Windows Analysis Report
FEFR237_f090161469300000000ED.pdf

Overview

General Information

Sample name:	FEFR237_f090161469300000000ED.pdf
Analysis ID:	1430407
MD5:	cddb06f6ef3ce9ce2c7056d5f55ad7bc
SHA1:	7d8dac629cb54440f00974428c7751fe2b206a98
SHA256:	7bb5d08f5bc407547f7f865ff4f31206bbcbcf2f0611db8e19bd80baca404c52
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 192.168.2.16:49705 -> 23.48.8.182:443
Source: global traffic	TCP traffic: 23.48.8.182:443 -> 192.168.2.16:49705

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.48.8.182 23.48.8.182

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.8.182

Source: global traffic

Source: eb47be62-ab09-45c0-81f2-4dde5ca78183.tmp.3.dr, fdbf1166-0c26-4580-b69c-7a8d9f1a83fa.tmp.3.dr

String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: classification engine

Classification label: clean2.winPDF@15/45@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7064

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 16-21-48-109.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FEFR237_f090161469300000000ED.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1552,i,18417824236284609083,1796295958897842713,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1552,i,18417824236284609083,1796295958897842713,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: FEFR237_f090161469300000000ED.pdf	Initial sample: PDF keyword /JS count = 0
Source: FEFR237_f090161469300000000ED.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: FEFR237_f090161469300000000ED.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.48.8.182	unknown	United States		20940	AKAMAI-ASN1EU	false

ID:	1430407
Product:	CloudBasic
Start time:	16:21:19
Start date:	23.04.2024
Sample:	FEFR237_f090161469300000000ED.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	cddb06f6ef3ce9ce2c7056d5f55ad7bc
SHA1:	7d8dac629cb54440f00974428c7751fe2b206a98
SHA256:	7bb5d08f5bc407547f7f865ff4f31206bbcbcf2f0611db8e19bd80baca404c52
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	5D649AECBF03AA6EF452B287916D9DEE	16FBF040364EE7460CE2C61A3ACDDE7C3CCE3CA3	F15DF804D5F2A0A688DF07622C9B596A92A9C819A8077AE1B0A1184E6077E5CE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	5D649AECBF03AA6EF452B287916D9DEE	16FBF040364EE7460CE2C61A3ACDDE7C3CCE3CA3	F15DF804D5F2A0A688DF07622C9B596A92A9C819A8077AE1B0A1184E6077E5CE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	235B35B03FE8FD02EED2E72222D1365C	C6BB2D37586D87C10845DE2EF6AE48AA0D0D109A	6B8932FE9D98C32391D81FC58B33ABAA37E7299BC6687B3F2D6E5F97864791FC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	235B35B03FE8FD02EED2E72222D1365C	C6BB2D37586D87C10845DE2EF6AE48AA0D0D109A	6B8932FE9D98C32391D81FC58B33ABAA37E7299BC6687B3F2D6E5F97864791FC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6a4070.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eb47be62-ab09-45c0-81f2-4dde5ca78183.tmp	JSON data	F8C7494B6CDA324AA68A9AA27C4C8CDB	2D16BC3C8C57B461B15EB1B24D348C7264F5C4A3	3F4346BB2CBD93EAAA91DB8A02D25459C7589A7131F00FDEB5FCB28CC09782BF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fdbf1166-0c26-4580-b69c-7a8d9f1a83fa.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	2F6F93170B9F350763FC6EE5CE704840	3BA7D994DF36302562EE443AEA30427301937313	781D7156C701E7DF4406EBAD9E82A79143ABFF0FA55B119719832BFB1A94E48D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	4AE97C678D3818B12031EACF768AF7BB	506AAE5304C55AF8E5DFFCF3C8A8569B1F4D264B	C06E51FF9518321081CE899DFFB525C657821A37DE13E1132EA5D22DDA08B711
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	4AE97C678D3818B12031EACF768AF7BB	506AAE5304C55AF8E5DFFCF3C8A8569B1F4D264B	C06E51FF9518321081CE899DFFB525C657821A37DE13E1132EA5D22DDA08B711
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240423142150Z-170.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	463827E61EF66A539F09F0E057C59607	0AF8878C5C57C3847A6EDB7DA82975B110ADF33D	E6A16E6F1327C6765DD690BADCB82139CB8F8E16996FB19E3332D0A2275C0ED0
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	9FBC96E5C36FAE06376F3F234058D44A	4F82D7CB355AC787D61CDFBA7A4CEDEEE3719738	C0B57168470783BF65B077F8C62E53EF73209D2A35C4201BD87842EF1AFF77EB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7064	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	38108919D6491AF19A968FD2CBA7BB1C	1127AD5A81B08F52520E4D0004BD62EE7891D34F	1782A62CAF6859C2D44EB5B9D63571315E5F6B547473D2EDD4D83BD33B58CC30
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	E3A75A91C1091E6CC450A2AB4E3F4B72	8757B82E74A97012B93CD264F0E4B19C5025419B	57AEFB7C4B430621DB61A1066B8FEA4962E7FC7AF880DC6F24674E3B7C62D3D5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	EBD2CF38C903DBD5A1631E40A44D8BA6	949CF00C4F6F3687E11215F86677826A4445123D	16D3AA45EAFEEBA437E4DD4ED7FAE1186DC1CE8D8A2D4F51D82C5807AFCF4161
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	393C7CC335C89DCE5E6AD9104F1306E6	97442527F84291C5600CE9EC829A4AFB413C9CD2	2E156907938FDF8F1992C39529F0210201D7C2DE5A2B59692C0EC1D90914A379
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	4326C22BED6DAEA4E72EF0029551AE7A	F4445A5C12C148F74E6F0860EB40C5121B555D77	5E9889CEF51C81855B5B8179C79AF96E247D71A383ED5C38133F5899DAFCBC37
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	A5D6982310CE54551EF3E9F33C76180C	052F060F77C6225511CA01749BCC3247348AE323	4C98A50C86345170FF76C9AF423E3F4DC11FC0C8CE6A5D2750455E95536B8CE9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	F681E32C0304DEC08C61D3BBAD54F638	A506BF0A60924B4BF4CACF1A46D6C454B38A40AC	E9C1EF885B9ED30B036F13454F735754E9F4327BD4F825F66B7A21287A430472
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	0C6A2EB3255D6FF9AEDCBA310512FC40	9686DE31195925DCCCC0B579388FC606B1321F1C	0409C4079BDB1C2B9BC01491C988DD4A0745C0A4BF3761FC66E9D56FFC217AA2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	EDDC114F517531A831507B2F68C6250F	42715163EFEFC8EB0DB8A29D9E37665AA731369C	80A989154BE3AB3CFB336726D5BA532BD1333994E5729CF6CF63EB5605D64638
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	71723B098676E26EC433F4A4729866DA	FB96268F1740D87CBB9F748B6692EA7755A4AB81	ED379D951687A31AED36DC1FB6EE796BAC914889360B7ED8C0C8933741BC42AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	5B1769EEC8A26CC4661B0563946BB5E1	6696BAEA22213F2467D8937801B27A3B7FE30784	BFB0FF13D5A4D9EBBEFD57B6A70D111E569CED73151B26D94AD02FA7AB6782D5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	A20F24D8B68842B5FCA3F38CF55BB3D2	45315F9C53CFCB109BC016A9A992ADA57CC42194	D83C2EEA7F80B98618BD47C7E788FD4BD4150DF5199D40227A8302AC9D5356BC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	BD78948C0B4298DFECAE209F444F2651	182FCACD4D458DDD4B0F064776F8FB9C53E508DE	235188E3F596452D81279A187FB2A311E83D29311E75DBA130F34945899A5D92
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	C0B11D4381E36FB09389B69E0BD0DED1	6E8C4221330E9AA1DDDE483AB7C851DD5232B28E	ED5706A761B3C2987AB50641E02BF95A0A383DD0946743840CBCB23452BD215E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	D723A457EEA759F8866653D2C4A29AE0	B780312AC810B79102E0D21292A1D0E94CA253BD	ACA9D36F67CBF77CB8A91FB30F29049E781C108172FE7F1644F61C5EE8C3E4D8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	1162103BC3DF6C4B3856761ACBC3F724	419865BBC48A86B0E9F22B25E74ADBD510589449	BCC532EFC44F0221A49C480C2C574AAF76950229770BF481D842A4479A6161BB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	88DE7405F193B4E813D01DCE5E975223	2FF5AB153FF958CE5A4D0B80A48260841ED535D1	780A2DE9FB85912585CC69421EAB63337D9A62235147C6A5F6B400E8DE900150
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	4BFCA9570C655FBEB0A60B008D0616CA	68DD52540EB2FBD2241AC3375375D59E57F6893A	7F1D51B645736FC0001C9072CABEF8B0F964F7ACC75A8C8A6FFD6090D763499D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	E8B305B6A7F1037A22A814BFA5C945E7	15308BC5C733F7A492035716F053C7CCB8F7E52D	6613F44DF7BBB51FAA8ED7F1BCC9BFF9FC5E8ACCFD47F160E533F9CE19A6E21E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	2DCD01EC4234FA333467F22F25D8DEC1	F2CDB134D524CF4B874AFD2FDE6A2E337414540C	FC6B3429E804C5DCDFE78619C5E23BDB0D3E8A2E375B522ABB536B339F75978F
C:\Users\user\AppData\Local\Temp\MSI9ef91.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	4A3C6F469D73A2A9B5306ECC9795F920	8D4978BE2B26159FC83E641BDBEC297D192134FC	EA16AD7FB3B92828D169B142F983C072AB210D2B8FED0BE050208C76EF7888D4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 16-21-48-109.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	EE2F26D9D7AD9B83BF35A2BA055F0E5E	14D3F27A51688EE5D77DEB30A29075E240CD18CC	32DE9E06118625369DD60CEFF5E280E507780FAF1F06AA7D3C9CF447DA2F5F39
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	A683F7E4FD28A779A00C2DDE20EE6BF0	86DD5CE6F2025B125328D535F2B10A25B5B955B5	CF447EBDD21196364DFBD4E054F1CEA8A3F313B6AACECDB3F1B37A97C87BC572
C:\Users\user\AppData\Local\Temp\acrocef_low\0c820881-fe4a-4fe6-8039-a883fe29432e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\5dd6eb18-b238-4713-85c9-ae7ab8423ff3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AAAAB43627E96B02BC54A78F0EE8E32C	03808205C51BA031BF69F0DF07C9C80835098104	B9ED5860C1528CAE5717E553381762D9C4ED093E546F7500F55B6B18B5C20CEA
C:\Users\user\AppData\Local\Temp\acrocef_low\620ff524-463e-4982-9f17-b639a0a50ca4.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\f8098cd0-a471-4190-807b-9cd31b98e5e8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC

Windows Analysis Report
FEFR237_f090161469300000000ED.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report FEFR237_f090161469300000000ED.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
FEFR237_f090161469300000000ED.pdf