B0A2ABDFC960D10433C90CFFBE536D625F2AC0E00B2A08D52A1540F402CAD6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	773A74E4A8C858B9F2F2F9F8E70A6BCF	3F2A5D05DBEB3B7987A11DBA59EC8A5956BA2C9B	A4D753318FE2AAB9E14440F3BA9A7432116F6B6B970D98E2CA9D4B779EC1648E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	3F2673D726E1CE3C94373B50276ADD7D	D5F12E3540D8355FAE81916F4FB42A2A8E40D439	60EABA6873F30C7D1FE961FA82C6D25018A01CA1974ED1A534027564EEE8AFA5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	6E911DAB548FAEB64450B8909EE7EDFD	FBD250B25954B3E15BAFE0173FFF995B802BDEA7	20937EFC18A50D682147F9B8CF9AA5A001CF2CB869B4EEC896CA5E4D97EAC946
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	221DAFAB1CDBEE8E557053489290A77C	1F8E79C5259B462E43CE9358D92629ABF8CF2F48	943222CAE461E2B907EC2D30E35EBBDC2888C863D4676BCAC8B57C8DE4D38A34
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	FB22E024EF42FC6107A52770FA33C9A3	5A9AF955A314A2B75011368E22450EC55CAD726F	763B007A5035BF3870D361DC0D7403C35222BABA296A850496F28CEB5F82C878
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	2D010DDD67E1576904BA0B35E4A275E8	FB60172C002136DC7A2A3C8E0A6D735688CEEDD2	0BAB87F8D5F1C5A4B980075F61BAF186F4D6AB11C1F5C1253D6129F7703E9755
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	CD4618DA11FC24996FCAED7D118CFC4C	E89624AA039F7AAEABE28C1A403BF7D653AC8936	2756B5BE57A2F18995B83C5345FC896E30FD0AD54437B39A7046951C111366C0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	4CB7A7B6A546A22C07BAC2872555C956	ABC7030D2E558716D7C9C24B3357026D257007EC	19A2532AEB88198E4BC5BADD4AAF32B8CB638B191D28CBA8A0C2937AB573B1A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	CA92F0B855F4FD7AB19579A7F10F2213	DC9947CD78B0335CE6C878BDEF20CAB6D8F4BBDD	622778417E1FEFAB8BE7102BDE714CB280901D846E1C01B7145AFA9CC683F9D9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	80769CF534FA433D6ECF606F2E4D19B9	C74BC0FD3F4255DF55C87F4A4253C9BA318BCAAA	7C6A1D8ABD5BBBB932ED37BEC36022B096FFAF3F7192903F5852EB3E0F3D46D4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	FED0444CC831FE8B12E85406A3BF0EE0	4D2BE4A982897B1445AB954E238E29B64E5116CC	8014DF327E2E1BBD68C8F26A13FFC1718B005527A178026549F6A812061CAE6A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	DAE8F07D1CB939EE3AF3AB8DC4FCDA99	CE5318D532E39E9FF6430ED51F73B1C28BB999E8	FE5CB62D5EDCFD79FACEE6DF1B40588AF9A8C965C375AD381CB42D61899EAA0F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	32C9D3E95961AEBC4FB7756D168DBAE6	5EB0C10E908D5F613366ED5DF1EA21E78BC77AB7	844911ABD285DCFB66AEF6945EF084FBABFBCDE0A3D753FDEF1333CD882119E2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	0828981CB7300CBCF83B3AE77E5E0787	329CB4D17E32C85BA7638C7D144AD9AA48C2F8FD	57D385039CE04DA17877FF34BEC432A1832DEEB65B705D84EC2B1FB5B5FCA37B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	E13CD40B907B8ADEC0D8C31C558CBB4E	979B4C7F97A3A4795CCC4070BB5DC11E9D985660	6176A287356F04886ADF5B2298B3DA094440B97C4C64990CE5B5DABE1B57EFFE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	DE09691ED0ECD6ED6EDB9D33CEFC63FA	CA716E9B2548B5C5EBC066F3CF6A16DDF54B9F52	83632E79CFB37BC98E14CC8A49FBCDDBA0760EE61ACD1D7245490A11B10A43A5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	184EBC29C7477A57D62BEC77BEF74CB8	580396D11CD25182B45D940DA1A390908A1AB838	62D0ED8A0AA3A0B351C36E817004A2947D1EAE4630F613D37C762ECCD32915C3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	9D74A38E382A476BA68E700FBE82C227	95DA4AE1C71FF5F35F25955DD2A6D37FABA8C1B0	B8A86906EE23B7C3A92B4B400DBDE42652A774F3CA7D8EC73243A08E1F0B87A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	428B5ACF7A6A084E60952A578FB67DBA	3661C8664AA78DA51942FFF34F546972D26DAD4F	9B9D77810810B31D25ED6E06774F10B1C8C981269E0F0C62941C7A7D6B464C52
C:\Users\user\AppData\Local\Temp\MSIc9ff5.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	03186069B1FA81460777B97829EAD199	F069814528630DB67D85DBA74663D115B0678C73	09B610A8A67F29001DA0A8FE4D0860411730A2EA679EE572E0A245BD680117F6
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 17-41-02-958.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	7F5C9323220D66A8A04B6A3D3868A9F0	982D2F35A60D93672BF7BFDC3401954738980304	E47D7D5D61C842D307AF107CEEA9C674065A3CFB43571D9027A06F46AB664604
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	4CDFE410861EDC0DC167C97647840D15	342F073CB6EA11744D941B6E6D87D95BC26E3076	F0F413555AC9A082D4706CBEBB18248D94C9F414C9F80E89FF2643A58A8DDA3D
C:\Users\user\AppData\Local\Temp\acrocef_low\00298d50-be2b-481f-bc31-0ccca799ce81.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\631d9690-e338-4ec3-9aef-03636d549d1e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\c9cb1629-d1fa-4763-8322-0e028e0b4c08.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\ef1d79dd-2b2c-4ecf-9b5c-a2fd48c8641c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
whatever.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report whatever.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
whatever.pdf