Windows Analysis Report
Excellence in Digital Banking & Product Development- International Summit 2025.pdf

ID:	1571441
Product:	CloudBasic
Start time:	11:48:15
Start date:	09.12.2024
Sample:	Excellence in Digital Banking & Product Development- International Summit 2025.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	38dbb5060226bc9040432914b04f1217
SHA1:	5f0bfb5eeaa2f20bfda31d3624fc700f1c864266
SHA256:	ee6b50340c51e45708c10e8ff5259d3a9b129eb9ae7546093adb727db67e1828
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	93777049CD434C89C61C6B93E7E310C2	C7209924FE1008F7B1B27F2FB7CBB355C15B6295	3FF3D29ABB9BDDAC2941229BBA578AAA87FA40FBCF0F1985EEC339E42ED51112
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	D169309CBD59E7E4B566584D04385AFD	46216980DF1D1BE2B797489E8827B6C5252535EB	8292DECA21C4B693B33A0776F38BF84BD2F6D238BB3D990656E9A8D674EC5489
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\343691f4-c07e-4c27-a245-e62e1cd8587c.tmp	JSON data	C0DCCFF09CD22A3484112B5F7F1D9AB3	314C2538F862F33F3B8298275BB42823D93ED9E8	A3CBDF0EFE888BF17C56A8889137A806464137AB4114962B4EB26AC0F81AF00F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	C0DCCFF09CD22A3484112B5F7F1D9AB3	314C2538F862F33F3B8298275BB42823D93ED9E8	A3CBDF0EFE888BF17C56A8889137A806464137AB4114962B4EB26AC0F81AF00F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	AC47D93E5A8F30A1D45D0C289AAADAAB	5A6CEC6A7D512EE395AFCD915E7D88B6D84AC434	2A464C92AF9A64D5479AA721AC8B55A568CC250B3E57FDF57328C811F5F25A39
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	DCEEC3C1DBD161E952ED2E65EDB1A12B	0D67C575E88695EA903EBEE87836A78285253CC2	CA27C539B2820C4D8F811769739AF007DD9643886BFB11804354A3BBA413ABD7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241209104905Z-182.bmp	PC bitmap, Windows 3.x format, 164 x -102 x 32, cbSize 66966, bits offset 54	FE7052A77A9F461CC46FF4FAC284E1B7	BE4030E82CBAE57ABA732A00E067B4B569D1F50E	E7AC5BC695561FD5A2DBF4EFA86124E68E60B2D7F558E5824A7BC6415998A92A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	FE56294EE8FFFED3C3B21CAE7476641C	DD38F960397A4290FC907F209BB26EAFC78838E4	DA30F907B5EEB564A42F0D2D8105722EC0D713D1AFB8885962670E7EE1CAED0D
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	1CD347D596F1DBD148178F59B003FD9A	9B6B29D08164CEC3B4FBBE10EA91A0F4CD3E9D12	25ED2A55F397A2D0FE11F803B8C9E9E1579D11B7F3BD843A558A390174F33C7A
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	DF13B1E94805B2732FD37F9B707602DE	4197313734698B791A1577BB7AB1FF6E64BEF9DD	1881BEEC2C4D12FC101A2C8D2D70E2B671F0F83EF20AA491FF84992D61800BEA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	8C328E7214ECB5F8E3428BCE82DAD16D	C3B5816EF0FDC4DF2F0F0B32C9CFBD4819A8E543	A012BF7225E888718010439D29F6F770BE2FC5C9868056F26D78BFD2A52D99BA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	1CAA9C13493DBA3D59977C62F90FA83C	F3F0E19D20AF95644D1381C88DC4FA1E138F72E9	DBF52705DE95F7FEBF20A567BB54853FD995FE44C52A88B0BFFE5945FDA72987
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	71071993F102EA5F1C61B81142181D4F	67100276AACA74C60580131A3BC899CE3A08D445	70E750C146AC79529FA9813552B795906F2C2447EE27558BE198D6730896D1C9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	ABAB633772A35362DF6537828D5D04D7	9BBCAE0141B27E9E9BCE81E0CA30800AE271487A	5FD820DAD42208328EE57E1D4275BD0666992067C5B51D63D160736D27BD5242
C:\Users\user\AppData\Local\Temp\MSIe4921.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	8D0AF31B0D6F91B71E823C39312B86B2	3EF80365C658E5AA869A28D3476F09FB79744200	0BF25AB907B159CD895C728F4FFE5EAC52B3FE4E91CDB6CC832A2E1E018D47E1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-09 05-49-04-048.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	388C1B658339E65B5D30DBAA1FA9ED98	E3109419235617610F1E8C4D5E1BE845B9154539	7CF25C6420D910C9F45BBFF80BE8B53215C8B9156B6514EC129F758B071F9D0C
C:\Users\user\AppData\Local\Temp\acrocef_low\04b487f6-4ea2-44e1-b1d8-7066a80e340a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\3d0c6d7a-4757-410b-8fd9-8da20a626bd8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	BE0B75D7B096B44CBB2A7F9140209151	FCE18CAA51DF1C9E5FA036FF1D1267212A48AAC2	A571984DB01CF39DA8A828152CDEC864004CB56158C4BF6DFC2888A32A54B0E9
C:\Users\user\AppData\Local\Temp\acrocef_low\8d918156-2e8f-4904-81f3-4ed3927630ad.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\be5649ab-e552-438a-a2f6-13bdc6852174.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Software Vulnerabilities

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443

Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.16:49707 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.16:49707

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

System Summary

Source: classification engine

Classification label: clean1.winPDF@17/26@1/64

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-09 05-49-04-048.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Excellence in Digital Banking & Product Development- International Summit 2025.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1680 --field-trial-handle=1540,i,13588921467431034322,956796405548050646,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 8F745F3655241E055FFB5190446DC213
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1680 --field-trial-handle=1540,i,13588921467431034322,956796405548050646,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Excellence in Digital Banking & Product Development- International Summit 2025.pdf	Initial sample: PDF keyword /JS count = 0
Source: Excellence in Digital Banking & Product Development- International Summit 2025.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Excellence in Digital Banking & Product Development- International Summit 2025.pdf

Initial sample: PDF keyword stream count = 216

Source: Excellence in Digital Banking & Product Development- International Summit 2025.pdf

Initial sample: PDF keyword /AcroForm count = 2

Source: Excellence in Digital Banking & Product Development- International Summit 2025.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Excellence in Digital Banking & Product Development- International Summit 2025.pdf

Initial sample: PDF keyword /ObjStm count = 10

Source: Excellence in Digital Banking & Product Development- International Summit 2025.pdf

Initial sample: PDF keyword endobj count = 235

Source: Excellence in Digital Banking & Product Development- International Summit 2025.pdf

Initial sample: PDF keyword endstream count = 216

Source: Excellence in Digital Banking & Product Development- International Summit 2025.pdf

Initial sample: PDF keyword obj count = 235

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation