Windows Analysis Report
Confirmation Andrea Cuevas Sepulveda (Request).pdf

Overview

General Information

Sample name:	Confirmation Andrea Cuevas Sepulveda (Request).pdf
Analysis ID:	1428450
MD5:	ff790714bec9adb9dcc958b159555c00
SHA1:	4bb9d78b50fa65b281693a3cdaf559411d096a62
SHA256:	9d68bfaf1a38b71af02f835d87ff1e4f6b38a305466c7fa533151a87d1604511
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Phishing site detected (based on OCR NLP Model)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Phishing site detected (based on OCR NLP Model)

Source: Adobe Acrobat PDF

ML Model on OCR Text: Matched 80.2% probability on "Digibee April 18, 2024 Andrea Cuevas Sepulveda 318 Celulosa Arauco y Constitucion Golf 150, Piso 14, Las Condes, Santiago andrea.cuevas@arauco.com Dear Andrea Cuevas Sepulveda, In connection with the audit of our financial statements, please confirm directly to our auditors, Deloitte & Touche LLP, gdayal@deloitte.com the amount owed to us as of December 31 , 2023 amounted to $83,200.00 in respect of invoice number #7290 dated December 30, 2023 issued by us to you. If the amount shown is in agreement with your records, please check "A" below. If the amount is not in agreement with your records, please check and complete "B" below. After selecting the appropriate response, please sign and date your reply and send it directly to our auditors. Your prompt attention to this request will be appreciated. This confirmation is not a request for payment; please DO NOT SEND PAYMENTS to our auditors. Yours very truly, Rafael Nardelli CFO "

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 184.25.164.138:443

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 184.25.164.138 184.25.164.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138

Source: global traffic

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/44@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 00-06-08-428.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Confirmation Andrea Cuevas Sepulveda (Request).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1568,i,589966986038949355,13703487978581972660,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1568,i,589966986038949355,13703487978581972660,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Confirmation Andrea Cuevas Sepulveda (Request).pdf	Initial sample: PDF keyword /JS count = 0
Source: Confirmation Andrea Cuevas Sepulveda (Request).pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A95iut3n_efa1dk_5z8.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A95iut3n_efa1dk_5z8.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Confirmation Andrea Cuevas Sepulveda (Request).pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
184.25.164.138	unknown	United States		9498	BBIL-APBHARTIAirtelLtdIN	false

ID:	1428450
Product:	CloudBasic
Start time:	00:05:16
Start date:	19.04.2024
Sample:	Confirmation Andrea Cuevas Sepulveda (Request).pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ff790714bec9adb9dcc958b159555c00
SHA1:	4bb9d78b50fa65b281693a3cdaf559411d096a62
SHA256:	9d68bfaf1a38b71af02f835d87ff1e4f6b38a305466c7fa533151a87d1604511
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	BECACCA2D3585465F72E3939737BBC44	F72EAA545AC77C783C008B422E6D9E01D54A3204	C10E8D429B0D61935CFDBDEF396E893FFB831D8F0828264ED2F9EA3C6BC054FF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	BECACCA2D3585465F72E3939737BBC44	F72EAA545AC77C783C008B422E6D9E01D54A3204	C10E8D429B0D61935CFDBDEF396E893FFB831D8F0828264ED2F9EA3C6BC054FF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	DF496AE59ECF0F673E58B92C0B9CA8D8	0053F63967D0095114D351C06E3B3098A5AF8758	4505BFEFCCA6482C61C9F60538259B235A5D2957EDCFE7C6520E222F32458C8D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	DF496AE59ECF0F673E58B92C0B9CA8D8	0053F63967D0095114D351C06E3B3098A5AF8758	4505BFEFCCA6482C61C9F60538259B235A5D2957EDCFE7C6520E222F32458C8D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5b6a8fcc-f09e-4a7d-8e95-ed1613379993.tmp	JSON data	0B0CD26466D235B08D7A0C67E113B97B	94C1F0A35EA7E45C3C34E5E1B8C43B55CDB47BF8	E899D4232428B44F07ABE39ADA55C50DC606BB095EF3E4C58BA3BE95E6F38DDA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	0B0CD26466D235B08D7A0C67E113B97B	94C1F0A35EA7E45C3C34E5E1B8C43B55CDB47BF8	E899D4232428B44F07ABE39ADA55C50DC606BB095EF3E4C58BA3BE95E6F38DDA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	55DD2288FF08E6D3FA8CEFB12450B278	72ADBC1792516475B33491D54E61625AE6B1A0DD	F914F742097A63CDE4B59E3066DE60A2A61F33258366DC90F1F404D1C8B189BE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	2E4202405316F89063675E8C04AF73AB	5A3B7D82B2EB2DDBE61143D509ECC22CB950E49B	4992E8DCFF679357542C418B9C8B84DD51F7F386416450106AB712B9C766D569
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	2E4202405316F89063675E8C04AF73AB	5A3B7D82B2EB2DDBE61143D509ECC22CB950E49B	4992E8DCFF679357542C418B9C8B84DD51F7F386416450106AB712B9C766D569
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240418220610Z-153.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	8C8C61270C69AADF2D60A9722AF8300F	25E3E0747B7B6B5CEFAC68E41C74546ABE339307	906FB1D2EC24E419C98206263C766F725A874D62B366A4FAEDF9AD0350E5C435
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	FF3D19FC4397C049D64F17AB0F4B9D70	80575DE298C9B77554B8962B9BDF130F255B1CF6	7AC5288D7BE728D943AB8892D39A5125C01857056C4A33277CB9798B1474B2EF
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	C4E82721611D9A1D4763456B640E2B28	97F654368251CB811289EB8DDCA6F05639098EBE	AF125D2C79833C0C4AF69867ABD218954BE3F3189D3B4A403E7EE6A58E3867B1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7748	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	F0A089B3CC61EC09482ADFD4FCEC2626	2F37112A99767361D193ACF6D857ED002C80D7F6	B44BD62F10AE356BBB53F07250349348D6A74E97C969A25B576FA52174B9535F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	F679648207A2318E278661939ECB7A4B	BD1E6832FED04298BCB79BA53D18B48CC04827F5	0E386B6853B747B6B263E48228200DCF3F666237867737E25C261653422E0316
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	8D658C17037BE33CEFAB570FA428D30B	34EE81AE7607FEE8A06A5DA49973FBD6F5B86073	06C69798DF133D1D0C6559DD7701FC98191B76CFD503E9536A8A1178D0B1E6ED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	9D778E097297E117655988B15CB51299	ADAAC8D843AAA5BA84774C44B91CF94B2BDF7C08	847E32D820887A59B5E7BE2372C1E51BFED02C40ABC968B5732A6D2C2DD26883
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	EF05C3DF22F505B15EF6DA2D25D864C0	6504BEA64E2A2C43070AFD3D2AA5A07B0BECC7B3	D57407D567450DD2822CB3AAE8CCED6BD7B2962CE75847370174F3B1BF0D37A2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	F339B108C91E9FC915C20EBBB707F6EE	8A125AF73293FF50EDCEC843648AA1AF2E87A47F	96C3480EFEF65F0AED40BB2E923E805ABCE3C7EEC525EE6593447D948ABE6D03
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	87EBFE912F38A755413756BEDA071676	C7C1C07C8EC52F4F1F5AB93E185BAAD442B5A50C	583587FF4E719FCB28B77ED5E9204F401689D45468326000C85DFF604D21F5F5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	20596F0178D9D356CAE56BD2165359B6	DEB330F71092029950B115AAF5524D1C825BD27E	B3D9D3F5A2305F7BCDE994DF3141241AD2911181BE927CF2020B85C921A1A404
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	F92153223C654F50558D90CE72DCAAC5	E6387FD262C2D11ABE0CB3CC24536194A0EF0F1C	CA462B9E876B67B2BEE759EF2347F0C2E43CA4EC5F59A5D2866E8057D59F284C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	7B7A9DC72578FA103D1D1300637930A0	E8C9456A147DDE1C53D6C6D78AADCFEF960E858C	12C48BB41DBF2EE17B741063B5DD9C5AEBCA47C0E0349819DFDD3D75A7DD4491
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	5241D1D917535CB35D6ED25233020E98	3B84CA4C685AD880E59FBE7DA6F6E93A076C07FB	A1B008D17179AEBB5B1C2F711789318D94FC16677FAF7D364B6E19F2E5A2702B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	93FB2FAEEF988DCE6EAC44F492607D38	805E7BFFB290459D77DD2690D41B391C68B6B6E8	90465BEB430190018777BC0CCB273BDC82FB706342B29BB2BB84C866A4F1E50E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	F1263953DD40EBB8C332CA01247B4FBB	2168B0EAC05037C0226DFF31D698B12D487C9CD3	22F0DD607C72CC9016293EBFBF7D9D77B8A8985E3067FA18E8B710953505900A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	C11EBB147251CCA3AF544E3B642261D4	B838430E4F3C3DAAB678C9EB36B464EDFA5EBB77	3ED27DFFDB033D64CAFE3132B6CC379BEB8785E4E587AAA302D3A936AC88E9F1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	B94FDE6B5EDCD571E1FD5F38399FAB2F	43F39A6DC90869887CD3D8E4BF642A2D148F9AA7	1D232630C46D838D93A3DC61ABEF18C98AC2B0BE41D68264272AFE13B0C5922D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	F520CE67012E19022AB19129EA8D2714	C48E6EF327C38B8CAC2AA2611BBE74A1204315AA	8D10B59A364415CB3C658CAEFDFD699F0FDFA3CE5C294FD96C3A2F9864525FDD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F939E3EC0C30F5C58016C81B24EBF8C3	C0FD0C380614A0BC1E2C345DA297C5A27A950A41	6C6EAEC7224FE43199C3B8C4DEB488EE606978792EE8EF357ED38103ED1BF65E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	8382764D72A6060D864B126079C4B8FA	BA021176361BF9F4536ADC784560A3BA7FD8A6B7	6AE39CC94058D09C5E217994F032F06DF7B39293377E6491292E4E4C55869794
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	F15F0035D337417097DA8C321928548C	F5416887B11B17566698C20F76195883CB8A1115	143C80D72B960C77607860192EE28AEF0C44B69E63CC0F6A9D1743C4DFB9F1FD
C:\Users\user\AppData\Local\Temp\MSI44177.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	82939DFF30BA51EF9BD7FAD0E95D1FE3	86C3CE083B8C8582C6272B1613AC7FF405BFB110	749B6C280B5AD31648CCB4A6140CBAF52C376BF142AA37B2866CA58A72CA7A62
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A95iut3n_efa1dk_5z8.tmp	PDF document, version 1.6, 0 pages	B56F2A36DC2CED1D2DC8285B56B31A97	5383B10367E07339C9B3F7F0AE32FD4220ED1471	CABD365AFBB5F7BC1E7CCE11215A70B3F9F30E7B50B3E977CB9CFC4AC7F21538
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 00-06-08-428.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	CC8D244BEEF4EACDAFBA568AE721A54E	C5113EE7E5F6D37BEDCF6A8EAA1F6EC31FC74EC6	D4254D7A9F764842D868E9BB22632458B9B899C0F313EFB36146A3EBA9B7BF34
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	E8A10785EF99F635A54CA083C77E5F8B	8A34FEF5E2A9C516355B0F72BB97ED76522D70CC	2AB9EF5DD6DA78122F3B6C0EDA57DCB9DCE0B93306828034058E8A5DF269CAD4
C:\Users\user\AppData\Local\Temp\acrocef_low\518aecae-ae07-42b9-a3ad-0704a5c78b4d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	13F55292D0735B9ABD4259B225D210FC	810CC5D545BFA11D2825F6E1DFA69176794DA7EC	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
C:\Users\user\AppData\Local\Temp\acrocef_low\8a9bfb8c-db3f-4d2d-82b3-0c92158d2a46.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\a361586b-12a5-4232-8125-c6e077619939.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\ddf33fcf-e54c-4db2-a0fd-5500b6e7d7e3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
Confirmation Andrea Cuevas Sepulveda (Request).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report Confirmation Andrea Cuevas Sepulveda (Request).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Confirmation Andrea Cuevas Sepulveda (Request).pdf