Windows Analysis Report
BFAH EIN.pdf

Overview

General Information

Sample name:	BFAH EIN.pdf
Analysis ID:	1417267
MD5:	4ade6ef77b904f97c0aa224a1985aa73
SHA1:	c4595a3bddcfff19cb2aae28a663d16c5f6d04d2
SHA256:	55dc1c8b818b0b870db1082c39037dce15e693f156763a237af17e7916a81af3
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 23.205.76.135:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 23.205.76.135:443

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135
Source: unknown	TCP traffic detected without corresponding DNS query: 23.205.76.135

Source: global traffic

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: classification engine

Classification label: clean1.winPDF@14/47@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-28 20-25-41-478.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\BFAH EIN.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,5647836430669080431,3322115967871796701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1572,i,5647836430669080431,3322115967871796701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: BFAH EIN.pdf	Initial sample: PDF keyword /JS count = 0
Source: BFAH EIN.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: BFAH EIN.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.205.76.135	unknown	United States		20940	AKAMAI-ASN1EU	false

ID:	1417267
Product:	CloudBasic
Start time:	20:24:53
Start date:	28.03.2024
Sample:	BFAH EIN.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4ade6ef77b904f97c0aa224a1985aa73
SHA1:	c4595a3bddcfff19cb2aae28a663d16c5f6d04d2
SHA256:	55dc1c8b818b0b870db1082c39037dce15e693f156763a237af17e7916a81af3
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4B2AE8B2720DE8685941000577F9AF76	0B5EF660D6833CCCD30C2BB245D0E73742539137	5FAE8DB1A6E61817F5419E40FB166A18A410D77A3A758E462C5D69E8A2578735
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	4B2AE8B2720DE8685941000577F9AF76	0B5EF660D6833CCCD30C2BB245D0E73742539137	5FAE8DB1A6E61817F5419E40FB166A18A410D77A3A758E462C5D69E8A2578735
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	55E30AB3A4110519D532F289FBDAB4EF	D3A680FBFD010F2CED62412F2ED8AABCE7A84908	65A227D479130E55BC1DE8F589B6BCD525A177D8059123BB3EEAFEB1C096DBD4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	55E30AB3A4110519D532F289FBDAB4EF	D3A680FBFD010F2CED62412F2ED8AABCE7A84908	65A227D479130E55BC1DE8F589B6BCD525A177D8059123BB3EEAFEB1C096DBD4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	1780B7704733BF6C122EF2147AF2DDF1	29D38052A59ED30BD5CC47F520A5C1DBAB960650	B38D289F308E0F8EFB6DA06522B7959505CD2748541A163B09002C0D5CEB6970
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a39c09dc-690c-430f-88b0-47cd397adf8b.tmp	JSON data	1780B7704733BF6C122EF2147AF2DDF1	29D38052A59ED30BD5CC47F520A5C1DBAB960650	B38D289F308E0F8EFB6DA06522B7959505CD2748541A163B09002C0D5CEB6970
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	DD60E66AF56DC3F9237B63A0D2D30046	55EAE783D782E2DF28BE188D165DCF64B96FDA2A	8724AF8A5EB53A9C6B289392A00C4A4905FD6476F6723C59CAA202955228B780
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	851B58F0BFBAE3E15ACB8C005966F2ED	8691CBA2D73077B9F422BA05E9D2C9DC53C67919	E934C8A528DDC367028D11C7F9748FE89D6B1F5ECFF8A3EBC55A4C1D011250CB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	851B58F0BFBAE3E15ACB8C005966F2ED	8691CBA2D73077B9F422BA05E9D2C9DC53C67919	E934C8A528DDC367028D11C7F9748FE89D6B1F5ECFF8A3EBC55A4C1D011250CB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240328192543Z-152.bmp	PC bitmap, Windows 3.x format, 164 x -126 x 32, cbSize 82710, bits offset 54	DF7E699C428831B8ADF21B83775E2DB9	FFCFD39CAFD28A32C5A4C7837E3E31CAD11F88D5	890E8D5937B5427AC08C483E2888680B5B66B738595A0949DCFF369DF4AD562D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	DDA213C8107ECE7300926EEB06518170	063D7E03CF2710C3147FB2854D6339D5700E8D1B	87C669369E62BD29248A79B9BA972536B1C7C872D31214FC4EBC68EE031CAB81
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	CE8CA7C4CEA6B70CF4E1484B41F8139B	71D94A7A9BDD0F7B9D07B36DA527E6877FA5528D	5FD93D922822BCCCC8388AE821E1D46DDFAE1F426654F9960CCF4035A0559D28
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7548	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7548	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	758B42992DDFC41CB5E57069C621B54A	D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD	55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	EC1B14AD912E597672DADBDFAECABF3E	C8B952C048765A5E264EA8DFDEB7191F33E74E17	3CD4D087BBA7D9EDA14E2C9ED2C3E2213F410B83A9217FDA454FEC9F27740485
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	A1FB17B83D402B30CEE05F14C49BC213	E56F414AF50BF0C5BC6503B3A332E1606E6F462D	A85F53E7F5670301381B91F7945DBB9D6E666F897C9648F385F80D1FA1CBBA2A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	9FC9C526ABFCED3882EBEF507360E724	C4FBC49C8F7D7469101FF8EA5F35DBAA351F9712	1378C4D323D65E033EF54C7FDC2425466615E9B7207BB3840861758ABADC3C15
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	302057967207F3E2DDA4F81E720EEA83	C3D01E8D359A5416359539A6C6AC4B68FAB43D8E	D8A0D1EBA940F240435D306F772CD518A9CB9F6487D1B4B726B84FE8045FB7E3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	5BA7F1AD941C06F56FF28A474ACCA590	CE9566328CD47B5B287A147663AB5DFA9820FB04	221EE1E9A6CADF0544F71292ABAEE2F9EF3D615238B8D19A2D3B969211689070
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	DB526263FA78EF9002A15F3C1A880E59	33F4E7CA3127AB7DA0A6D6DDEDA91B46E58ADD39	E78FC7B0F7108550BD860990F043810EDC20077D434C91BFB5DA702A27BBEBCD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	0648AED2D7B15F76B3187E54EE8C79A0	0AB7C17265E0586AD3CEC8AA8A37F2D58EEBB369	8B23D2E7BCED4806C45BA734D6B9241F90F999CDF2A9F64F0DB48DF16106914F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	CDCA87BB731110C69938683E46DE99C8	F084606D6BFB9B3A7A3AC37A6A6B2C922BE79364	E501E4E79A132C8AE79E74281C203C7A3F5AB4B586EC56BD275C2F2B67C5EF65
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	5B6917D9BC0842E101CE8807B2508642	8ADD41370C0B0A552BF0181DFD24E5A56B79170D	7677711A4E9C474DD31572FD04C3A741C614C03299668B81A883B5034B47D1A4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	0FE6A265CB332E6F3E6B96B79ACDB2B7	A441A61FDE92367809ED212210349FABF45ECBA6	AD47D3CF2E06ADDEF18BE201CEA23AAEDFE985360CE45289FF7ADFF6B71ED074
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	72494E99ACC16BE56282F58E7DCB4DBC	2A06553A97CA0193FBFA54845BDF06FD9AB8CB6B	CA3D34D0ABDE70F88028629560BF10663E7CD0478B91B4396413F0F8CAC58FA1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	5402271FB0A37F8F754489C1A2E08EE5	1E75A367064B22748547E31233B06B2638B52433	EB22FE4D2D7DF029B5733BE04DF6217F86F847E7DFF34B060A58426CBDF44C0F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	D92AEB880F101A91806C425D579C8ACC	631B9D856C2154331B9362E11E979C86D8A990A1	70E24A8A3A0039B2C7C455CC2288EEDD23ABF8C7E10D1AC3446B9D23DD32ADD0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	708A31AD20DBCED659E97B5F4A2DD987	3836CDAC6BFDBB39D94C44A7B28675B0B62FEE8E	AF36E2CA1E4FB722B0D0C576660BEE9F31B6111CB8D1D9E1C697F2EE69CAC0F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	F928F65CC47C817835A3735E4F7142B6	13DA96E03A10419399D3E8918EF41E285E658290	B61787E12F03D20665FB26347A8C3D4674673921BA101E203C33D2DA073426F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	AFA8BC76A3CAEFB08C5D29F83D694BB0	2784148524FA75E0812FAD2527C85698B22F1F00	6CF63774048206D64D252484377E3CFA7A06665362E228145C632566457FC501
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	682B2077429C763B649BF7DADF432CAF	93F925F0E56A993BD5A183AEDA7E2495A1F88006	240A003B7417E57B089F39B8EB75D414E40D83E403278E8116A9D96A29384385
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	CB9FE721FD85E920A3E03E45E1B92E08	F3475E94632AEB390DB8E2AFD455FF52D6DA3A17	E69B08AE8FC808470BDE4E5AAE05771C51BCF4CFF25C1505BDFE065A2FD310D0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	4522B3CDAADB9DCE8FDD10DDE2B55626	8148D73AB872C6CF4F627D4F2D6E872CBD34C6A5	49BFB8B7AED2BDBDB5E836CCED968E9C9E28EF25925B029A7C32A5541B5D1045
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	0B825CE86BD209F26DF17679A09DEE2A	401FC5BDB124E7ADBDCE7270432A5704F276FAC2	120B14FB7F6E6F79266044798F0D75DD36200A1CB6B8EE4123D0B7925EE7EF13
C:\Users\user\AppData\Local\Temp\MSId993c.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	AF4906B1912A3D1F33BE3314C7CDCAC8	B6331F6D857738FE5DDE4E35549418B8EC1169C3	F194146FAC35B2DC3CAFFAE06CBA1538FF877955D3DF677010FA628789D9C997
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-28 20-25-41-478.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	D852FCCE1B5A3322C14BB67FD9129F14	D4AA3924BB13FC832262C6D9A7E0D1DBE241A5C3	7ECA726DA30BED8859A23C47B12F79FDDDE2948AF16DF91654FD4D2A2EDDF4D2
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	A08048715E5FFC5A61A4705376D1CD0C	F9B161AA45E2FEF0550F6A7A954CA2E9BE0371F9	A54158468E2BFBAB2148556DC16AE541922BE5BDAF18422D84816DEF084091E9
C:\Users\user\AppData\Local\Temp\acrocef_low\62626aae-35d0-4143-9468-ed1b2dd6a271.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\c713db90-2e35-4ca0-a269-219a496d8b0c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\ed04dd8f-82a4-4531-b806-81c8e4df6d34.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	9DE909C4C633E6829165A4F1E0FA55C1	2E5FA5D6C1FC57BB2BBBD36837BBEB363C650849	8770BE5263FD11B1A805E381669C27C0E18DC265B6041D531454299C14D0C83D
C:\Users\user\AppData\Local\Temp\acrocef_low\f7516748-65af-4ad3-bfdf-3e9a109beea6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	BBFD5C2DB533CDA3D36078A62E71EE6A	D60AAC38BF170D7B2C5EC1DC2FB25DB636D5B676	462155888A46175F8C17A6277CB4D5A3FFD1F512D74BA6FFF06967426AC686AD

Windows Analysis Report
BFAH EIN.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report BFAH EIN.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
BFAH EIN.pdf