Windows Analysis Report
RX890.pdf

Overview

General Information

Sample name:	RX890.pdf
Analysis ID:	1592381
MD5:	34587d25868ad356afac608c6b7da5ab
SHA1:	cb964622cdc1dc35c8cc0c1a8bb8b96f10d99929
SHA256:	0018078242b1bf6fdf8147cdc0a7f099ca8e6d8fb4b735e370e3e39981808b54

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.217.172.185:443
Source: global traffic	TCP traffic: 23.217.172.185:443 -> 192.168.2.16:49712

Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: classification engine

Classification label: clean1.winPDF@15/41@3/64

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 20-34-49-564.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\RX890.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1592 --field-trial-handle=1340,i,15006123155217655051,15495931205750220234,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1592 --field-trial-handle=1340,i,15006123155217655051,15495931205750220234,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: RX890.pdf	Initial sample: PDF keyword /JS count = 0
Source: RX890.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: RX890.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.209.209.135	unknown	United States	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
23.217.172.185	unknown	United States	16625	AKAMAI-ASUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
199.232.214.172	unknown	United States	54113	FASTLYUS	false
3.233.129.217	unknown	United States	14618	AMAZON-AESUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
x1.i.lencr.org	unknown	unknown

ID:	1592381
Product:	CloudBasic
Start time:	02:34:17
Start date:	16.01.2025
Sample:	RX890.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	34587d25868ad356afac608c6b7da5ab
SHA1:	cb964622cdc1dc35c8cc0c1a8bb8b96f10d99929
SHA256:	0018078242b1bf6fdf8147cdc0a7f099ca8e6d8fb4b735e370e3e39981808b54
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4013391EBC4368EDC8295E48B91C67ED	4C09D6204CAC28A3B645A433F272AD875619BA51	F37195CBE43492E433DD1CA446025655BB54A4D7A23FF031715404C40EE15EAB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	DF9959CBE26B0C9087007F3EC821A558	6C035C9B1DBDDB1F8417418DA34BBB870F91410D	69174A7B8131D4208A9C00CF9A12BBE20F41679FF794694AB5376A000A8F217A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\25f7d7c2-3586-49be-8269-7be08be816c0.tmp	JSON data	78EFB82C8A8F7270E3AEC0A70D76C75D	BFB03254B25145E04D2DD09A8D7CD0AF7455678C	C405C3B345EFBCFEABC789B29D8EFDCAD53A4DBA9E817AE1D196D80CB7855E70
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF591aab.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fcfaaf47-4d3f-406d-af66-50a7b22c4d9f.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	6D608B09030B13897E68EEFCF6F093FB	89F52CE15C4E0E69421DCDB1461A3EC3FF2444F1	6EB35E3FBBB1F29AC18B05C3187FB9A415A16DBC06400096FF4912FBC7F14717
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	BF347E6CA1F093AC497F3734895719EE	34B13271C22DDDC51294EF573B0C00C1D2649A9D	74099FC6314A10700FD1670D63B06CDCD442201ED55C528137A5E5FD36C08303
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250116013451Z-162.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	8AC94DAF4F5241A7A3F0099B3AE5BB24	0B7FE83B4835E711D73656F42533EF0AB053E534	C09D2DA5E22855ACE01778141E85F30D41C652372E0F8CF2F656D0C524AB3E1A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	E242E17C89E629F742DF4DE4CDE79E85	28E449DFDC95A11997137A2C37F0BB3D001A4DD5	0F544C2CDDC57387B9D47F4AC12F1767F3340BF86A6CF1E571782F6613FE8912
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	D989051B99CDEF0E7FBB75958E442833	BD7F094F8BEDF50B470A62CAB47939D6A10F0905	2E4245B26C16816537B681D139191E04205254D4EEAC8D8C76F335B4C5E5F96D
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	5CCB67E39D784C9DE726B1FC8FE9A68F	F5F461606C7B6B426101DF8C4F02550395B63072	965A8AEC989173FA54FC05A75F9ADA5E089D2340DED7C8AC5570CF608976DD8F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	5BC42300220AB51E892F3F512F69FE70	36C08F21FF5456389C873F3C3263D61B711AF1C8	A4FF467E5E22F81B47C40F7155F67131C9A666B049D56E29BA3FC4D152E5C6DE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	651985C36741D41DFBA503E6BC0901DA	DD68FF91A34F30E8560F2B497367B7EAD7C25A95	662D8E21EAF874FCC3653935A9D009304BFA36D6DBF026AC0BE7FF83AC0BDB4A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	8FF0CBBF23C568CA7FB35C8AC05D61B9	C4614CF89EA1F4E125F51E3D98B5441E360DDCCF	20D6D8DF676C810DC10DC2C2A84CFCD6C209227D5FAFD816F187CA91BBC65F81
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	60929943AB746E787FF4E7E5B5EBB1C9	B24547A75EC301F8EBC21DC05285A78775BE2599	87E6A2F8F56FEC7F9692A50D7C7B1F54D12A439089D1A8E5D3E6350AB2828F15
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	CFD6BD6615A5D185A8586308D103DE03	B59EDB1338B0C40722A168509393BAF2B07B5438	A5F9D25229918E1B9440A7F816EAC64F7713151362177DED73504679A9023EA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	AF3A821E97929ABC2B2133175FFF7301	749B8EC57CE587E74505CBFD1D1FB401FC915B7B	B6E37C60EA68DE44EA6E2F40D711DB12447AC50EB2784AF39057EBB0D946F1EB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	00A6408CB3A129830ABCC32E84123D90	B4E522A9FDAB328BCB10C991028F351B114EE8DE	2684D65DC53B11D83532E8FB02AC192B380A9FE5500D6EF2BE99E03E3BC2F396
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	D672DA8E21727E9F724EBB3878D770B8	1BF73E0E85D5A389A20700081BB3DCDEE73CF8CD	B053CB8B81BF411A6A19C58103463D7E0C2ACB9B7D597A692F037307014008F0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	58B5C3CBE62FB95D531DFC985317EC30	2D0BAC9118DCD33ADC99B36E9ECA0AC942E1C12F	E65840DCF5C65BADEEE5FDF5017D16483AC323E5EB96868911248A9D82E437A5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	DAACE697B5E15F689251D3F1AE4BDC0D	847D8FBF2D8DF0155E54D82DF91438AD8868C4B3	8BF31C32EB582E2EF340F3478AB8E5763A399B6B836532ADAE0A2737C2E4A713
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	82FDDA5FD81D7D8EDFDDA90F9B855B2D	7F9299274AAF5647EAD3C8A289FDB3ED569E6464	54E959AB32D7D720E2AC6DF8E072A59C9E6C1CAB63FA984CDFDE6D777FD3AF43
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	C8A6BE15F89B35007E40948C98BF9F3D	37D6E596EA01D1F07A023560E3AC70DF804B6DC5	860101D892A274283E10698EF666BDACFB1E0D3813F3C4615EB58D7FD970D40F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	F961174FD898ABD61FDF8DB443FFCBE3	97B234978D373BA81D5F2050D5B570255E6BDF07	A34837DAB5D721EE8012BA1A993BA7B8B98A605CFC5EE9877B9BD8C8EFC05C5C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	8BA0367791B7FCBF298EC2618D54829A	AB8E738CFC88C36E8EF78F86FD07BAABAF76EDF4	4D781CC32074628D47F00E0B9272598F855078096B548E549CD731F3E4C58173
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	FD1CB43A9D3D2B77078C4FB14425855E	B5454111CB130027AFB3F79F79122E03D4F5AE9F	A8C648EBD4A64AD2B6F1BEE9F2302B5F49C5F0C0D875B1CB39F5A6E19D284163
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	1378B3F3CF9E64FEE391B39040EA30E6	59AA25AE0B90F8E768AB0743B4A43534D4D2003A	4F418F78C6EE2AC507AC1C6369FBAEE7FCB1AC24C0D4B29D77CEE40050E31D13
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	6E53ADD6EE9F39C2C2EEB9424636E602	447F8489D5A6AAA59140D46E7AC7EE80D986A8CD	9E48759A8A7F5ABB4DC42277D18C24D94ED7FC2503731DC56C0B709E28D26DA5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	9EADD783F8A7100817DEDCF10B547684	599AB25D733496A4AA12EF90D371EC57E4698978	151090CEC56FCA9FC0E4299D0F983D9C149AAA38C6480F8610C4594D2433E76F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	E40EDA507D5C8129CE0FA9B989292CDA	36D80D6F0A5D2530B73ACEA7B35087D67D842E24	24877F5177F3382278BE2B7BEFF88D2C7C658F731BF219E06993765C76571256
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	26AAD14612DAC706B1AF9DD33B542754	E3898AD3C2E81B1D79E3D073777D42D10ECEA162	E555102FB5AF61A0B0E49316628DE953393B34D2DB174E9A1D80CD234DC36E9E
C:\Users\user\AppData\Local\Temp\MSI80e1d.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A30F5D4A44F7804E94C0FBAD133A8A61	EAA58B1A06C2D9206D6E47633B41EDBDB746CB74	78C2148ADBD7B896E0FD53EE69EAF9492B8A75417C31E1C20FD7255668F57C52
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 20-34-49-564.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	9AFDF7B55D7C72411047A4DBA02FF445	FB62956D9F44EBC908B44E0078A2D3A722BBC8A7	54C11E24E629297DBF98D8B75C5EAB7C6AA2094DD47238AC8BEE32129F9CE72B
C:\Users\user\AppData\Local\Temp\acrocef_low\161b5c3f-8a91-4ad6-81e8-481e48305a5e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\328e28fc-bf43-483f-ab5f-928b434df9c6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	99B9D76737F60004B8783DF857533C76	8C7F170E4AB439A2B5B64D0D5F4C386A52260406	E4D547764D6B54B67FB4450FC700479F960E10DFEACF25F45B88E642460EB747
C:\Users\user\AppData\Local\Temp\acrocef_low\d3993780-02c2-47f8-98c5-7a314ee5af45.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	8674C13B906E9978A46A0F17EA280FD3	BCAD8A0D29A4916BA7B5C38802FED00AA1F730E7	A18C97131BFCDBF3ED234CE94F7AA659C54F43E98FE58E2699F6146C900FE4D7
C:\Users\user\AppData\Local\Temp\acrocef_low\fc4e9700-2b6d-4106-84ec-e9bbb1d1a40a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	91BB1BDDBFEB3DE05BBF8C096F6D6F4C	727CEBB36C9825B03B21A966500FADF2EA8EE450	87CF49769653DAC0CF5971AAF4964F20E5E4D04AF2BBC6276E2B66EB2F0B6EEA

Windows Analysis Report
RX890.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report RX890.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
RX890.pdf