Windows Analysis Report
FICHE DE GAIN 2024.pdf

Overview

General Information

Sample name:	FICHE DE GAIN 2024.pdf
Analysis ID:	1427901
MD5:	9b71bdfa35a3a3e158eba22b8a3b9c79
SHA1:	c4e0a964d16872b36ee0d7f7e3097c0c14541b30
SHA256:	744b12b2d5b62e78fdadae33e9da2a635c96e10b3898af252f3fcc66eab5adf0
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 104.123.200.169:443
Source: global traffic	TCP traffic: 104.123.200.169:443 -> 192.168.2.4:49751

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169
Source: unknown	TCP traffic detected without corresponding DNS query: 104.123.200.169

Source: global traffic

Source: FICHE DE GAIN 2024.pdf

String found in binary or memory: http://neevia.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443

Source: classification engine

Classification label: clean1.winPDF@14/44@0/1

Source: FICHE DE GAIN 2024.pdf

Initial sample: http://neevia.com\

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-18 10-13-41-697.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FICHE DE GAIN 2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1672,i,2245883855589128702,4143463741450360039,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1672,i,2245883855589128702,4143463741450360039,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: FICHE DE GAIN 2024.pdf	Initial sample: PDF keyword /JS count = 0
Source: FICHE DE GAIN 2024.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9134hnii_10z2654_c0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9134hnii_10z2654_c0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: FICHE DE GAIN 2024.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: FICHE DE GAIN 2024.pdf

Initial sample: PDF keyword obj count = 50

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.123.200.169	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1427901
Product:	CloudBasic
Start time:	10:12:48
Start date:	18.04.2024
Sample:	FICHE DE GAIN 2024.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	9b71bdfa35a3a3e158eba22b8a3b9c79
SHA1:	c4e0a964d16872b36ee0d7f7e3097c0c14541b30
SHA256:	744b12b2d5b62e78fdadae33e9da2a635c96e10b3898af252f3fcc66eab5adf0
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	82349CA7CFC477C6D8550C5AC88B42AB	39205DCFD8022267CE6E0DB5191857186C9C0565	DA7AB78D65D2510FD6F88F56074D149A098914ECF83D7D0DCE38895C6D6FE0C6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	82349CA7CFC477C6D8550C5AC88B42AB	39205DCFD8022267CE6E0DB5191857186C9C0565	DA7AB78D65D2510FD6F88F56074D149A098914ECF83D7D0DCE38895C6D6FE0C6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	84E33C1B7234DE04C104F70959CABD56	C509C9A2135CA2143A39EC2874CB963107C070F1	72A1A846AF63302EC4A9CC8D6367C3E73569F6D5C23963A11E35642863A8B571
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	84E33C1B7234DE04C104F70959CABD56	C509C9A2135CA2143A39EC2874CB963107C070F1	72A1A846AF63302EC4A9CC8D6367C3E73569F6D5C23963A11E35642863A8B571
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	79FD142CD8A1B42CD780BCC456FBBCEF	702BF4D241CD4769A3A4F512C7FE0895D0EC4FB8	B3169A52F8CFB3A9EE8FA7C5325718397B623BB6DB02D8614438400E29166D1F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e6bac22b-e512-4d78-a913-9b4da19b78ee.tmp	JSON data	79FD142CD8A1B42CD780BCC456FBBCEF	702BF4D241CD4769A3A4F512C7FE0895D0EC4FB8	B3169A52F8CFB3A9EE8FA7C5325718397B623BB6DB02D8614438400E29166D1F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	BC79F19DCC577F7F9CABC259E1C2CC78	39DA012BD9D528D192AFFAD8AC0C6AB3B863E44E	CB54F1EA86E51F301B9AC2B51147DA41A8A9EE01A23B8FFE08E5D32B1C2375AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	CF6FC19A31D4E826B47C531C88D01883	782FC1BB406AF12887E8A16D4238435CF87238CF	480A47E174284E4B8C09277443860F5A1801FC122885A2B33D5FED716FB08A68
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	CF6FC19A31D4E826B47C531C88D01883	782FC1BB406AF12887E8A16D4238435CF87238CF	480A47E174284E4B8C09277443860F5A1801FC122885A2B33D5FED716FB08A68
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240418081343Z-163.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	7046622CA00F2C45E5CFADE689354E8C	A17E912B39A2FD0B0C6B20BA84765A230384EC11	BE1D0EF88A60FBA55830726ADAD04B9DF8464BC7E45B44644E45853FBCD3AAF8
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	DB4ADC6235CE6095EFBC350C0D8BCDF1	AB242C90E5335D31E0A3D2DF9B721C7E74121E6D	3E057667E45C28F4152A5C9FBC75914650D6C3F44E493C2949D6CFBCC4D3B50F
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	800169F7CAA1CA1B44128066AF798A27	3A61C87D28E10E6F900391E37386A0B21E6D8424	FB9D7224A3D3BFFDE44E61D386FE8D47B819BA9DD576FE15D29C42B75215D490
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.432	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	57D6F3C0DE75700BF1EFDFD1F00A4582	3BCF5E56A2AAC596FEEC6A6DAC2B65A3D3E3DC2D	DDEF8BF63DEB2F573F1AF1D6689F70B1694F0204E021883BC418858047EBFC5F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	3052F35BC5AF5DE00FC779ACBCA45527	CFC4E2A1F4001C805C0C6C5A3ED971668465884A	149477E29ADA762013363C27AB972D16F56874E430654EA1AECEFE5A0AC7E63F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	258C8432117B137B52DAB970F1C8C248	52745050F7E16A82BB1F77D8A752A6C8B844A92C	3204D6A66F105012DB01D50A2CC65AEEA31F4975874E738BBC4764E66CA1C3B1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	E8B11758725D0DF98B4C0D407C8E2D65	15DDFCD90BCF9946971FD2ECCE786623A76F4CC4	49479F2E8CAD6780E9ED7BC5282B342290FBD531E8F47FD1ED2341789584C8FB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	B7CB2D22235DDDCE1F2CEE0BBD55DD19	393AD8ACE0F1931A87C69FABA698D5ADE3E9CDF6	83E9D2833FC71FDA429C60FCD62D935D42028D4D9DD99A4F9EFFECEEB8318A8A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	1E5B8337AEAB07A276A98E1AF81125BE	540CE19BDC5A61B4437EF04E34499D4B2FBAD367	F554B685FBF6462AC30E8A2B4AA349A54BD28F8A51EE577B37652FFACDA91989
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	2109F9198C1C1E9D6781C3711B38B70E	3FF8F9F19E1C8208316BF874F721CDE9321C9723	9EF9C3F17CAF4FA90AEB57DABB8C00A8F34E782AD075A416E40BD9D19A533B10
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	32E0B18F75A8A3FECDE581571C525B36	F159589BF789E6492052C68F9842D59811016981	22E44F0F7B74AF62F7809C263C3E181167F430AC7BCEC6C95C8C2CE20E6D931A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	794C447E820939CE1AA7269DA89B67DE	55BD2214C426AE30E0FC4EC35786CE489016AA33	8A0EE4A2FE64BF05B50F342B6F8DE8722E545F3E3E0312AADD506EE093267778
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	12564171DBBC823555259D0315C1E267	470299E3369D3D0E7C8B0C6E47E729E8A2FA3B9D	7AAF6BE0552E8488C493A13C7AFB75363870594A3A0871E66A92B0872D2F2663
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	A7D31FAB7E07E0D582A56EAE06F80DFC	F7306D8A6D713CB11B7C31154930CA80C1DE0C48	DC2E5CB30A9A316973F7E7B1EB5044FB99753A0C950FD5B9CF20B825682AD5A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	44CB77CB1128850E0635DC5963C79011	2573A49EA58F52BC177830C1AD297F4C5CE6ABBA	58CCD3050192AC5A5C1B930CD602FFCF1F8A4CB039BD6E3B00441B84C7E38E19
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	02C75DD67F24940F9DCEDB2E5C642AF6	1D0F0B6872E73B0C0E7ED8E78BD13F13AD63ADC7	BF4A82AC121938FB9198AA234032F00C7CE3E538A09D78867186F35A6A6C8616
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	D5308AEEED6DAD918000F6A42B5CB08C	DE89B7DA2957FB7B5EA30AC9175CAAA4B21C2729	E98D1FDCCFE757E732D25A7BBD7711FEDBBB60F9FDD8995D803591394641DD39
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	AC5BF037A8158580BD0F2BE8B8B073E1	5F58EA8CDC19EEACE36D84836524E4EB8AD29200	5C6FFAAF392D1CB2FDDC043B3BE19313A4A849171A479B7E00363117016528B1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	821D4C2B3FBD601990EF2ADF10788C1C	9462B43924160AAB864804EF77437EC70B11032F	49D895D37457FA68372AF2B39D062D7BD41DE99274E27D757D41EE37C2410C23
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	E8FA17D60F671029002752A174876D19	7FDC8F7F957A24CDD28FE5604FCD957DF488BBF6	859112E2431DD309FBA63E2D7B90AA35229B4E559FD3F21559468C2CC9F35B0A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	A0E66063FE0FDB3DA9E48B80E78CC8E5	163E7E10058394B8B5CF81E2F6F5004DC37E5F12	FFF017BCC40679771AFAAEF6F03D0D351DF66B1D695A45B364687912F231445E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	1409BCD702CDB38516C2777985B8B421	F308089A19C303BB1D67547B3C7A40FCF597739E	AA006F79D62A48566B4C11A0464D06CA6681E69F04A20DF3B675EEC97D6D29FA
C:\Users\user\AppData\Local\Temp\MSI95e1a.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A3C14026DF4562E07557D67D0F383045	BF2F0BD0E3CEDDABA850EE72B9379A7DA546A2B3	3A11733727B399B3358214B7CC482C18816E67D0056AA11A110F1F6EC3998D9F
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9134hnii_10z2654_c0.tmp	PDF document, version 1.6, 0 pages	6ABF384C53C330C9E31247C2EA67476E	1DF7D850EE546BC85C86673E15692CA77EC67BDC	77E58A44810D574DF240A4FC766C277C62CCF368FA1024305E1F74EF4F4C59FA
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-18 10-13-41-697.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	5F8C176A7F024D1BB1912A37C1F0BF4B	B620BD58F6DE979F9A74EC9856B98639BEA32A61	DCB4D3926A6792F2F1B45BEB196C061BDF534C7720124BDB2BAB8B2A30353C35
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	E9CAE47F5B8594ED1CED7A81A1C76CCB	CB5AFE8A76255EADEF28A0E664A6680E8F873050	1698BABD6A2A524CBE603D60FB6134D47989BFAF6E0D8A64D21FAFFDCDA8D053
C:\Users\user\AppData\Local\Temp\acrocef_low\00310207-ac81-4d22-9640-dee75aae0360.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\3dc66295-831d-4907-892b-2af48af921c9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\a91a770a-7ad1-4394-8d34-018fa1452276.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\b7cd88c5-1422-4907-b244-949c501ea5bc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
FICHE DE GAIN 2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report FICHE DE GAIN 2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
FICHE DE GAIN 2024.pdf