Windows Analysis Report
U.S. Xpress (1).pdf

Overview

General Information

Sample name:	U.S. Xpress (1).pdf
Analysis ID:	1426964
MD5:	df9fd48d0c89ef5a450f1cc3bc7febfe
SHA1:	401b6af770346e5446eee26a1c87878f9f2c0afe
SHA256:	5d584b0051274996f4e3e3529edb6cab40317770d44fd2c15129cf6585d990b7
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.5:49714

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 184.25.164.138 184.25.164.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138

Source: global traffic

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: classification engine

Classification label: clean2.winPDF@14/41@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 20-09-06-176.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\U.S. Xpress (1).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,8927202370515218720,11377247752305104417,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,8927202370515218720,11377247752305104417,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: U.S. Xpress (1).pdf	Initial sample: PDF keyword /JS count = 0
Source: U.S. Xpress (1).pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: U.S. Xpress (1).pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
184.25.164.138	unknown	United States		9498	BBIL-APBHARTIAirtelLtdIN	false

ID:	1426964
Product:	CloudBasic
Start time:	20:08:16
Start date:	16.04.2024
Sample:	U.S. Xpress (1).pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	df9fd48d0c89ef5a450f1cc3bc7febfe
SHA1:	401b6af770346e5446eee26a1c87878f9f2c0afe
SHA256:	5d584b0051274996f4e3e3529edb6cab40317770d44fd2c15129cf6585d990b7
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	B118117A823B234BFA45A7FECAF6692F	5A50C8559FD971B6EEA4A20D8687674D4B78075D	1079E8471BD9310021EA79D90BD7CF49E44D26DACB43211A8B4850DAFDDD04C3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	B118117A823B234BFA45A7FECAF6692F	5A50C8559FD971B6EEA4A20D8687674D4B78075D	1079E8471BD9310021EA79D90BD7CF49E44D26DACB43211A8B4850DAFDDD04C3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	DB32017B4463C67BBB279368C94E8F71	F05E172B6371DA746BBDCBDA63C19BB8DA5533F6	1B5A6A4BC7D9CB51E11E388DC8DB7A809A56877E77A7E6BEF77E114BD1913F6B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	DB32017B4463C67BBB279368C94E8F71	F05E172B6371DA746BBDCBDA63C19BB8DA5533F6	1B5A6A4BC7D9CB51E11E388DC8DB7A809A56877E77A7E6BEF77E114BD1913F6B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	255B08032310A6CC741189EE0100C770	05392BEDA1253B835FA95FDCEB1744DBDFB218CD	3C579B60A2A38FAE34E31A8B20451D5769AB615D41930E363FAE300CD6BE0995
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ca64dd55-b7f2-4754-9cf0-a103886c1ad0.tmp	JSON data	255B08032310A6CC741189EE0100C770	05392BEDA1253B835FA95FDCEB1744DBDFB218CD	3C579B60A2A38FAE34E31A8B20451D5769AB615D41930E363FAE300CD6BE0995
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	1E0EE1811FB1D74810508413592A4FAB	E2A35A7FACB36C3155350015488361A156FFF535	B8F5FE181AA68C527FA8C8098F3CC1575D6D39A87D2AB4C6AB97E6BBA025E16D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	16D3C94D8EAEE0518B1595AB2A3B9880	0F4AC11C696C5650DE0EE31F080EC6C6B85025C2	FC3C1BDCAF92E6C6CB6F659E815DF5B4405ADDFD8A0FEC9C5A78FA6074C36969
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	16D3C94D8EAEE0518B1595AB2A3B9880	0F4AC11C696C5650DE0EE31F080EC6C6B85025C2	FC3C1BDCAF92E6C6CB6F659E815DF5B4405ADDFD8A0FEC9C5A78FA6074C36969
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240416180908Z-158.bmp	PC bitmap, Windows 3.x format, 164 x -136 x 32, cbSize 89270, bits offset 54	20C7AA4C94B7B8EB6EB241E309EFFA95	373CA9367AC0FCE1F178AB95AC96D5E314817CCF	65A30288786E5B35559065D3FCD14A7E24E72267AF316901D0D3D622624287ED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3276	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	BAE090D23B1C0D4F6DC247F0080D349E	8A7AAD52A54F9A3CCEF3CE323F6BBD5B2B530461	D7D3096317CF32DBEDF75D85390FE89A96170D44C09B2F6D164036064F506AE3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	0C4D94E53DFDB6B13BDC2DCD4163D1AC	DE276F260886BBCB092CF9DF743BDDE3C53B1F35	D2FCB4B0CBF75C4AEB43B271231875B240EEAC4544678EA6E33E091A22C11303
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	94FABE161365FFA5943107AC3061184E	961F50387E8DA646E3AA0DD614474DF929B25EA4	9EB1F6CCBAE26205990554C711110FC9F32202C203721051D045DA50C8E46B56
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	79928AF755B0047F398F1208BF016AAA	FDFD90A28B184B108180B8A49ECBC74418AA7162	78630CCD71EA852029E14E75C6EC2BC50F23ABAC556E24BAE2C7CA33159B75F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	C1893B7A8C7AD67424B6943A7F9D95CA	F11A75A2D28D9A279F7569F4BAE722117B4C2D39	D8FA5262850EB6D4DD6A1E08A28557839AE965AF39E648B15B1C118E015BC8F0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	77C7B99CD7E0FDAE496C29F2CFE76101	89AC5802A75748AA4754607AAA553BDC1CBC0451	CEA624E9F72BB9EDFA95924ABE720974A1D5FEF28BE2C100E143A0E384255D30
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	30BC535A3D0DB5ECEBB305AA879E7F81	7B8F41EB2CC132440C8ECBD42055B91EE882B6C2	F69A6D254C6014837B3F6D3B5ADD1CAE5B26147598CC9F7EB333A728368A7E0E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	1DB5C4BC793BB257A8B5A194CDA9DF27	B5F46250338BCF1E865F5BA27427D30B592EE67E	397F114B0E5EDEC8D8F476E4328C3CDD3E6E673A9553BA91A6E59EF610AF14CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	34849F67B2E43F3160EDBBFE8B3758D6	2CAF03001037F872C082B88A7606C4BEB6BA1F85	340FE6F80FB04ADE76CCB8F7AE9E644B6F86DEDFFE01F2CAB608E2C7B654CE6D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	1F8D02FADBCA357697DA3F4FE8E298AF	9C906607C2B5CFA730A576539A4704B6DEAEA897	119E9141DC1E8E1D3CD2F9ABEC6F0107E0C6D1ECBD90F27E259F559D158D8A5B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	90B0C36F9E3AD8342879D917D2BAF88E	34E3211BE62F21A8A9389D4356A82E85F000F900	311FD9892616B169BCC9ADEF654236F5B31E09EF4B9AE5095ABE88F740065C72
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	2A5F3EA5EC7F9F408011B7C2FAFC0FE7	322E48520D0E673ABBDDB262376C9666909F79DE	50E73BEA28B122E07062038F28806C6D52FE7913F2A669CECB00B5D4384ED1BE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	C1039990FFCB092DAC221DF63B2365BA	42DA879CE43844CBBB51946E45B0757847100BC7	F9F67773BC5D7D35E05BAD208739A4C5099B79FBAC6AA244D7EF71FA9FAF927F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	59D6639C0A454D8151866D0B3DCC169D	07E7879D374BB83A02852B7D4FC5609075E84CFF	E4719E698C204651E9A9E0389538A5358E746050684767AAB2446FA49B2F36FA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	A57C056D58FE51629387EA56EA468FEE	4771067413503003C1F969FD726B96BCCE770250	DC46912E7AF95DFC7C729ABCE0C2A60E781FEAFEB932C9F16946393E8F32213F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	059A2B79CA41709C36C90B1252992A5B	1BF75DD524EE821D5B4F14ACB08E55669BC37DDE	508A5202DCF652C96E13DBDEDA70E0AF71839B2B49CAB738CEC01DF8B30B169F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	1E6B50052EC3C73110CDCD57C4A47884	B340D1FC58C87EE8FADD77C9A3A12D33E98158F7	F2E995D7D4F58916CCB1FA32BEED9B69DA95F308E5FF2DCE2377BAA3BB9DFB9A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	BD0717CD212A27EDD61E0EB9969A3A4A	10130EE482D312B9BD7D7F0A7C17FFFEC198350F	91D2E98E58FC10AECDF5142C2C85422D41043F706132C0519FCC5EE9C6E68F19
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	6A6970714F06D2CAD1E8067A7A7A6720	26C3BCBAF1A28735353D93B00CEA3DC107B7797A	8CE04E27FF2C01A7B010CEBA85C88EF576E8A772679879D4D774CCA4A0F5DC5A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	8BD364809EB8551EB45A1727A44FAB88	BAEDBB0D03DE4E24FCEEF188291BBEE17B0913B7	A49B4BC2A4055251FFC734B6542FFB2A012B4DEA036E1A48FB1463054A816934
C:\Users\user\AppData\Local\Temp\MSIe8acd.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	49D417CCA784D834D276A73546B246CF	2610A9F2D140528619DD80D3FACE459B841DC864	101A0AF2C10992C740D0DBBA1AD319A3E13E0EDD18E61B93FE9C6700D88A0BE4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 20-09-06-176.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	AB0216DDABD4C8E9221CCF0D1AD3241A	5D0C0F26AE13FF2916CAC10EA8FD1FAFD9E8C65E	3A2ADE90347743CFF413DA4F10D45203F6D03ADAEA05FD710054408410122E5D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	CB22ABC60C46C5958EB5BA0088C6D66E	0367D7AC9BE648FC14F3FF6237B1D6FD341B1E45	7170DEAFA995656B39EE9EB5EECF5F01EDD08F617CA7D70E9405E0763FE73C59
C:\Users\user\AppData\Local\Temp\acrocef_low\0cd51b71-80a9-4e4f-9e20-e8623ba18bad.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\190a63f6-a54c-47ba-a0bb-0eefdbab3d6b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\5b8c4a8c-7b0f-4daa-8cb4-9b310240402f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	E787F9888A1628BE8234F19E8EE26D68	44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5	3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
C:\Users\user\AppData\Local\Temp\acrocef_low\cd2a7dca-8c5b-4eea-b425-494111bdb459.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD

Windows Analysis Report
U.S. Xpress (1).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report U.S. Xpress (1).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
U.S. Xpress (1).pdf