Windows Analysis Report
W-9 Blank - March 2024 revision.pdf

Overview

General Information

Sample name:	W-9 Blank - March 2024 revision.pdf
Analysis ID:	1427110
MD5:	4e7f7065f6e4a526452ffacb0134bc50
SHA1:	3c265a136ba7fa236cdfc7b8f8b7853ed6c63e08
SHA256:	2d420cbb4123dcf1fb82595b2359cfbb5d81f00b9df9d359fcc7af361d093f53
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 23.54.200.159:443
Source: global traffic	TCP traffic: 23.54.200.159:443 -> 192.168.2.16:49714

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.54.200.159 23.54.200.159

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.200.159

Source: global traffic

Source: W-9 Blank - March 2024 revision.pdf	String found in binary or memory: http://www.aiim.org/pdfua/ns/id/
Source: 277dd1d6-3c9f-4726-b373-68efc296bc69.tmp.3.dr, 8848a2dd-243e-41bc-921a-0039a5e3c480.tmp.3.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: classification engine

Classification label: clean2.winPDF@15/46@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9491l1w_169jtfc_4u0.tmp

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\W-9 Blank - March 2024 revision.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1576,i,17669440550934361566,2057664599773174521,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1576,i,17669440550934361566,2057664599773174521,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: A9491l1w_169jtfc_4u0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9491l1w_169jtfc_4u0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: A9sbk45l_169jtfd_4u0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9sbk45l_169jtfd_4u0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: A9m1c204_169jtff_4u0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9m1c204_169jtff_4u0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: A9491l1w_169jtfc_4u0.tmp.0.dr

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.54.200.159	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1427110
Product:	CloudBasic
Start time:	01:57:16
Start date:	17.04.2024
Sample:	W-9 Blank - March 2024 revision.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4e7f7065f6e4a526452ffacb0134bc50
SHA1:	3c265a136ba7fa236cdfc7b8f8b7853ed6c63e08
SHA256:	2d420cbb4123dcf1fb82595b2359cfbb5d81f00b9df9d359fcc7af361d093f53
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	5D6BC45FB7008CE920EEF51F0C5A29E2	817D9A3138809C9848C2E9482135EFF74579E139	09F424697F28F889BA84E28F4A09EB035053A837F43680ADF5AD4E68C4A023F1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	5D6BC45FB7008CE920EEF51F0C5A29E2	817D9A3138809C9848C2E9482135EFF74579E139	09F424697F28F889BA84E28F4A09EB035053A837F43680ADF5AD4E68C4A023F1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	943567F8BA3F40F765C4919091BD71B2	FB4EDD0DEAED8F763A21810B0D79E0FDEF863563	F5F67791BAFB969085D61CF28AF77FE9725A1CDAFF1A1075B56A13EFAA3ACB05
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	943567F8BA3F40F765C4919091BD71B2	FB4EDD0DEAED8F763A21810B0D79E0FDEF863563	F5F67791BAFB969085D61CF28AF77FE9725A1CDAFF1A1075B56A13EFAA3ACB05
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\277dd1d6-3c9f-4726-b373-68efc296bc69.tmp	JSON data	657F6C75329D3AA08F4E8DBE302C07DC	93DA91F24B1A1DC1E0F2966B3002DD2678379747	715CACE1F4F1E51623F56EEA0A9765BA7F349C3C9C6B168FD764ECE42F145ADF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8848a2dd-243e-41bc-921a-0039a5e3c480.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5dd78f.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	90A006B22AC5301A5297E61F6329C1D2	8DC487F49E9B7B7EA833E0F74C548572315B7E46	CB16C3C04F6530B677638D5C9AA0CC78D768B1485AA3A4B30A5E0FD16F4D02E9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	BA3D7D9AF94AB3DA7506045AE23872C4	8DF995F274B280539D180BE5D2903F02B879F747	D10CEF105CA057D35DC6A406F5B5C5AA8F1EBB57929141D26DBB9867ED811C6B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	BA3D7D9AF94AB3DA7506045AE23872C4	8DF995F274B280539D180BE5D2903F02B879F747	D10CEF105CA057D35DC6A406F5B5C5AA8F1EBB57929141D26DBB9867ED811C6B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240416235758Z-276.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	64F36373DD14F2D05E45B3430EABE0DA	6B293984AE01F9253421DC20BDD718644F4DB4F9	D1E3F20F275AA7B1BD1E31D606C2A1FDB5AB0E400BE608517039BEB408AF0565
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	2DD0B6DBC3609ECD62F0D0CC160BF68D	484238314BBBAA96DC2CABF984ABBD2972C7654D	D6DD29DED7BCA7D858DDCCE4E4DABE4FEBC116E625F5F88E422443975D5BAADF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	133E86228BB7B7CAD2CFF801FD4C9C0A	203E3D2951163862D43F00F20F155857AA341005	47607FE4973200CDF933215099E099AB9D11C0F022D151C18819577AC414C0AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	C696A63C6F32B11D2BC9EF514E3C0322	079E502F5023CB14D13BF65353979517AF9B26FF	FEF9A1BE3ADCA773EB8906F8F7886973CC59098F94BEF0C0B2794C28819897CF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	858733A8FA906F9611E47851B5FD037F	7EFF231B4F29F20167A8FDB6EED1EBA4C347FD31	B8A170E80BEEA166420E1F841A1437E1CF31B22FFC320CAFBE771D1149CEC7B8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	DEFBF362E16AD9EC0ED847C5DA210434	1DB95D466AB9F9F134B37F70EB63347FE6E4D4A0	9880C2C4EA25C96BBE5597B3F5E026494EAE73A15A0137E682A230CC8205A092
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	89EB9CC13C01F2058E582C33CBC8417E	8B17E4319829BC0FD3023C6C9C45C1688EA23D83	B1BD7E8CB0445931FB57DC8916CECC97E68404AE72C9773449F5A4FC7F07DB58
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	DEC37824BE1C6F401DF5C540E34749BB	B9772E41E4696F2CC338C8A1977E04759B81C869	06FD1C3BD920ACC3346A3D40F43918AA1D2F710EC513E91BDD76B03D8BBC101E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	F2DA25A8B6DF229237A60BBAF65A334A	87B16A732BA87E43731280631CFA5DFEB53ABDB4	ECAC5E62CF7FCFB9713CDC5ADDA2FE6171B1E5AA5DD0BED8DE2DA2A553E955AC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	DE0C5ED1054D7937F24E3622D4E3B7A5	FD5E3353D2856649430AFF288882C6EA92ABC84C	83D8961AD26B74EA698CFC5CF917D611C820431154E3125411D4914D70525EF4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	D200DAA156AAF673703DE58FF3BAA4DB	4AA276B4961B87FA2D709B871E322F24962ACE3E	16BFA370504D52F7F6D138AE09DBEB962BE0919A8F7D3701439E3606E856EB56
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	F2717EE14567A2E464CA37037B65B142	BDF94A3036CBF0B3E1F6AA6E9F5C632BC89D700C	43DB24011ED29CFB277D2B3A1AC2330DAF369BE7BE2FE77431B7C5F462AB1679
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	2661BFDB32BB997FF300F765C944ADFD	8BF91A0569CF0780C41060D2F3C9270177E0D175	971C95B2AE69A139FDF2D68DEC0B104224ADE0A67F6726C13A4B076905479D43
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	A692F1EA9D3EF037F8A8A8BE51260D92	0E86924E43C9FFD170AC5A93F6988F7CE440DEF7	5BCDD0EF8EAEEC0AE62FA9C6DF74483F0F25F3ECA2925A8C742E5647655D2A29
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	4B7325B5A479FC78BB82E0A006C44E34	BC96AB9C7A3D50793C6C987612B7408199B3C29D	6D107387AE6C3C550A0503707B0F82F505CD52BF533B6AB898D4BC9B7A8B3A66
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	23E4D7D98B1B98E805FEE5B2770CCC33	D22E9F562D41871986E6068020DCEBE9A02A504E	AD8409AB98D5CFA8FE52C44525FC9316FF159361E6A0470BA5A304C675259BAA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	7C1233615CF5FD8F8758C8D435295D66	29E0F657F23DEB9D1192D7BAEC2FFA8393B9D39D	CB87FFFA809971790330A374DF39E288F3D9F501F673AD6CB566C40D281BC1BD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	BED6D8F0D60AABBA5FC066C2D4F8B7BF	FAEB714C20D5A35A78148B18038C2CC657F2E0A9	782E497589C74A5821E372C5CB38EDA1A79B6C0447ED24A1D1DF779364C65372
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	744AE0CB61EEA6C0AED6E4B968B2A319	1F08CB41F7E6F83E02AE2BEB0193DEA02A652F29	5DD62319AA7DD1D74B4C41CCF824EEABE69E7A3610E5BBDA495F9D694FE7FAEE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	507995DD73452FF540C7707A61C67DB7	8DC4ABEE2D4662B3B46B1C1EE492B78C5D350E56	53D12DC98A4C81589A96EC8A108444EBD524CA7DBD27B5B586017F75DC469F1C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	E1965652DD842D786D51BBBD5F4A9CF2	6C188F8D6B84AF67A95914EE1B36609C64450944	C810E01402D0255ADE209E5FDEDD88B1C3EEB3E461B3575E5825B3B4350B1FBA
C:\Users\user\AppData\Local\Temp\MSIcd0ec.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	AD2F902B4800A7E86C825D1A59C1F189	7D3D83E29341BBEB52A7FDAA6BD985299D6832CF	0A7886F2D1CFCD7D5B55EFEA0BC3F16417F53E65092469ECE6C57D061899EE19
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9491l1w_169jtfc_4u0.tmp	PDF document, version 1.6, 0 pages	2DF23D079FC83EAE8114D25CF4A634AC	9CA71AC208EDE2BA0257D6A45E2952C26BB86A66	53E65E7F4B95A55E719397CEC703A41E32E0C6EA8C7334322A5404D270F206BD
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9m1c204_169jtff_4u0.tmp	PDF document, version 1.6, 0 pages	592075E11999BEE229874A7ED2ACA2F3	06E46BFE89F230EA86AEA71C7B19CA2A842F7502	C085E35FBEB7D414BE7846E7A28D55106376444969F81EB4FF41BDE32C1EB3C9
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9sbk45l_169jtfd_4u0.tmp	PDF document, version 1.6, 0 pages	F97AA699D6F4DC9FD50FBB082C6E3343	CF39E438F2D23755C8A87AA6751463C9927DA7CB	F4A83AC8E27433EBC2018C1F42F1BEEF58BDC7150E878468E61692F80D6B0B3E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-17 01-57-57-386.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	81B38F74129CB9C1A084DD88060AB41D	9E57BE186D698B131D993CBDF7A3E1DDEC24430B	E0455E64A8922EE8C02D338E11CF3D4BB330CC9A85D4C72297F9E476240F3A01
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	5020DD61018F8E21AB9E2A7F2F3C27CE	0F159C73ACB880E4D50C8939C9DD7150BE9315B0	B95A5EC1A85DD7179C1CB8D72667FB10206D96334A8F218E585570E8724A9044
C:\Users\user\AppData\Local\Temp\acrocef_low\2fbb8b65-71df-4186-8d2e-d2ae6b0d1ff0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	59EE5E2FB56A099CAA8EDFD7AF821ED6	F5DC4F876768D57B69EC894ADE0A66E813BFED92	E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
C:\Users\user\AppData\Local\Temp\acrocef_low\394ac64a-43b1-47c5-8a41-edf99e4aca24.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	FFA982D6F2F9B46A1DECDD28BF3EF0E1	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
C:\Users\user\AppData\Local\Temp\acrocef_low\67134e13-5502-4003-a59c-f2122a9b68ac.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	774036904FF86EB19FCE18B796528E1E	2BA0EBF3FC7BEF9EF5BFAD32070BD3C785904E16	D2FC8EA3DDD3F095F7A469927179B408102471627C91275EDB4D7356F8E453AD
C:\Users\user\AppData\Local\Temp\acrocef_low\bd1ff109-7b0f-4bfa-802b-cf2c3032c774.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators	32FCA302C8B872738373D7CCB1E75FD4	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6

Windows Analysis Report
W-9 Blank - March 2024 revision.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report W-9 Blank - March 2024 revision.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
W-9 Blank - March 2024 revision.pdf