Windows Analysis Report
E-statement_TVT_7855563201716.pdf

Overview

General Information

Sample name:	E-statement_TVT_7855563201716.pdf
Analysis ID:	1426957
MD5:	418a36afc8429c6ce3ac8f6375aa7e0a
SHA1:	51cf287ed2f761a01a1ac2b1a3dacbde606e592b
SHA256:	8638e1d486d21cae05baa6ec5ff22d1973c211f37d40f2f5bb48c8267bfdb891

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 192.168.2.16:49708 -> 23.46.240.131:443
Source: global traffic	TCP traffic: 23.46.240.131:443 -> 192.168.2.16:49708

Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.240.131

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: classification engine

Classification label: clean1.winPDF@17/27@0/43

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7084

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 19-56-47-840.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\E-statement_TVT_7855563201716.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2268 --field-trial-handle=1568,i,6974506343822097808,3129201781754671408,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 9D6A312AD69722ACEEB2B510127921AF
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2268 --field-trial-handle=1568,i,6974506343822097808,3129201781754671408,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: E-statement_TVT_7855563201716.pdf	Initial sample: PDF keyword /JS count = 0
Source: E-statement_TVT_7855563201716.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: E-statement_TVT_7855563201716.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.46.240.131	unknown	United States	16625	AKAMAI-ASUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.220.188.152	unknown	United States	24319	AKAMAI-TYO-APAkamaiTechnologiesTokyoASNSG	false
34.193.227.236	unknown	United States	14618	AMAZON-AESUS	false

ID:	1426957
Product:	CloudBasic
Start time:	19:56:16
Start date:	16.04.2024
Sample:	E-statement_TVT_7855563201716.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	418a36afc8429c6ce3ac8f6375aa7e0a
SHA1:	51cf287ed2f761a01a1ac2b1a3dacbde606e592b
SHA256:	8638e1d486d21cae05baa6ec5ff22d1973c211f37d40f2f5bb48c8267bfdb891
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F42E2E73F42E8DC59CF6404165F600E8	7C41D32EBD13BA3803F018E9102BFBD4FE1B92F9	37DC5D43B70A9725F9919E1FE8194D2F3151AA94846507E6510179AAB8FD1425
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	B583DE90668D45F93187402F356608DD	8BCEC6C5F3D76B80E24D2AEB2BBB909D9DAFAF2F	D2FE6BE8EF2402EE005B2BF94D6EC17C2840E8C5DD0675BEB8CB83DEB3B8E97D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	F05C6F54BACA71F5E2098A055BC40F11	CBD5D20D3765E9C16EED6964ECD0B656159B8A26	6961A426057B5D196C9E22C07CA67CC919962B1DBFAC28F974515561A028582C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bdd27cdb-ebb3-4e58-93ef-98895f18e3b0.tmp	JSON data	F05C6F54BACA71F5E2098A055BC40F11	CBD5D20D3765E9C16EED6964ECD0B656159B8A26	6961A426057B5D196C9E22C07CA67CC919962B1DBFAC28F974515561A028582C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	B7C32E8DF1260033D57F9D607FDBCCCC	4B50390ED41C08EA2CB239AD4189D58667521272	1A68ACA82E61BE7030AA9C8C53861398FDDA6B186E9A6C87FFCB36976CFE24B8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	1D75C6F87FBB585C904219B4017536AC	50A4C7C03E31954D15237DDEEC6DA5FC66A7F4FD	EEFE578A49AB2A93F55D2B0FF3F005874DF9BEDEEEDB31A098A918279142602E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240416175650Z-159.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	00DB8ECE00238719F9D531102091F31C	2C93F28D42D242532093FAB1BB7DDE33EEE810D5	95444CF39A1424F48C5D069EE1F263B613F89D22C379C4A2886F6FBE160BC00F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	B0E68ADA6E14E8A73F7BB3695AF47C27	6599D5B3D05691F406811D95C15DC106705CC4C4	8DB0DDE6DA0A2D9A258AF6FA448722B04EC334CEE9C5E3A0010F94CD6BADE8EE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7084	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	98E2BA2B550663E9062145FD710FCF91	9B8D2B6FF467AD585A610C84EB5A002631AB5BD8	06EE201D48E611F528EA7296ED40731D0EA654CF84D051FC2F83D74A749E4DBC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	A3C9C0FA0B10AB31C8BD21447F2CBCFD	C30D4BA9E7EAE9B2827FD5F84EC1546AC52CA233	746B22E73E10EBAAD3C6756030B1644A795A7E5F2F8A99D36F4C77D8DB7664A8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	02FCF3B8F71434D59C7FD13561DB473F	E8F6F1857962F897ACC5F9AA247ABC599CC8BD15	A7B56317EB969A76445C8E5DDA6441D7459AA7DF77C49926FFB2ED76EE509B42
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	98964AF0360E45BF21CC9F4D707A5734	E5280921F46E1E08C5AD7F04D88DBABDF608E898	DB0584853A6AC8AB3939168A74CF8B52D5238CF8F626C2F3F223745A3509D9D8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	9BDF0DF3BD57C29B50F6B68AB4DFA279	BDEF35C6D534222273EDE0FBB215CC70216B86F4	77D8E8414FF6C8A3E0D802C403FC849495AD6F6125A18947D5B97D2F91479B90
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	4918BEC279E60C320C10EAEC6A9616CD	505AB5F45EE4DDAFE5B0E759342A294BFE7B593B	F275D37A16128CF950C390B15BBB06F11D717BD26C42D5495BC4C67EDFF523FD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	601DB76F629A40CBD98F69C97F40AE16	2DADC15D74AD3BB54E13581F191B3158081C1432	85523B80A327A79703331365312475862B79E8E5E62BF545A703178E925ECFEF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	989EE020CD3ED8B8ABDC5958A3A3C966	446D64287B5CB4DA8122D48B137613CE97338C99	A5950682805304F98CCF92ED39947C4425922605543688C8F0689F7100300A3E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	DDF4D8B9CB79E7C2EF8A4A5C49090DAD	BD1B6E42C712DB09CB776D67A2739B98DB21429E	CE39502F8022D3D8E3E0E3467EDBD3561645F1248E9FDC646EDC21D8D02922D3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	53E9B0ECD5F16A43514E996BE4CE64A8	82EC3B60B84640D0723649A38378465CB84BA6B2	0D6D7B90EA9D4E4DEE0C4EC74889F0CC3C641AA69016996747B85EC7EE8AC3B9
C:\Users\user\AppData\Local\Temp\MSIc9f88.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	1A2C60E0C7D0609C0B3EC68752688F91	3CAF3C256FFC561FC10E1DF10A22444247F671A2	410B385EBB8F3988BDB192A1510C2CDBB09C8D9C96538B8C2F747DE93F425488
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 19-56-47-840.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	0457B83E6FC352FD1EF3FE73F65A270E	95A1D07D2FD65A774B3EFC3EDC732C11F9A537BB	269153CE42450714019B48B71DB236120484F52D1F241A5B04660FC563895EB0
C:\Users\user\AppData\Local\Temp\acrocef_low\5d605bfd-da48-4f01-8bfa-c8bae2e3b985.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\8de901db-7396-466f-a702-76f5afed53b9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	1A39CAAE4C5F8AD2A98F0756FFCBA562	279F2B503A0B10E257674D31532B01EA7DE0473F	57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95
C:\Users\user\AppData\Local\Temp\acrocef_low\ced7e1f3-3301-4da1-bfcc-a5171470ce33.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	207450D6B117C53B842582BEE9AAD59C	1461AD75274ACB600EF67AAD4621C3E949D894F8	D92A0BDDEEE3AC93BFC5490300394E0C8FA0FC1DFADA8A36CA146EEF262142B7
C:\Users\user\AppData\Local\Temp\acrocef_low\d7ee736e-1e52-488f-8cca-096207892408.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
E-statement_TVT_7855563201716.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Windows Analysis Report E-statement_TVT_7855563201716.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Windows Analysis Report
E-statement_TVT_7855563201716.pdf