Windows Analysis Report
INVOICE 135658-01 04_17_24 08_19_23 422.PDF

Overview

General Information

Sample name:	INVOICE 135658-01 04_17_24 08_19_23 422.PDF
Analysis ID:	1431080
MD5:	8b179c7d9c4def7dff212f7fc1530d9d
SHA1:	202d0211391244ac7ed74c7880def34a8f5a1624
SHA256:	523491fc16aed3938f9d74b19ca5d73abe72cecf085cdabbefd0a75d8740a704
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Phishing site detected (based on OCR NLP Model)

Classification

Signatures

Phishing site detected (based on OCR NLP Model)

Source: Adobe Acrobat PDF

ML Model on OCR Text: Matched 87.6% probability on "Phone: O Fax: z Terms: Due Date: Price Extension Quantity Item Number Rev Description Pack Slip# Ship Date PO Number Order Date FOB Ship Via * *Any and all disputes of amounts billed mus be raise within thirty days of the invoice date. Disputes beyond this point will not be honored.** Subtotal: WIRE/ACH CHECKS Tax: Freight: Total: This invoice has been produced electronically and is valid without signature. Thank You "

Source: classification engine

Classification label: clean0.winPDF@15/43@0/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.332

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 14-47-03-284.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\INVOICE 135658-01 04_17_24 08_19_23 422.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1604,i,13522873780708684326,15572357352614556485,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1604,i,13522873780708684326,15572357352614556485,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: INVOICE 135658-01 04_17_24 08_19_23 422.PDF	Initial sample: PDF keyword /JS count = 0
Source: INVOICE 135658-01 04_17_24 08_19_23 422.PDF	Initial sample: PDF keyword /JavaScript count = 0

Source: INVOICE 135658-01 04_17_24 08_19_23 422.PDF

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1431080
Product:	CloudBasic
Start time:	14:46:06
Start date:	24.04.2024
Sample:	INVOICE 135658-01 04_17_24 08_19_23 422.PDF
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	8b179c7d9c4def7dff212f7fc1530d9d
SHA1:	202d0211391244ac7ed74c7880def34a8f5a1624
SHA256:	523491fc16aed3938f9d74b19ca5d73abe72cecf085cdabbefd0a75d8740a704
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	D75ED9B8AAA894883E0F75BE1756CAB4	4833DDBBFB2A52DB08D4C945515E9E158A9A6549	7529636862A8213680C9AE2A012EE56F20292C7BD997582BF39D8D4175927420
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	D75ED9B8AAA894883E0F75BE1756CAB4	4833DDBBFB2A52DB08D4C945515E9E158A9A6549	7529636862A8213680C9AE2A012EE56F20292C7BD997582BF39D8D4175927420
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	0026E833F08A8FADF1B9F06BEBD89E9C	6CC4BD2C83B9EBD3CE8B4414B3F1B67950BA2CC8	6F6BD8E9DE6CAA7FD6D9B104CFFE81A79A1CC80573EECAEB7795B53BA98525CA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	0026E833F08A8FADF1B9F06BEBD89E9C	6CC4BD2C83B9EBD3CE8B4414B3F1B67950BA2CC8	6F6BD8E9DE6CAA7FD6D9B104CFFE81A79A1CC80573EECAEB7795B53BA98525CA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\464fa6b2-750d-41ff-96b7-511bb7f655a1.tmp	JSON data	3426F540646EF0285D2AF302664C708D	799824C0650ECE7A2A0A5AD4CEC66F92DBC14F82	50546C83B9369FE56C1737B4A8E166B6C26F159285D38C06EC2AB56AE76ACB73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	3426F540646EF0285D2AF302664C708D	799824C0650ECE7A2A0A5AD4CEC66F92DBC14F82	50546C83B9369FE56C1737B4A8E166B6C26F159285D38C06EC2AB56AE76ACB73
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	358CC3BDAE5CCCB8D53E54034206385C	B186603644ED6C06928D0EFE1ADA467607138099	28C41B9CCA295362D666D1FC6C3F615F1350E7828637B8FCF43A27811BA4712B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	830502EEE13D16E36B35C31DB12B149D	C1B89A5C69C8A1A9FD3ACA47F0C676EF374DB22B	087241EC856184DC3495AD9B0A98D9C71DDEB382CB5BDE48E719EF32F910C677
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	830502EEE13D16E36B35C31DB12B149D	C1B89A5C69C8A1A9FD3ACA47F0C676EF374DB22B	087241EC856184DC3495AD9B0A98D9C71DDEB382CB5BDE48E719EF32F910C677
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240424124705Z-158.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	1D11ABBFFC9A9741CE5E5D9B7FF47852	F0F9DC6662EDCFA62766E2919675C3EB211C519A	EFCDF92457469AF5EA2031FF3EE86CDB6DA6F38D4131A6C8BFC0900E91BB2AC9
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	DAB1E3D445B846C743763B31A0CFD328	75A8952F1CC5E6140CBB5C4228D36C2248E6F205	CF5D74DDF716C97BA71EE3790AA38E4EE87A601E015B71E7FB26E9B62DF38593
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	6DE0CD533DC29C32F47B64B27099B255	4C5FF0B78EDCA4193C80ECEEA28073FE3BA22EF2	A50A2BBC271BFB351B881134C0519C5EBE06A6B262EB55E46FBEFF9A50142123
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.332	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	8EC8DD7DBD7582F1540CED0D2897926E	E22CF9B4960437E2BA86240402CDDC9837462F42	B327B10E3772450B4A961C5872EF03A2D559E2AE70862BE0592E6C825B0AD367
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	D080184A44FBD68F3C36A082AE0F604E	8ABF23361FFF9B900A01CFC67A9E0857E9A05EB7	03F27A19A7BD603F630F073FD4FE52CF362B43ADC6060A7A905D440E8894365B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	D35581F6DBA204F1091EE270979BD559	DABA319F91CBBF8F704E1521E6D7D8065E316DD7	3CCE3F80E3DAB4120CC790DE26459EA25D90A7BB5FFCD3AD7EFCA847F53DEE51
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	CA9905B6D3867E7477B27DDE39A41969	35C983CADD66B66F3F3156CCE07D7C0DD59E4E24	C8DC5A70102788A690E1B842BD11BCDEF32B9CF037B25FFB859D2E664F35C643
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	AD3A445D42EEBAA7303957BEF053A23E	83C8E621DA8CA01842BE6D87CA998DBDB581E846	7EF3E34A8456BA1C82976061E06FF151E043173789D56F4A32138D1F2E625545
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D59F22E181A9F2F9B8B7A23051A82134	2817EEE36667708DBB2953B2CA36910563A5F217	05E842061395FB5ED1C8C01DEB51086350574A3BCC64B5898ECB1C12F7B4C57F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	C43B28E2E0B79BD2816C23CCA1D937B6	B6C3909610C2B7EB7D97CEE719A84C95B2D038B1	F8C3DB5A4A5043DC8E69E8FB911B2FA0B06569F5F7FA38A7916940CF5B6E704B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	1429A4FFA82818867CA84F1DFC93F3A6	D34F675124F2304A0C1FAE45B41AE543CAC57640	0AB0E4FA9BE4AA5171D61DF21A01E85F3577CAB49FA59D7BBE365D6B00683A0A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	C2C3ACD808B48680DB0F519EF5F088B2	F79AF66A349AC7E7C090B0402807E67A76C79724	AA89257B8469CB3BA2F73AE0A52054004C5B26502898605E73FBE186C39B28AF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	5D3D9C24B976E66226B3F7D563DA87FB	546EF0C9CBCCE763FC2D900FF712DD033BEA2A28	3D6672AA540B8B3AB852ACBDE59DCAF1013144BE29C210842C75D8CFD2E35207
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	84948D13BA42CDCD915C487E405A2D41	6047CC9E77FEF19C966282C72F2FD89F56DC16F0	820597202212A6A3D090EFCBD03DEE10109916E1DE9FE1C7363C79CF1833C427
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	D84AA9E5FA8BEBB1EC0C9E9D6DD4814D	FB55221C3210C78F676390ACF306FED97FDF2C7E	4BB5A40D444FE948848BEC8AB2E58BE026FD4AC54365495A49F52AC33D4B3401
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	6B5E6314A544C7EDD600E1ACCE51E601	F5A102C2921E75192EA1E44737C17F0D9405815E	F0B9C7B9AC5E9F26E1401F32EB4F1B452CD4B6A4B7647590E07284FB6ADB2DA5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	BFEF71BAFB3CCB69E98320B2873F16F4	6215590E6AA4A61DB2785F468B9B934A639A035D	3351BD77C0D80708ECBA6CBE5A30E7FFA9666AA6C4459086819D3972B762817F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	AA08920AA34135F051CEA73DE79923B8	1B0644F5C0030CC91F6A0E73FC20387FCA8EF44F	46F39D46B07BFE9B4CD20484695274DCB0B68B4B47E97B19B4717A8834DC44BB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	6728680F5847240024693C499FA6D59F	D2D09F19737B75C3129B72CBF1643C9F2A19B6F0	316B51E9E8308DEBC8A66846C889F97B88CAD539F0923E49B22EBA53DF50A15C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	83D5A3404F0CCE731470FA407FD242E0	7D54490544E7B9A6AAEDA81E43334EE731419661	22663DF4622DCA0D1B314B74067B433FD68B2594B6D4359D8D17F4CACA7196A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	5903C80C93BEEF788E09B36975DB5448	26E547FCF329DC19E324329D4752760B660277BC	805C8C22E7893318C88A1AB9B6F32858C427FDB7D9EDF2BE824CB3E969ECC2A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	499F7D1BD67591C252DD8F24B006B86F	2A6F1D33A66C98FE38376A995808DC6741853970	7AA106E478007EFEBF2554CCEC65D661C5D24C55BCCAA9277C33A95014D3C7E4
C:\Users\user\AppData\Local\Temp\MSI556ea.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	D0A8850DAE9F38608BCD9A11C26D99FD	B9D048C108533EAC53BEA5CA5DBF63AD6AC1B74B	BE11ADE7B22A9C920BB6DD53D46AEFC4EE0F3157B44335EC24611FEB1C1F9024
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 14-47-03-284.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	80E627F33E8515188579524EAE8564DA	6D4CEF458E944803990D88892F0AED26E84D7CBE	2B19E39F364E6F243B8486DC2DDC26274D99C5EB662FEC5035BD9D8FFD0578D2
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	483DBF67B5B73F6E0512A6C0D8675A74	A8BE9DC392EB424D4181701155DD2FCCC5A679FE	23F86E73D86E02CCD611DE38B28249D880B874478F0AD592DB7048BF377FCFCE
C:\Users\user\AppData\Local\Temp\acrocef_low\4d88126e-6324-4696-b93c-bc6725b5462e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\70cfd232-30e6-455c-bb29-4539e071fbe9.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AE1E8A5D3E7B2198980A0CA16DE5F3D3	A1DB2C58AFC81E6A114A8EB47BE0243956F79460	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
C:\Users\user\AppData\Local\Temp\acrocef_low\853fede2-5e9e-4732-a8ed-578485c6520b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\d8ebb569-1dc6-4847-b40f-b5a186a97898.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 894778	C4B24E98358EC87C7F853C86A641C2DD	037F2682BE3AADCBB7149AC18ED434FE005FB132	88C547944F788B7B436D7AAE8530462183F5D714A5AAFCA3FF743E66D420E0AC
C:\Users\user\AppData\Local\Temp\acrocef_low\f4e4b28d-7271-4e97-82af-8d7a530af11e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685

Windows Analysis Report
INVOICE 135658-01 04_17_24 08_19_23 422.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report INVOICE 135658-01 04_17_24 08_19_23 422.PDF

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
INVOICE 135658-01 04_17_24 08_19_23 422.PDF