Windows Analysis Report
DepositDetails_01205024DOCX.pdf

Overview

General Information

Sample name:	DepositDetails_01205024DOCX.pdf
Analysis ID:	1417547
MD5:	035c11c4d9eaa501b76a106cbb2b49b3
SHA1:	ffff7f09664c353853df20b964bbdb7ec43260a1
SHA256:	d92af11c2c12450613f9eaa98a14c8d95139b5a7e8c78b3591c7cf08982e2a13
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Phishing site detected (based on OCR NLP Model)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Phishing site detected (based on OCR NLP Model)

Source: Adobe Acrobat PDF

ML Model on OCR Text: Matched 87.8% probability on "Office 365 A secure document have been shared with you via sharefile, to access file click the button below View Microsoft SharePoint Development and Consulting SharePoint SharePoint "

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189

Source: global traffic

Source: daa51dd5-4c73-4f6e-a4be-1d2246cd8d05.tmp.18.dr, 1d0a83cc-0291-4917-ac04-900261178b64.tmp.3.dr, 2d62c934-b542-41a6-aaa6-b89c000010b6.tmp.3.dr

String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Tries to load missing DLLs

Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: systemsettings.datamodel.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: settingshandlers_sharedexperiences_rome.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: windows.devices.radios.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: policymanager.dll

Source: classification engine

Classification label: clean2.winPDF@46/65@0/1

Source: DepositDetails_01205024DOCX.pdf

Initial sample: sharefilecollections-96166.grwebsite.com/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-29 15-55-07-910.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1568,i,15003637769907798127,16232566362215290703,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1656,i,18135951954436833280,6426284676420575564,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\SystemSettingsBroker.exe C:\Windows\System32\SystemSettingsBroker.exe -Embedding
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1664,i,11073650710475831001,5174923615738780206,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1568,i,15003637769907798127,16232566362215290703,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1656,i,18135951954436833280,6426284676420575564,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1664,i,11073650710475831001,5174923615738780206,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown

Source: C:\Windows\System32\SystemSettingsBroker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B488CB7E-98BC-4FA9-9FCA-E461728EFDCE}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: DepositDetails_01205024DOCX.pdf	Initial sample: PDF keyword /JS count = 0
Source: DepositDetails_01205024DOCX.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: DepositDetails_01205024DOCX.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SystemSettingsBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.45.148.189	unknown	United States		9498	BBIL-APBHARTIAirtelLtdIN	false

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	28AB26E3E645F0C663A7C89B1B62CC3A	B9353103DC658FDDAAB7718EBCBBE95B6B418228	A78E442BEE3D92EF907B5AEC133698DF0970F289C3C2B1D5F041E15297813C6F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	28AB26E3E645F0C663A7C89B1B62CC3A	B9353103DC658FDDAAB7718EBCBBE95B6B418228	A78E442BEE3D92EF907B5AEC133698DF0970F289C3C2B1D5F041E15297813C6F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF3f7414.TMP (copy)	ASCII text	28AB26E3E645F0C663A7C89B1B62CC3A	B9353103DC658FDDAAB7718EBCBBE95B6B418228	A78E442BEE3D92EF907B5AEC133698DF0970F289C3C2B1D5F041E15297813C6F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF3fb301.TMP (copy)	ASCII text	28AB26E3E645F0C663A7C89B1B62CC3A	B9353103DC658FDDAAB7718EBCBBE95B6B418228	A78E442BEE3D92EF907B5AEC133698DF0970F289C3C2B1D5F041E15297813C6F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	F2A0C94E52A99B020D57E1ECD962A64A	828D39A5BF0F176B137FF63066BF1A44000BE774	C7466D6E640DB0AFED5E35E90A605A610A392CC8440E94CB8EAAD6F06CEA4476
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	F2A0C94E52A99B020D57E1ECD962A64A	828D39A5BF0F176B137FF63066BF1A44000BE774	C7466D6E640DB0AFED5E35E90A605A610A392CC8440E94CB8EAAD6F06CEA4476
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF3f7424.TMP (copy)	ASCII text	F2A0C94E52A99B020D57E1ECD962A64A	828D39A5BF0F176B137FF63066BF1A44000BE774	C7466D6E640DB0AFED5E35E90A605A610A392CC8440E94CB8EAAD6F06CEA4476
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF3fb321.TMP (copy)	ASCII text	F2A0C94E52A99B020D57E1ECD962A64A	828D39A5BF0F176B137FF63066BF1A44000BE774	C7466D6E640DB0AFED5E35E90A605A610A392CC8440E94CB8EAAD6F06CEA4476
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1d0a83cc-0291-4917-ac04-900261178b64.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2d62c934-b542-41a6-aaa6-b89c000010b6.tmp	JSON data	AD02251FF725F175A0BFC007DA6364F8	FBDBA813C3B24E880851B0D20ACF56D8934B4FE8	168DC2341C69DC23CE37E6D5F15495F852673D7B3DAD3AECC78A0C1516A7CC80
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3f68ba.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3f8ccc.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\daa51dd5-4c73-4f6e-a4be-1d2246cd8d05.tmp	JSON data	F8BABB6DBD0433A6E8CC4DD4FEB63365	D471C12B500628D985C06A155682F2132904973C	BC3C088691BCA244C2CD40B0CC70C7DB7A68551278008FF87414233E57A68499
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	23CD57EC51024ED5F2A6C008BD738E52	7488BA392E2873DACB30B1F5B7EE5089A8A3DC01	7F435FE044E8DC1CC1C90BCCE15096BF01410999F8CFE701BF25DAFE2B00BAA4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	65C786366E98CB674F89685B02050BB1	BB23D5E10E01B75849DD960E63751EBF2E709E7D	0E01ACA7C636E8A30AF27038A8070CF4500F4BEE2C121EF1010DCBDE1CADE471
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	65C786366E98CB674F89685B02050BB1	BB23D5E10E01B75849DD960E63751EBF2E709E7D	0E01ACA7C636E8A30AF27038A8070CF4500F4BEE2C121EF1010DCBDE1CADE471
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old~RF3f7452.TMP (copy)	ASCII text	65C786366E98CB674F89685B02050BB1	BB23D5E10E01B75849DD960E63751EBF2E709E7D	0E01ACA7C636E8A30AF27038A8070CF4500F4BEE2C121EF1010DCBDE1CADE471
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old~RF3fb34f.TMP (copy)	ASCII text	65C786366E98CB674F89685B02050BB1	BB23D5E10E01B75849DD960E63751EBF2E709E7D	0E01ACA7C636E8A30AF27038A8070CF4500F4BEE2C121EF1010DCBDE1CADE471
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240329145510Z-170.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	017115686077B424236F3910995A99DB	11F37AEE96E7ADF800061DF43E84410E3D9E6BBE	3D95BE6DDF4EFB20D37DDE0C85D512A333F57B2D1548C7E9A1D54D4E4935B125
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	A109C479F54BB08FC206E16FBC446CBB	A8E76C48DACE1245DAF19F1C5C1090F1D350353E	2A68BCD137AFEB41D01F51E66FEE849F1AF74442D514DE853B23050B313D149B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6884	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7888	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	8BA9D8BEBA42C23A5DB405994B54903F	FC1B1646EC8A7015F492AA17ADF9712B54858361	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6884	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	D12B154477D7051F856FF95E48CE3BED	B4B528C2E9BC277353F9D834255E7C7FD67D8A19	EF2CA5AC3C540BC46DD353CD2233E6C76A50E433ED9E0545070FB7C49D291005
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	641E9518E967A3BDA5587B82782E999A	32DBC88DE292B0C5BF9C57B233EE329322AA69F0	99493592AA8F4BDCC370B5FFBAEE0B975FE959776F53926F42ED96B141F661DB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	0C67B82CF1762862CD40E92B3E6CD8B3	5F36BE49B480877DDD3F050D6622BAEC3C425D4B	EFD5363F4BA3A12C48FC40B1F48E056103DD11E78D71E10187F3B087A38B9934
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	AA1175854447D3164A74024B3E9608BE	DA620F1D40E44EFA00079ADA790711646144146F	C4281098363CA55C3309E4A4DFCE82B738CAF7A8FCCE7BBC64116730CD7EBD63
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	C7CBDD3C96CC7DFAEC7D6693045AF9AE	21D61BE7FDE6E7D2A27847DFEB597DA3398A4AA8	F13561E432E6DF7E168B692C26D313BAA062E99E962EE100F932E550EE8E12CD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	CD173D51281943FA0281E2599533A537	D81D3E79E8E7791E3AD054ACF4A6E763C2D5C0CC	4C708A0198BFA6ACE11045DE86A2E9E3123B01C53D2EB2C3594BC2505A786781
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	8736AD00F7770CFABA6742CEF0BBC48A	8CD0F037B3E66EE0707E7EA4EA00D458C70F17B6	731DF17C964620DE55AE4640F9792D9E1831FB74249C5859A43855766299E1E4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	1D9DD492F19224482D921ECAD823149A	26C225DD733F68666F373C54AE1FF6E0021A304A	21B7455631639D6247BB12FE9C26F4513588A541B3794CF9C0DF869521D55394
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	936938F385BFCBEA813ED431BE471FF7	24FA4F11DF40E39C54C16761ED6BB9125859345F	0C4B953B23C9D6A39AE10F203A9636BC6CB8D205C51D10DFE9533D7524AB3369
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	C4E553683DE401615C16FF524A322A67	2C00EDFEBF22984223F276FF5C17E7F7587D039E	4E0ABCC543A6770DE7CD074A169EDB8F1454BE3D2A60CDA70264602A781EBB21
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	9693C95C49E23697BC514097F37C1318	7A9A22656E1165BDD0305F7058C047B17CA039E5	D44E92E57DD8D404428643BB89B2EDA2D5FE88FEED5DBA45B8610F2CC3B8B60A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	DE8EACEBFE7D800BA8C1BCE4D4AEB6AC	E73A99885B82C68A47449628983274A2CC06D90D	2AFEBEC2EDE0910034CF80F840B8073C06AFA7C6F557A4C8AA92AD29D9E98E07
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	6D32124849B304072A29F3A74E37A78E	0C90D20781BD52819C0A69638B306F94D14AE45A	18A4629FEFCC779961565545F0A70292529B82B75C6CA1F9FF8A9ADE866BBD64
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	7A75E528FF40ABC890E71C595715DDDE	7EBF13BE1E999C32C8EC9FCFBBDF216449DA6802	EF9798274E7E0AF0B428B1BCC8B9E2D03C220EE7674EC59CF09D411F5F78197E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	FE6E73C17B1F485E818EE97DE61E5E87	FE88B26A54DA25C4726539E1D5DC8DE78DA89FEC	5BE587431A6090809796C59796F4F04ABABBA818C4B2604C118A0CF4F1E665E3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	0ABC9B6D1B46DF2CB0A4CE69B6E42466	77EC6BC6E2030ED361532307C8340CA775599ECC	56A8B70664687903F8493F654FD02F7C5BA4A6BADA3C32BB6BC4DF67BB8FBA80
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	6D94B6F3E03401BCF01974C509C86FF1	DCF2FE0EE922428FCBE003C86668204AC6C7F445	29C35BB9A8C9575029AA1142E0FD10E1F224EF4E1305231CFCA12D6C6D85A722
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	1727A9CF0CEB832453D245E7073A5785	5AD2882300E2D1614500D3C2DBE09DBC56CBACDB	B14DC75D90E0CF54EEC6EA6D16F12064826A49044254D56C46EA0F5768E8EF2A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	3689408F216BA5B3836B85AD2759D2E3	94B76EE5E2A1F294D2E627197451BE77836B43BF	83B390B0098A5A5A8216C37ACBD3FF1570A7C82B8E4AF30903D08F6AF4A27A0D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	234F122556D7D66F36DC6042DD8F0C63	C1D1A9D486B8B31985ED4312329D9C9BBE4078D9	AD9E5AA73593ABFBAD698E84C0D490672822E15433DCA63F1990C19E14AD2300
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	A56BA3F0149BC23ECFB6F640FDBB4062	43DFEDFA4A87817774A1F7E22C6D68FB190450F8	0E56CC913EDAF679CDBA731B5D64C5569A685DC7A4C7EA09AD3E1AAC9277A9AA
C:\Users\user\AppData\Local\Temp\MSIebb05.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F030D88E846536A979189D796A87ED07	7159DFB3AEA6015F287F85CDFACF85EB0B3F9330	638D25D06A311847B0305B7A6B9AFF60D7E24936F3990DC02EA72AC0050FFFCE
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-29 15-55-07-910.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-29 15-56-02-602.log	ASCII text, with very long lines (393)	105C7825221A65B93959FCF6DCB4A325	7E0F5BFB34B5698C9FE2F10BF35616186C51391D	2C8280F73EAFCD78A34C55D64C63A84505A956CC12132D2526E3A8B7C6B60F41
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-29 15-56-18-716.log	ASCII text, with very long lines (393)	A85F4695AB29C721319EB516248AE99A	5022A426E045CCEB8D95AC66CC4B9E250430DD4B	D3DAFDEF11D71E745F37B8FCE7447A4BE2C66F22E287A2B1ABEAB48249FEBF1D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	F64F83E0B420928D5B545F86253A4F7E	6D9F726E0495F11FEEBA5E0C00E08ADAE654C34D	85D464AF8DC618DD4CF0FE09F310E9C21E9E3FA2C8BDB720BB32451CFD7072CC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	2054403C976E7FD0466F311804F92A48	616AEEA6AD98B6B66FE617119563733FFC5E0828	14CE62AC75CDDACC241012E4E9C6F60EF3DD3553BBD8D902B74A6F5031461694
C:\Users\user\AppData\Local\Temp\acrocef_low\1efb37fc-e846-448f-b0d5-0443f3e91e56.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\3b43fce2-f1fa-40c8-bc00-4749e1b87f52.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	716C2C392DCD15C95BBD760EEBABFCD0	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
C:\Users\user\AppData\Local\Temp\acrocef_low\40581979-6d48-4fbe-9e38-d5818319f206.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\54bbd3eb-ce2d-4d87-8824-dd24467896f3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\8a9b3172-63fe-46e4-9410-7f70e17f9263.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\9bf11384-1497-40c2-8f03-251f5e570a45.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\b59af4b7-d29b-4678-9b63-8091ac638e92.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	A8E5C37206C98D1B655FF994A420FFB6	827237782AB5971EC205C3BCECCC7950BE9F84C3	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav	data	5C6B932A79952B4B27833691305E61DB	09804DB0986A989C2C49CDCEA563567FB4C7B1A0	DEE5A5925227B125F4AC6D9B70A277E6EC8494FFC73D1CCE9E08CC7A78D6208A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav	data	6A614A7743B0C781AAECA60448E861D6	67B7DF5EBEB4527E4C31F3F9B7E52A0581DC4B6D	9703120DC62C2C3F843BAD5B1E77594682CA7820F0345AE0BBD73021C1427146

Phishing site detected (based on OCR NLP Model)

Source: Adobe Acrobat PDF

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 23.45.148.189:443
Source: global traffic	TCP traffic: 23.45.148.189:443 -> 192.168.2.16:49710

Uses a known web browser user agent for HTTP communication

Source: global traffic

Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189

Source: global traffic

Source: daa51dd5-4c73-4f6e-a4be-1d2246cd8d05.tmp.18.dr, 1d0a83cc-0291-4917-ac04-900261178b64.tmp.3.dr, 2d62c934-b542-41a6-aaa6-b89c000010b6.tmp.3.dr

String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Tries to load missing DLLs

Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: systemsettings.datamodel.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: settingshandlers_sharedexperiences_rome.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: windows.devices.radios.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\SystemSettingsBroker.exe	Section loaded: policymanager.dll

Source: classification engine

Classification label: clean2.winPDF@46/65@0/1

Source: DepositDetails_01205024DOCX.pdf

Initial sample: sharefilecollections-96166.grwebsite.com/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-03-29 15-55-07-910.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1568,i,15003637769907798127,16232566362215290703,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1656,i,18135951954436833280,6426284676420575564,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\SystemSettingsBroker.exe C:\Windows\System32\SystemSettingsBroker.exe -Embedding
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1664,i,11073650710475831001,5174923615738780206,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DepositDetails_01205024DOCX.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1568,i,15003637769907798127,16232566362215290703,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1656,i,18135951954436833280,6426284676420575564,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1664,i,11073650710475831001,5174923615738780206,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown

Source: C:\Windows\System32\SystemSettingsBroker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B488CB7E-98BC-4FA9-9FCA-E461728EFDCE}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: DepositDetails_01205024DOCX.pdf	Initial sample: PDF keyword /JS count = 0
Source: DepositDetails_01205024DOCX.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: DepositDetails_01205024DOCX.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SystemSettingsBroker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX

ID:	1417547
Product:	CloudBasic
Start time:	15:54:35
Start date:	29.03.2024
Sample:	DepositDetails_01205024DOCX.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	035c11c4d9eaa501b76a106cbb2b49b3
SHA1:	ffff7f09664c353853df20b964bbdb7ec43260a1
SHA256:	d92af11c2c12450613f9eaa98a14c8d95139b5a7e8c78b3591c7cf08982e2a13
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Windows Analysis Report
DepositDetails_01205024DOCX.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report DepositDetails_01205024DOCX.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
DepositDetails_01205024DOCX.pdf