Windows Analysis Report
Enertia Standard ACH Remittance - Email.PDF

Overview

General Information

Sample name:	Enertia Standard ACH Remittance - Email.PDF
Analysis ID:	1411163
MD5:	0fedc11a6b55c699922aa9dfc45e5dd9
SHA1:	fe0c2afd0276a0ab6424681aa3cfbee4ec910a88
SHA256:	b5d036d428b0321dca1034a1970154adfde2332c7aad294eb98fb18f4cef914c
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 23.47.168.24:443 -> 192.168.2.7:49709
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 23.47.168.24:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.47.168.24 23.47.168.24

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24

Source: global traffic

Source: ReaderMessages.0.dr

String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709

Source: classification engine

Classification label: clean2.winPDF@14/49@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-18 17-22-00-322.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Enertia Standard ACH Remittance - Email.PDF
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1652,i,13769276738168295805,949551808815667000,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1652,i,13769276738168295805,949551808815667000,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Enertia Standard ACH Remittance - Email.PDF	Initial sample: PDF keyword /JS count = 0
Source: Enertia Standard ACH Remittance - Email.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: Enertia Standard ACH Remittance - Email.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.47.168.24	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1411163
Product:	CloudBasic
Start time:	17:21:08
Start date:	18.03.2024
Sample:	Enertia Standard ACH Remittance - Email.PDF
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0fedc11a6b55c699922aa9dfc45e5dd9
SHA1:	fe0c2afd0276a0ab6424681aa3cfbee4ec910a88
SHA256:	b5d036d428b0321dca1034a1970154adfde2332c7aad294eb98fb18f4cef914c
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	97A674A8C31174C799F7E5932E640A75	F530DE5A5DC2EF59E7220E89AA5C1B5EA332E922	1E77ADE03D6D751C7BACAA9FDADEB3FDDFF0B2DD0CDB00449F8AED2F22699578
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	97A674A8C31174C799F7E5932E640A75	F530DE5A5DC2EF59E7220E89AA5C1B5EA332E922	1E77ADE03D6D751C7BACAA9FDADEB3FDDFF0B2DD0CDB00449F8AED2F22699578
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	96294725BF95CBBBF11FD6DBE6DAA885	0D9C1DCDA305155AAED29B2948455556D1BA3403	E2A2B6738423C22ACF287A80CFED45E07CECC59BC069E8C0AF34435F0681EC50
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	96294725BF95CBBBF11FD6DBE6DAA885	0D9C1DCDA305155AAED29B2948455556D1BA3403	E2A2B6738423C22ACF287A80CFED45E07CECC59BC069E8C0AF34435F0681EC50
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\812df807-492b-48ae-962f-423f334c4d57.tmp	JSON data	5C794C7995BFF997998A272F6661FE86	3E101D4F405192CA9F7C33CC950CBB86E50DF398	41558FF23025054C3B7A3C96E4B1E7166152A3AF7E3B995A15B8797FD0CE02CD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3c82e7.TMP (copy)	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c1cc108d-d9a4-4f64-9d25-ad7f8ac1692a.tmp	JSON data	7BE9C8316EB1B7252CB363207744A145	57861355BE6541501AED40F896891579DCF473BF	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	F628B42FC128C31FD4652BD91324133A	38AF0100083633C7277C2FDEE049C2CED1C47ACF	B87BE30F0C6DD192A570EB29118F8BBEE9FBD80591DDD3FE8772A553E93AFC0B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	56663BE2B6F668ABBB11CE32B175901A	E5B2F05F3796330A49DAB22F40BE446D6C3C471D	C84654BF29A59DF87CA03B1BF1410F691B3EF6D503F3BCE8FE276207ED0DEE73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	56663BE2B6F668ABBB11CE32B175901A	E5B2F05F3796330A49DAB22F40BE446D6C3C471D	C84654BF29A59DF87CA03B1BF1410F691B3EF6D503F3BCE8FE276207ED0DEE73
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240318162202Z-164.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	33F92D89A0C53BB4735C39F616E2698D	39FCF82FB503D731AF61C42F535120A43D2BC5C9	30C22304FB9F5F5E72199A62C61E2E241E96FF0B62732D26CDFEC0BEBB767CC2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	C8D7824F81C0249885E7F235333A3446	4AB38949A34437BD04785EED56732D52E6E68D48	108AAC377C7539E81ACD9CD9B5F24552B224088D9028E992D2FC377F53741D57
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	9785C6454493C66D9E6F327DC1BA6905	A1A0EA4B1BDC7F0B7A4F032D6EA509FF7C990A01	A6C5594090DF88644FDB27C7BA988A09D22A21B63A8D365F1ABEABEEA245B6A3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2816	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2816	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	C11248DE3EDEB5F39EE8D1E2C1FFE7D8	7EC6B85BDB7C99BA691BB08A051EF7C4D4A43231	57612AEEE8F8E8471B730963F8E111C9890F83D8120380A6FF0676A3814A4B41
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	E8EDFA686508CFAD7BE7DB32C67C90EE	8E5178097081553FF956B14BD32C32F2EBAE35F8	D8BB2F5391AD5BA46BD77A1AA5E2759A4A53463E076601D0FB8BC03CCFBDDA60
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	671DCE4426F904CBDA85E4EC0F8D69F2	61578FBAC1A1CD44F80F4921B8CCFD93DF49A02F	F3386EFFED2EC6134ADDCE2FDE74F8480AE4FF65E86EDC4C666E892ADF7E57D9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	46E6580BEBC246DFA1D689898B73F520	5649F9B50AEA275981986E9CE97643E08F90FE36	DB7D2A9428D1DF33A53F8825AC1FCDB08BAE0045275A70D85C5489769EBA66DF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	87C26D1928B9F8E5B8780C1C67F26DFF	6B97818FD0396657BBF553EE23460A244A8FDC51	5F27DBE8FD1B01572FDBB6254C841AA5C23284778557CEE1BD8BACD88B140858
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	881FD01C0001AAAA94BDB5F02176B33B	E77C065DD29103BAD6A4B06448CC42F2543BFDF2	28649EFD5E21A756F402E8A86A7A0B66F598CEB8A0F992C6BCF2F6A5D1C694A2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	526441D5000ED90C612171810B68021A	EF58C5849E53AB174C0EB6E9DB446B89931BF29D	D7AB1ACE711410AB6745F210A9BE5ADA66CB5104ADD60AD20E97C95053FB8EE9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	1C206CBC12885EBC0F334FDA662D322D	B76006F18D787E2F734CC0F66B4B43063F9C3E74	42EFE071A8E75DEB2427493230BF74A6EE75FEF5A5D9887BBC28DDB338C8060E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	D976704A43A6E6642F87A870A46B0A1F	FB6DEAD32FE5C26FFABCEDD168058E5195D8F984	75B44228DB61D2D3EE73ADEF4B735AA8BBF57694462C4BCBC95D79329D641DD4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	9D1196669C79F0DF5A2CB78A8371A677	44B27965BBDBC33B9255C13CBBB47F225DED2E8C	2371A3E7CAE1B9745B3BF32AF195A20745C4E5E1AE34DF4559452867ACE16D3B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	DDB33DD6E2D9EF051C5BEFE27CA7E758	30F4818A0BB3FB0E0663E838CF026C0380BBC66F	D12934A747ED3C238A23332802B2ECEBA451BEE3826F0677556F06C9A2B2CBAD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	686167836DFE47CBEEDBFF7366C37383	FB8443400F67508F53C82B98756438B57702B7D2	D6D2EB7BA0E6FE9601DC6899A9CBF48CDF5A40C86351FF3A9CC7B3605333E48D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	D5962555B1C3F7696B056F9D53614DD7	E41156D77BBED0301CFCA27A4C5772D8E9F10F6C	1856EC09F5BE98241EBAF90DE6A3BBDE47BFE924C0112C5F375B5300829439BA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	8146ADF89C6DE681C9A8C5DCF97C0529	1A7D769C64519D2B2E6ECDE2106219246795F946	93EBE617A5C4B8A032895EE692567AA3338189401E0654547377D73733C5C08A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E7A8AB9BB3B45CAF5C58183132AFA892	D9174D54B4A85D5C2E0FC1DFCA8D10F29BD56FC0	3EA0BDF82F5B5C8DDD4F1261C02C7A3560638D8CB391B51D05ABB9FCBC029A04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	8E8E4A4C7229C4F65A6EC562FBBFBB9D	87D2573208491288AFCFAC8F74C1E4B03104E1EF	F04926F26FD6FE6418FABDC3894395E72C6C3C409B72B5A2221574333719514E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	5BFA8EC44F84FDC96706D1E04C243756	9F07A4F1DAC84BEC94CE8AD83526CE6BC0F54D2C	031D47C94068492EFF28C92F375E43EA392CFF21A129D63C350C09FE27CC9DFB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	E6B7620C971B3DD261FCA1AF456D5E18	2DD57A8134EC4AB9467B487F594A9ADEEBCC3254	6B19E945DAC654D988B8A336246BF3535654F4B755E59F0FC7F371682675B4E3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	B3B72D34AABDD7A207EA6D01ACB1FED7	44FF9A27E3BABCADC95F0901999CB872A360A15D	D5698D1214C83524F15F4A374D494F9475F80DA5EA89EF5A6D389A377F2E52CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	900B83AD0D454D2DD85EABF68C2D1288	CB9929CBA7C87E36AF8A78422E69D43FB9F661CB	591CDEC082465B6A4FB9D3BFF5B2E5EE9722A8E8E0BBFC23243FC2A8C97D98B0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	8FDBF5165E526756A83B91BAD0E7391F	9EC49EE52DD53D4477707968C8BB398D64ACEE06	4E73F2E27E6996EC1E1C1EF02B1328104DD749B029F22DEE51071FD53C1248E8
C:\Users\user\AppData\Local\Temp\MSIc433f.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	8A34AE6A711B2972A4ED7C78EDEDD929	89B99EFA8B73E883BC4148AD5FB0EECD08D8266D	A565CCD0BDF3B5B86C4676F4616A45291F6986AAFA6EB9DB5CBF0F81A20D9549
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-18 17-22-00-322.log	ASCII text, with very long lines (393)	F49CA270724D610D1589E217EA78D6D1	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	6ABAAD8AC22CD944B9391145BB66A342	88BFE73851C4F650BD0148160AAE1F74A70EA0BF	D40881C6DBF5E1B7370B1332FDCFDE52CF8C4FD53D8FDBA453C8283C5066F18B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	A4379671E59FF15AAB3EC0B5E3387FF8	C34F9ABC777619572D8FDAA1ADF76A4B8DBCEE28	DC621CF94285DBA4FA1A05C7DD7262757484D51AD106401F6281AD3C43F1E6D2
C:\Users\user\AppData\Local\Temp\acrocef_low\48dd18df-790d-4dbf-a7f9-a4c0db2a5732.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\520b09d9-6675-4333-bdce-b6214e31557c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\84b3117c-ae6f-415d-b5cf-60f82ec459d1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\ec917661-073d-4ead-97ef-3a0d77c6427c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
Enertia Standard ACH Remittance - Email.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report Enertia Standard ACH Remittance - Email.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Enertia Standard ACH Remittance - Email.PDF