Windows Analysis Report
W-9 (REV. March 2024).pdf

Overview

General Information

Sample name:	W-9 (REV. March 2024).pdf
Analysis ID:	1427026
MD5:	4e7f7065f6e4a526452ffacb0134bc50
SHA1:	3c265a136ba7fa236cdfc7b8f8b7853ed6c63e08
SHA256:	2d420cbb4123dcf1fb82595b2359cfbb5d81f00b9df9d359fcc7af361d093f53
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 192.168.2.16:49715 -> 23.46.201.17:443
Source: global traffic	TCP traffic: 23.46.201.17:443 -> 192.168.2.16:49715

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.46.201.17 23.46.201.17

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.201.17

Source: global traffic

Source: W-9 (REV. March 2024).pdf	String found in binary or memory: http://www.aiim.org/pdfua/ns/id/
Source: f795339f-6183-4a17-a53e-f055cde0f985.tmp.4.dr, 996abf3d-4caa-4fea-aaf6-efee5df46969.tmp.4.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: classification engine

Classification label: clean2.winPDF@15/46@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9w5t6z1_10v6p1j_4xk.tmp

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: SharedDataEvents-journal.0.dr

Binary or memory string: CREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL )Cd;

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\W-9 (REV. March 2024).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1584,i,2641897468703573433,6327094948391134971,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1584,i,2641897468703573433,6327094948391134971,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: W-9 (REV. March 2024).pdf	Initial sample: PDF keyword /JS count = 0
Source: W-9 (REV. March 2024).pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9w5t6z1_10v6p1j_4xk.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9w5t6z1_10v6p1j_4xk.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: A912gg2v7_10v6p1k_4xk.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A912gg2v7_10v6p1k_4xk.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: A9zq6pl0_10v6p1m_4xk.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9zq6pl0_10v6p1m_4xk.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: W-9 (REV. March 2024).pdf

Initial sample: PDF keyword stream count = 76

Source: W-9 (REV. March 2024).pdf

Initial sample: PDF keyword /AcroForm count = 2

Source: A9w5t6z1_10v6p1j_4xk.tmp.0.dr

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: W-9 (REV. March 2024).pdf

Initial sample: PDF keyword /ObjStm count = 17

Source: W-9 (REV. March 2024).pdf

Initial sample: PDF keyword obj count = 86

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.46.201.17	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1427026
Product:	CloudBasic
Start time:	22:43:24
Start date:	16.04.2024
Sample:	W-9 (REV. March 2024).pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4e7f7065f6e4a526452ffacb0134bc50
SHA1:	3c265a136ba7fa236cdfc7b8f8b7853ed6c63e08
SHA256:	2d420cbb4123dcf1fb82595b2359cfbb5d81f00b9df9d359fcc7af361d093f53
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4C1145656880B8C6CB634BBD7A5808CF	B0317E8991E13C6BF3955E3F086262DBB2D78F1B	487E9FE954A9C428A2B5A69AC3B7D71F73E92089762866DCC8E72255E73D1D8E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	4C1145656880B8C6CB634BBD7A5808CF	B0317E8991E13C6BF3955E3F086262DBB2D78F1B	487E9FE954A9C428A2B5A69AC3B7D71F73E92089762866DCC8E72255E73D1D8E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	C79F304728C21DC204AEC670759FD1A4	682B3BD5ABDD3C7225B88C8DE3E6727BAEE151C2	C268FFF39D9D4D8205FF009071B8E567C0CD90B6A5B87268C919670626BDABF2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	C79F304728C21DC204AEC670759FD1A4	682B3BD5ABDD3C7225B88C8DE3E6727BAEE151C2	C268FFF39D9D4D8205FF009071B8E567C0CD90B6A5B87268C919670626BDABF2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\996abf3d-4caa-4fea-aaf6-efee5df46969.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF603891.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f795339f-6183-4a17-a53e-f055cde0f985.tmp	JSON data	82A2A4B0C7C09747BA5583F543EC1028	7156E64AE6C15C6B42B1E62AA8930883DCAB26D1	A59E1993AD74A3B33CFDAA88C2C90FB32170784168CBE5DDE8E17FDCD37A67B1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	61F251766AF01D6B29F46144EC5663E8	710C3114F6F1A3A27EF802F24078A5D9FDFAC3EA	70536E36BA7A66DA2999CB9A32A4B37E06E8F15E8CAE3D8A977FDD05EDC76258
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	A6A717AE982F3D8B2049419F9960B449	4CB6753456B5054B1CF9B9B5A162858DD722BB11	72C0A7E2159106C141A5AFC90C94CE438F0FC98884B016B5EEB0E3DB32E724C9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	A6A717AE982F3D8B2049419F9960B449	4CB6753456B5054B1CF9B9B5A162858DD722BB11	72C0A7E2159106C141A5AFC90C94CE438F0FC98884B016B5EEB0E3DB32E724C9
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240416204403Z-262.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	64F36373DD14F2D05E45B3430EABE0DA	6B293984AE01F9253421DC20BDD718644F4DB4F9	D1E3F20F275AA7B1BD1E31D606C2A1FDB5AB0E400BE608517039BEB408AF0565
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	7046E5D5109F475D70B56B8E44DCCD0C	8BE43222679512C563B82DD9E90D9C88F356D5F2	D1780E734F96B7B62B2A37FD5656EB0359EA6C65969F331A3CCA5AD8089F1521
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	BDFC0738B39296C69E4A98EA4497D4F0	D8A4044A140E0872A845ACFF10A52BD1275734AA	B642EBA0619F308BD8D58C8D7A8C6274FD7ED1D6A012D33783055FFA4722E027
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	8796048A02A57D025B4F1948DBC99A1A	18FF15FE44A41DB113006264B1DBEF59A137FB73	4F59B0EC2993B41D8303D7B75DA2E182ACEFD1128BA6E15C060490ADAB82A6D7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	2392E7D57DF03933C5049257A64CE41D	BADB4F4A38B2A75206A1E8B2B2B1801C9CB172B9	8050E494996C1E2CF492C540AF1D642ABFD665E175F782EBF4C34C9B5FFB8D36
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	2595B70A4A6784DAB2702867CCBE904D	77261F79C63F9D8B976D2A5AB16BFE0B666FDC03	AC3B04CA7D466F642EA77D40D01375B655B93C24749D394ACEA1160E5497F539
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	778686093256AA8BA323E30F153DB654	1EB249847DE5122BE165598542770A15B4496CFD	08EC6CF8F35DF4BCD4AFB01FFB1A55280B4905309B50F64DA54F3A4FACA3A038
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	99F88D569D3A61E2FB13590E575B68CC	79DD70B07CF4325C9522E872002598DD8932E43D	A77543E2E5B3E5E7E14D4DB996E938A87EEEEA7181553246C44F440BA66D56FA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	B1EE462A01EF308402454CD174722759	B49BA21BB8AE3CCDA2DF10D485C06944C3A3B081	013BA33613A810AB37593FAB079593EBB11436376C3E7404375AFB708E723105
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	4CF9CC100B65CD2C1256F167EC714891	E7BCDA40C09D7DC1819675DBBFA3F1E832BD6C7F	0612E946EBDC7A9663A30C342B0DBC1BD4F991B5DC002295435D53AED6F549C3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	F48CBF030899122C4DA0C83821DEE334	C1EF54F42CE881651E23F85384397AA30788B023	F1AC0F3D0758C2E6FD5501FBADD7E542FD74685DBAF766492D44FCFDC8D33688
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	55165A3B1A748D09C24CF19F80B58306	D2AAC87A4653D33DBBBD69B9B05C7AA85E67B2F3	A226A751344CE6A9B97437CEB2D540152767ABC240AC3C06FF58127E209DA700
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	4E40C70D111F59A34A70C70145DCC259	A4E4493B90316EF0DE2BFCD9C1D2587C8FD326D9	A831D30D5003EDD3632A0BE43390CEF066B6D24BF809E44DAEE704F3F63D2A32
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	C6387A48C38C959B4CDB1EECA1C8E639	50BC5F091038EB4C0409DD35601E630A20A36285	7954D2EB34F4352C21206E90292F27FBFB14BB8B874C2E6C137EFA711E624921
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	90687099F547E520DCBB74BE4F5995C2	748C68F4280A3A9203CB34AEB811FC27C81D2D72	DE125AE7994D62F167E4B35F3D4AB04CF0512982D14044B95E8613622615A235
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	7B12330DE58B136A25344D91AA1F7795	66B2A82593A9B9072B2A672D5E312994076B64AE	0DA97F927EEBB4C3598DF2DBFA2F5A548314980AECC91846FF934108469A9DD0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	EFC9E3601EFDA6856F8D25E611C735FA	9869EEA717E495191FB7FB1109CFC12DBD82BE62	E01D3B53179E98807CDA503272E1B37291741253EFB4A5250FA311C238273DB1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	DF06EEB115005783176FAC307B14FA0D	2615DC24E4CBF14CF1FF400425313627501B2D8F	6B146C2B473A2FEAA8EC46A80A1C4295688857FE8999CF49239F957CB2F9BF93
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	53D082D7EC156090ACEE314EA4EBF6A5	28F95FCE9E9D87204E2A614D076D15785370BF82	B3BFF0E5E0771A12A7BB45E19D1DA0318131E745EA147634B331A53F6FB4DA6A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	D68F621702364F2B4A938C62D82C96A9	66C178DF30A27E9920DA8C64B18EEAC5FA2F4E3A	DAA204180352572BC3D11DAB0FC6A4D9DA79079466C9D7A4AEF5EBCF0614B11D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	221C6FC9763179C35E48C9F3F206351B	23A5E4D862B4858F5B7865D9C690DA1D1A9C5D79	9D605B0CE311571F0D7B1CA8ECA24F03C5F378FC1C364974BEA478AE3D659DC9
C:\Users\user\AppData\Local\Temp\MSIf2be4.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	C43EF410E1EF99A9E65C7207E3E358AF	E518C4190E8F7A86A2CDDC8CAF034D613C74D48A	F290DA8C0F66FAD72CEAD08CC98BE178A8102AF64B2565B43C7A2B500E7460AF
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A912gg2v7_10v6p1k_4xk.tmp	PDF document, version 1.6, 0 pages	952BF698F6B6921E0DA7C273B1DEEB4E	CC12E3C71638866461A1D795308535258169CF7A	917C5CC6470224C79F6FA83AA38552714F6F4DD4FBEA15FF70D3F5FBAD39780B
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9w5t6z1_10v6p1j_4xk.tmp	PDF document, version 1.6, 0 pages	57CC433F5E721A1303677ED0420952EB	1250EBFCF833A93F68BF49CBADFB58C2723A55EF	67BB464477111A8A41553EC4EF89723EEE4F742FF8712DEBF1DD69C338403270
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9zq6pl0_10v6p1m_4xk.tmp	PDF document, version 1.6, 0 pages	AB81E54998AAF474192B839C56520FBA	84B8129B8E06B1979FD319595DCBE1DEE225D058	02CA5B6CF8D72C4E55B8CF4EC815C88277999F8FD176FA5D002C7E7966315511
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-16 22-44-01-739.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	0104DE3C51693D647A96B3DE88F4F4A4	74D7906C672F377656BC10195621CBEC2F0ED783	23888ECAA9BD4E5F17F5D2F25E0C0C26C22B67782038F36C62213146A99A8077
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	3194CF187CF2B4D207756F283033B187	A3398F080C4F27062079909426B6F84C900088C3	23D95DE3E2FA346CE826F3F55DBBB676E95B5C93D274092276B187303B4E4187
C:\Users\user\AppData\Local\Temp\acrocef_low\207e9add-5485-488a-b2c4-2d87682dcb57.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	E787F9888A1628BE8234F19E8EE26D68	44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5	3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
C:\Users\user\AppData\Local\Temp\acrocef_low\5c2a5076-effc-4338-b1b7-159e3053eb21.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\8244aa5c-cce9-4a7f-bb4a-3bfe137eb94d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\d71ddedf-6d06-49bf-ad4e-06b05fe5622d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	16CE9EE406421C4550426BB11DF0B5F4	308299E79688EB2F31ED9541F04ADDB5FFB6C1FA	51015E606D0E8654DA47E0058B408B6A12D025C41D1655EAB797E9DAC618434D
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators	32FCA302C8B872738373D7CCB1E75FD4	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6

Windows Analysis Report
W-9 (REV. March 2024).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report W-9 (REV. March 2024).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
W-9 (REV. March 2024).pdf