Windows Analysis Report
287f30b29d08d.pdf

Overview

General Information

Sample name:	287f30b29d08d.pdf
Analysis ID:	1417530
MD5:	c5e953f8ec611737a59e1f0cc8254383
SHA1:	ca81719de5a329343b7b72042ff7e909f8568499
SHA256:	342365d304a3c45d517c13f2dd1a6a53da1aee851f250637a1c4efedf6e61ea5
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.4:49740

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.48.8.182 23.48.8.182

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182

Source: global traffic

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443

Source: classification engine

Classification label: clean2.winPDF@15/46@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-29 15-10-18-089.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\287f30b29d08d.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1560,i,8317152618337752444,12301217609217587103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1560,i,8317152618337752444,12301217609217587103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 287f30b29d08d.pdf	Initial sample: PDF keyword /JS count = 0
Source: 287f30b29d08d.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 287f30b29d08d.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.48.8.182	unknown	United States		20940	AKAMAI-ASN1EU	false

ID:	1417530
Product:	CloudBasic
Start time:	15:09:30
Start date:	29.03.2024
Sample:	287f30b29d08d.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c5e953f8ec611737a59e1f0cc8254383
SHA1:	ca81719de5a329343b7b72042ff7e909f8568499
SHA256:	342365d304a3c45d517c13f2dd1a6a53da1aee851f250637a1c4efedf6e61ea5
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	755E6AC5518EC4C267FA31BE9C2A7363	82CBF8134F0A4A86EC563B09D8E026DDF1AEB459	ED1C4B269416EAD1695199187758EAAB1E582F2CC328112BBB36E7F044F59A01
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	755E6AC5518EC4C267FA31BE9C2A7363	82CBF8134F0A4A86EC563B09D8E026DDF1AEB459	ED1C4B269416EAD1695199187758EAAB1E582F2CC328112BBB36E7F044F59A01
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	12F734A4146C08971E95C9989711AAF0	0594681B7E25D83AA7CACFC096897019D8F9937B	872D93B1D3D1B6BC30E732D073F31A3B9523588241F45CF528BB2D03C7315FBE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	12F734A4146C08971E95C9989711AAF0	0594681B7E25D83AA7CACFC096897019D8F9937B	872D93B1D3D1B6BC30E732D073F31A3B9523588241F45CF528BB2D03C7315FBE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\95192160-fdd3-4d2a-94b5-e90de8e739b9.tmp	JSON data	80D7E128E248925F29611EA1D05F748E	E5FB9CB81C37E973556A8D7828D019A9C50FB3F1	D148302551D43D14E37640B97A86C11C085D12C404A368E52ACC524FD5C1CE73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	80D7E128E248925F29611EA1D05F748E	E5FB9CB81C37E973556A8D7828D019A9C50FB3F1	D148302551D43D14E37640B97A86C11C085D12C404A368E52ACC524FD5C1CE73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	AFCCC0B6CBD0DFDFC1BFEB5E8B7B2B5C	F993F8BBE1D05CD0B6346D0B8D253CC96AE0382C	5645E36DD7DA2D357296FFDDF4ED3687D59EB315FD1331C74E0C1601AC875555
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	536D3F416021A154CD173D5726E06335	D808B25B348486BF009A64E40DF81568C582AD53	B589750B9336DC773C243E0D03989AE812849126CD175F13AD99A12DDA34EB71
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	536D3F416021A154CD173D5726E06335	D808B25B348486BF009A64E40DF81568C582AD53	B589750B9336DC773C243E0D03989AE812849126CD175F13AD99A12DDA34EB71
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240329141020Z-157.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	00DB8ECE00238719F9D531102091F31C	2C93F28D42D242532093FAB1BB7DDE33EEE810D5	95444CF39A1424F48C5D069EE1F263B613F89D22C379C4A2886F6FBE160BC00F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	B65ED0D35D38E3780034D88143DB50B0	BF8904EDA08B9C3ADA0605A565D56F51F361780C	8648CBE670A9C94A6D269CA28E5E7F2268A9534BD60B6ECA4629B4A5D95121EF
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	5545181E4286C90817FF4AC8DEE267DB	14F5D92A48139B5ACC563834D05875E3E5BB71C9	46C33F18BE0CF275A44BF170B69FD7C2876F2BF31B5F77787864A7DB2EA54A3E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7516	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7516	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	1A8F15CA59CE97A0595F673AAD848D4F	F236BAC2935736B417727FD03C512DEB75E9EB2B	6FE790A8661A4C504DC3C67DF54F2B694D143FE6E0912C96D4A5AC3A86ED8F2C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	F2C92F74625A272B170FBAA42646539A	5548C7852A32201A0DB998E64640DC04BFD30CD0	B2E16093DE36C48B98C3D6AFACDBC9C374B766A4FA90DB38F326055A75F756C8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	477669AC63A4B9B10649170B15782EA7	3DD17C269A384B267064421FAE6A7C3467004C6B	7A86E89224C77899ADFDF08A4C531D0F4EC474A891546E89DAFA5C9679FE84CB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	8779E7CEB5485F3D39729C3076DFE45D	2F765BF766302CCB51C7BA9CC6B00FC05B04DAA5	DFF989943D391AD1F21D00BBA17B3B695FDB38D9570E8963A0B256B14DF1A5BE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	13DDC52A7E503574F57057EEF258DDE7	7DA162692F3DD8DE59778CDD3971D732BDBA588E	0A1E1612AE1679E422DA4F41800F4FAAA3BAD2D5FA96013161298CB5D8EB6015
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	54110D134E5F1ABFFF06FB574ADB5672	38AB188C37E8393AFF5CBC019AC0574C87E3A1E9	9636E41DF16A19DCBDF64CAC3D56430AF77051676EE8E7EFAF4540E579950554
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	BD1498EE41C3AEA267C32372C7C5D575	FACF3FD7A368B4ECA08F8F86269ED4DE8036F3CA	3B26E23AA6C460091C3BB43E1E1F94D8A1D6A4BBA7D724C2587A72EF1A477D2B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	7BD32EA4408D4C003DC3921809F22442	FC09B5CD15858DC05AC4EF7371DF736242B2A9ED	0599271FADEC4302EE3A4EB5F642760F4EB336EB508BE39390105B7FC77769CB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	FAD674C50EC89E517BB1B5ECE38395B4	BA96BBC8EB01F0E68EF3B43A01652F7304CD33F4	862FCBBD6BC84847C6A3DE09A546EAA0B31452A6B7787F13DEC73A749B428AA7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	94495CE269C97B1A4A1417EB39C808E6	898190CBE899AD375B17E1BE4F2A3BC3662A8E24	028911447B8C41EE6AC99B282310170B319D20BB5CEA92A37647FED55B373E1E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	368BCF46B5460C4A2B7A5072E1500655	8CEC30323DFEC413992461E11BE5AD99CCCD504C	F7A6D860419151EC95B1873295E1DC1073F0542576FEE6DC85E6A9B14E927AE4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	79F988936536FC3EF51CDADE52C80F06	137C1A2EBBA85424E7388D52A721471E6B3F4AE9	30E86C9568D9D597EB497CD93FB2EDDCB2730531196A02BA199FDF4B9B001FFA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	3AB14A76B80AEDB193F2D5B0E872024D	04834E99B2A1AFC334EC3AFC8FED569E7C19EB66	7D90DB161DCD6432A1ABD159640FF64F4652925B047A7DE5FF552456793BFA2F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	22F029044D9ECD1DD1AB135CCCE35D25	CE4F5A263E4BF7D3D00D15225AC6A5898D0AEFE2	C84F321F6220B36E866757250FB8FF1465ABAD0D907150169556D6812159CCD4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	4DB3225F2CEB6AF976E9C460EAAC3880	C6EF0526B1DF43310F8F083B2CBAC9D9DCB2DB6F	3CB7E740478C987B62247668331A023F32ED25B0386918BE0D0AA8445DB50B0D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	BE841C1CF1BAAA9C986EBE68F9CF2D1A	3AC8A02874DF6770FBE8835C650FE7B828384ACD	8E9EAF2105C339F804BABFC019FDA68E754AAC9B9B516FFD86EF49786938EF93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	37F3200219063773190EAA606FE893B2	D5DC0FD7023AECA3DA2F0BAC227FE2528B43566C	602AC291C47056C000D5927A55BAF431369B3A2A2AC85410C072DAE14F2A47D5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	25508790A93C727484E08B32474916E3	C8DE061BFC497E2F154A94B14CE8B85E6736A26A	B634B2EA27211BD2F894F2CC5363EA98CA17983D027ABD66D8F250945CBFB14E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	BF596FBD94A58D5A8C752FAD11605C13	43963CFC46A06C6BD174244BBC4629393CA95348	40E35D66F54E4196F62816B03A22DAC55C8D47D6C905112D5AE1BA8CA9E296E9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	314B26049494B9487DB7C07D80ADC7E3	F2A60188183413D98A1444B310BC3931E662EFCF	03806A258FA0222248800423856B82F3A8CFEBCB6EEF3FE43EBB3718DBA5589C
C:\Users\user\AppData\Local\Temp\MSI8730e.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	6D60977DE78F26687DEF7B9307A3C040	C7D79AB3758691BA90EB0E1EDF6FDEED0495F5BC	FBF2D48ACD510332B711E52E01EF9B9C000A8B2DC70425C0C6E5EA3D75520B3E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-29 15-10-18-089.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	FA35B4E27BFA2E3A3AC3B35C8F158389	C89395D75C555EFAF6C8E82853BF2918F4F975C8	7CA2A8866A366420D3977D418AC578357027AB50150ED680E40DB65CD8461B2F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	3F7490AF3115DEDC8E21231ED3F9DB06	40983CD2B9AE4381F1CBA717224566849D2585D1	F8FBA658C0B7EE2299E8CA74CE2BBFD3CD66ABBFAB06006A38E3198B3432FC3F
C:\Users\user\AppData\Local\Temp\acrocef_low\2301d7c1-163e-433d-8cde-8fde8b18d86b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AB9AB7524370F33FCB9DC48C196C6192	C0EB3BBE2884C9D081F2D09310D71F381818DDFD	BBE7F54A87E89788FA9E2DEB351A34B8DD5D2F4789EF86D13FE5B0C7450F8213
C:\Users\user\AppData\Local\Temp\acrocef_low\4c795b8b-b442-4630-9c1d-15197c901a3c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\b804ef94-fbb9-47b1-8df7-c06d34b2c58d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\ccb10978-1422-443e-a6bc-f07c5729b05d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\e76f4d58-2f9b-46d0-89c4-a4a344533e9a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 894778	C4B24E98358EC87C7F853C86A641C2DD	037F2682BE3AADCBB7149AC18ED434FE005FB132	88C547944F788B7B436D7AAE8530462183F5D714A5AAFCA3FF743E66D420E0AC

Windows Analysis Report
287f30b29d08d.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report 287f30b29d08d.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
287f30b29d08d.pdf