Windows Analysis Report
FDrive ).pdf

Overview

General Information

Sample name:	FDrive ).pdf renamed because original name is a hash value
Original sample name:	The Difference Maker Making Your Attitude Your Greatest Asset - PDFDrive.com - The Difference Maker Making Your Attitude Your Greatest Asset ( PDFDrive ).pdf
Analysis ID:	1411155
MD5:	410213409ab017ba5acff390f4d8beab
SHA1:	012f7ca37a6b276dca0431b0b327f2e42a4c1c5d
SHA256:	af4c8a610a96b0d868ca651bf600ffbec8a016745596d667bc138c070fbe5b3b
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.6:49709
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 23.47.168.24:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.47.168.24 23.47.168.24

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24

Source: global traffic

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709

Source: classification engine

Classification label: clean2.winPDF@14/46@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4084

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-18 17-04-47-681.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FDrive ).pdf
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1576,i,13669524516722668851,15775429148942468690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1576,i,13669524516722668851,15775429148942468690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: FDrive ).pdf	Initial sample: PDF keyword /JS count = 0
Source: FDrive ).pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: FDrive ).pdf

Initial sample: PDF keyword stream count = 518

Source: FDrive ).pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: FDrive ).pdf

Initial sample: PDF keyword /ObjStm count = 155

Source: FDrive ).pdf

Initial sample: PDF keyword endobj count = 1351

Source: FDrive ).pdf

Initial sample: PDF keyword endstream count = 518

Source: FDrive ).pdf

Initial sample: PDF keyword obj count = 1351

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: FDrive ).pdf

Binary or memory string: OptrfnInZrBllBV^A~QeMu

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1411155
Product:	CloudBasic
Start time:	17:03:57
Start date:	18.03.2024
Sample:	FDrive ).pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	410213409ab017ba5acff390f4d8beab
SHA1:	012f7ca37a6b276dca0431b0b327f2e42a4c1c5d
SHA256:	af4c8a610a96b0d868ca651bf600ffbec8a016745596d667bc138c070fbe5b3b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F416B565790C3AFC626863C8F2817BFD	57DD63D4B396AD380198017614B1E711DBF147F3	8BB834DD361FC14497C730AD1A8059AA06D1D8B9F1302B36ED8A19376E2AE06B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	F416B565790C3AFC626863C8F2817BFD	57DD63D4B396AD380198017614B1E711DBF147F3	8BB834DD361FC14497C730AD1A8059AA06D1D8B9F1302B36ED8A19376E2AE06B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	1A55DEA9593621D772D43A0609913B9C	5948104118BB4BF9D1A22AC9CE0A0673A3C8EDFB	1C3278DB24D2902D0794F8A575865167079E69F12EADE922014BAF9811A09DEE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	1A55DEA9593621D772D43A0609913B9C	5948104118BB4BF9D1A22AC9CE0A0673A3C8EDFB	1C3278DB24D2902D0794F8A575865167079E69F12EADE922014BAF9811A09DEE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\839bb9f4-61e2-4ced-8770-d5d19a3b1243.tmp	JSON data	8812F7B613079C4FA56CAFD3C51B5338	76FB1CE3F8ACA16AC2BCEBABF1D0A2AFD29C45D5	6B2FEB23CAFFD55B054FD9FF041D012EDFA43FEE4C1D3A4FF27BF0F0B5831087
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	8812F7B613079C4FA56CAFD3C51B5338	76FB1CE3F8ACA16AC2BCEBABF1D0A2AFD29C45D5	6B2FEB23CAFFD55B054FD9FF041D012EDFA43FEE4C1D3A4FF27BF0F0B5831087
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	11334BE567DB7AF64652B6680D7DD742	12025C39CDBB7905D3106317E77E2BD538C2C9CE	E681316E31345E83E55FA71788FC7AD346DDAF6C13E37D709C94F7940852C826
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	CFC30BC717B1B0809D214EC4E237BF1A	49D0696644A795DF389C20340E0B865F7F38128A	F8D0BF7777AB6FB4E451C02B9BD38BDDD63ED0C810929CAFD5C503237BB13F77
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	CFC30BC717B1B0809D214EC4E237BF1A	49D0696644A795DF389C20340E0B865F7F38128A	F8D0BF7777AB6FB4E451C02B9BD38BDDD63ED0C810929CAFD5C503237BB13F77
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240318160450Z-198.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	D61FF0FA9396DA339CC72190B08ADBE6	1AEC844F453DFD33915F7BF78382DCBA8CF42D3D	6A77367BABC2C7A761FB977A6860D5B2082D8822AABFBA4A28718D047529D1EC
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	4984B73774B40D765C3D80210751C581	CDB17D90B926DED7A79D31C226202D858B427C61	96C74137ED8592A9EC5DB025F6C13B5E1301BB9544EDB488241A97E66418DBE7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	0C628F2E9DA06D2801C9521B89715ABF	F6A20FF0BAB9C36482FB3A16F9905D75F45F095F	38A158139661115E5117E068DE7EB412FA97209B2A30606F52A5126F570F4BFE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4084	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4084	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	265E3E1166312A864FB63291EA661C6A	80DFF3187FF929596EB22E1DB9021BAD6F97178C	C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	624A964FB6129D30796846CCC39BB1D8	C7FC76AD5A8A71EACE46F416210E9F9478751086	3D3C36C4AF87D37E15E9738B746EB37FC5FB24DAD09E177EFD924AFE9A894606
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	D68EB7FD5A44A07819FFB40590DF32B8	3035031ABEC2485F3D18D70510D03707273BC90A	615860E8E8E3D5CB17E5113DBFDF6C8006C03632067409B6CA5CCCE89A4C272E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	657A7196ED9F01351F7B722B95D37626	5705F798C321525AA3E6738B955739211A1895EC	4603EE7E3852C0C0A180101AC86FE0D89CA1DCC7B610D8165A7CF6502A9CEC65
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	A51BBC9F9F4CB2FDF08946D29A56EA65	2E647072796A91199519445B52CFA23A38862329	C532AEEFF5B82A3373F4D6FB2305167B56BB4F9C7479419F96002E9C185BED51
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	6074EE8B7575454D5259DC5D71BF1223	A68A9DA4BC698634ADE625C3787AAF569183BF81	11CE0ACDC1385D7F9E71185A3596D9A4CDD118DABB11A769DD17916BFC7716A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	159A7817DBEC881D9832D0CD15BE320B	2B5FE364D1170984B64379D3A7BB3CAC0F104105	4A2C3DC3277EC00D4BC53D65C3C31A3C10EFCA17C5F1EEE7266580977F13207D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	9C9F529EA8970E450A0672E751A9E843	16FE671E4B6711F20F1A6FA6F3B7228FF428626A	6C88079742199DF98C3CADAB5C4EE2D4455FAE2E2FBC401005B1F9BF06D42A9E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	36DC62C2C99B5D26A1847012B121F576	650569B0BB027D34745FE6A84DD94481D6C1F4B9	500AFC14CB291D6DB2268C488F8A70A93640C893BF1F6DB0D9D4B855AF165672
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	73C43F787495F442899E9B32EC234C8E	8BAC6719EBACA3BB086B42AA83C9C184DC6D7B7B	B3ECDDABF76566066A57EE03D41DE27957411253D2F9A7AA3E7224B756B2F966
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	565E16A9676F2D9FF7F86362A7D284BE	AAF1ECD53871A5B418F1E1912D908830FF3E0FA8	A2D8730331501D7863A7278EF905055924EBA7DCB4CD09F7845860BA4BCB3111
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	49B5BEDB2F1054EAF1E2B866DA553506	F6F10D7A19901F1708E1789C395B62773A09A8A7	B5114DB4BDAF32299B02837EB4226D09D2E7356122D476F2EDF9A6A05009A804
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	535C86C802C5A446FCD921E4B9E66BCF	80636B91495B25A4BBC0B357BF531F7058C0CFD3	159FFB576BFCCDA71C1C17A7A2A8F95900F27903485657DA90DA1062BB66398F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	17926103687FD8AD81A01B1A8CD8C190	EBA418A2203F5FCAB2156F323EE171C349D2434D	A0F8DD68D9AD408AB064CE455B3F9A170145A2A55883B7FAEE8C7FDC67F182A7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	8BA78A9D21087F3C564D924BE763E06A	B78C727FE614CC52DC436EA3067104C47DA44D65	29E913031C85FD3A3A88F8D34DA20397BA6CE70934DEF40F11451743DB89C34C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	D761952E27224C47E46E085FD437BFD9	36B9969486378393BA28BEB2D2013DFE7BB9259A	A9EFBA72CDC7A899AC59E417E83775E33D247EDE810FAE4D84E55ABD93A70E98
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	B0615FF32C550FB3333EE8B117366C62	1E7B8C6172FFE68580E5BBEA822831E73D755855	185DB6A88043F3D37A45A5D5B76E969B0DAC931B9F47C684CD7FD31B5D2C71C2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	8C341A874736C0EAA088DD9B6393E081	F8D1F419D4FA040F54F66533DA3D95E98D39C8A8	0F26A7F6FD004001308DD377965C011AA196B8FB95289C3C37C80A78E1E6C56F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	D32BA1DF38515C41F969F210DC74E44A	490FDF259460AAEECF5821ECD9DFEE5EEBDFCA89	F5A1BB96294943C110A7C99329094C652191AEEA148C2BC9C3EF795DFC999ABB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	36FB6CD692BF3C231ABF0BA59FFEFB0B	EC023E00B1EDE51FF038827289052B0206AE955C	B74F1FC4C015C855B3E2B200BC4A7D920C9F833565F84D54F4F9BC0D5C004D67
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	406B9DF0882D4F85C6DAC3BDF4686397	8896B56A63A93D78D0AAA01B88EB296B7D3176DD	E25AA1F08BD83ED691E8980429BE2B8C26C4205F4EDE0F805C557DA0936202CE
C:\Users\user\AppData\Local\Temp\MSI5e014.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	483D9935C5A925D27C3BFDFF13D4E163	C8F57C3F7738CC54135AFFF2B68F7D3DDB452E6D	C10B08924FDEBC17DF04B2D1485F94866931DD5A91D94737CEF143DF2803A9F4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-18 17-04-47-681.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	E6343FAF705585D2B2D1C4834C0CB48E	AC4D902574F25B70BE3365A63696B15C8EEA1EAF	5A95F32D92D2078CA30EEF4E156C80B037746287A9B32C73D48A2C608DBF78D5
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	D8B489174A39D8119D06F290742AE768	461A61386C04DAA4A235C9D7F782C0DC7252AEC8	C2EB0C0E94E047A8845EDE2EFE9AC4031A592681A854ECFFFB4AC816AF103383
C:\Users\user\AppData\Local\Temp\acrocef_low\5badc54b-c568-4dfe-9397-dc85213b4635.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	96E2EE6506759519A5E3E5E550F28388	477522A699526F3EC2270AD0B3D3B8D6609F8BBB	D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
C:\Users\user\AppData\Local\Temp\acrocef_low\b77f236b-545c-4986-a1b2-5e914dd8c6c9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\cfd2f4e9-6803-4809-9ad1-5f1b3fefc004.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\ee9eb599-56c0-4d51-ab6f-b0143c1f3a14.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	22B260CB8C51C0D68C6550E4B061E25A	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0

Windows Analysis Report
FDrive ).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report FDrive ).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
FDrive ).pdf