Windows Analysis Report
87003962_317456885_12-APR-24_361171175001.PDF

ID:	1428854
Product:	CloudBasic
Start time:	18:02:15
Start date:	19.04.2024
Sample:	87003962_317456885_12-APR-24_361171175001.PDF
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	aa4cd0f8e9356c607ff80dae416db7ff
SHA1:	6335fe701b586124361287a1327382ffb5a242de
SHA256:	01a2879a23b49e3a68c182d20726ec7944b160ab377f15fc336ba2da3d5ce176
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	C38C4773BBB9B0FE8ED7AE111DB588D3	522DFD52A721D32E9FE4C4C4DC61C848F31043EE	7EB2D08E7708EBA245D086F3B5F5389F93B2FFBDECDB88286D633804B80E2A77
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	F8C58583DA0F7070A7A6DBA900544D17	80B92C6667B248A8F7B643CB2B5F001E6CEC7C23	8D09025DD1803CD05A8CA841D25C7642A16F45A39967C029D59118DC18305362
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6511ce01-6c71-4b23-b72b-7f931537f664.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\753d7db3-3018-4277-b686-7b979a6e06d1.tmp	JSON data	25CFC87559B0562AF402A067BFB9945E	DD912E81C6333750AD53AD0909EEFA99C18493A6	160B86887613CC27A959E71B7EEAAB92BC252D1A1C19A6D6E4075CCAC348585B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF46f1fc.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	94ED742C0E720B9680456F4C1065D938	EC01890AAB0A604791421FB1FBED3ADE19FA9C9B	68BAFFF64A75D26FC666427F51B47B243FEED03783145BE04DAE23E5A1EFD82A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	36A543F53AF88DBE9A93A51FCD0F97A8	9770CE9D7B003E073DEC91C6CF709351D37E73BC	61D8712A2CFA9B2A59249CD65EF565C098F2C0E322AE272269A7C45F52533615
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	F56DDCBF8A49786539B8E0C9802D8DA6	AE15DC8852474AE78D5648C5607E6BC86515353F	FBEF7CD173F7E022D74AB61DD9F4273DCF29AF6E941823F9C4C184792A1A2BF8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	00543D7CEC7C2054A1FDBA37214D099B	B82D14C27A014D95FA86D6DF55C30BB5B5C2B7BE	FB4D89DB2C870A98BA0430434F63654869B0FD8485701BBCFBBADFA8E69B5007
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	102CAA76C4F1A9CF0943EB7A67CB0E0F	1D1BB30CBA96B3191334BA123C041527A639E42D	069423EDADA650391AF3FBC10D30A558371B490022F87474561C76A00C5CDBA9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	184CB9BB0977B07E22695DEA8D5E2EA6	4F02E952FB29B391AA754C042431B2A1C5FD5E32	62173EDB784D861040F75FA40127DF83FD6D002B76F97842EF95795951921012
C:\Users\user\AppData\Local\Temp\MSI5e57e.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	68BC8CB2AEA0261AE341470DED0A644B	11866F79F88025A50F2367220F1B571678B7CEDA	9851BAC224EBAB95B326F3DA1600C590FA7C1CCE414D91F6F357B7F0C9DAD250
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 18-02-49-436.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	4A87906220088474BD6F49643326FB32	F8CBB4693D2A4CB6E3D201FD88E6A3F38E2DDB89	0CB2AB2ABC5DC8EFD188DFD301F51C375A93BF6996644466F35B9AF72BD6CBA8
C:\Users\user\AppData\Local\Temp\acrocef_low\84a8bbcc-1276-4e27-8273-91e84742df36.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	408F8BA5ED5014C1E10FA19D75C944A6	87595F69D692B4D785AAFAD71394426879C7980F	FFFE47EBC7E157F63F4BE40AC0B2DCD73A5DCDF57B9D03FEA3EB99212A7EC16F
C:\Users\user\AppData\Local\Temp\acrocef_low\b465d672-9f0e-472e-8920-2d17833bafa3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\c28ad43f-1f99-4f99-8454-15bdea7cdb8f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\c28fbcb4-51a6-49be-b776-774e5b461076.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	1A39CAAE4C5F8AD2A98F0756FFCBA562	279F2B503A0B10E257674D31532B01EA7DE0473F	57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95

Software Vulnerabilities

Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443

Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.25.164.138:443
Source: global traffic	TCP traffic: 184.25.164.138:443 -> 192.168.2.16:49709

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709

System Summary

Source: classification engine

Classification label: clean1.winPDF@17/19@0/43

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-19 18-02-49-436.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\87003962_317456885_12-APR-24_361171175001.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1568,i,14145993654298625133,17833504530766648335,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding DE61680B44F398C7C0B5F5CB15DB05EF
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1568,i,14145993654298625133,17833504530766648335,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 87003962_317456885_12-APR-24_361171175001.PDF	Initial sample: PDF keyword /JS count = 0
Source: 87003962_317456885_12-APR-24_361171175001.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: 87003962_317456885_12-APR-24_361171175001.PDF

Initial sample: PDF keyword /Page count = 56

Source: 87003962_317456885_12-APR-24_361171175001.PDF

Initial sample: PDF keyword stream count = 115

Source: 87003962_317456885_12-APR-24_361171175001.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: 87003962_317456885_12-APR-24_361171175001.PDF

Initial sample: PDF keyword endstream count = 115

Source: 87003962_317456885_12-APR-24_361171175001.PDF

Initial sample: PDF keyword obj count = 181

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation