Windows Analysis Report
onetreeplanted_14442931519550.pdf

Overview

General Information

Sample name:	onetreeplanted_14442931519550.pdf
Analysis ID:	1431749
MD5:	ee82ea6920f71f8cfde8e707015b120f
SHA1:	d9bbdb48203e6dd4e83c3f27ac04b9cf7c75071c
SHA256:	07ee270ec3cf7ee5e088b38ec7fb7a04657bf49c7b07cf6bb39875351a34090b
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

PDF has an OpenAction (likely to launch a dropper script)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.16:49709 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.16:49709

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185

Source: global traffic

Source: bb3fb758-f2fc-4a3e-8420-bd41172aa778.tmp.3.dr, a59c001d-bb5e-430e-9b51-506bd6ed3c25.tmp.3.dr

String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709

Source: classification engine

Classification label: clean2.winPDF@15/42@0/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 18-00-12-332.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: ReaderMessages-journal.0.dr

Binary or memory string: CREATE TABLE GlobalState (LastSuccessfulSync DATE, HTTPModifiedDate DATE, FileLastModifiedDate DATE, TestPopulation VARCHAR(30), TestSegment VARCHAR(30), ProductName VARCHAR(30), ProductMajorVersion INTEGER, ProductMinorVersion INTEGER, LicenseState VARCHAR(15), Language VARCHAR(15), OEM VARCHAR(15), Channel VARCHAR(15) );

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\onetreeplanted_14442931519550.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1556,i,7166340705170249665,12930680160910377525,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1556,i,7166340705170249665,12930680160910377525,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: onetreeplanted_14442931519550.pdf	Initial sample: PDF keyword /JS count = 0
Source: onetreeplanted_14442931519550.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: onetreeplanted_14442931519550.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

PDF has an OpenAction (likely to launch a dropper script)

Source: onetreeplanted_14442931519550.pdf

Initial sample: PDF keyword /OpenAction

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
184.31.48.185	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1431749
Product:	CloudBasic
Start time:	17:59:42
Start date:	25.04.2024
Sample:	onetreeplanted_14442931519550.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ee82ea6920f71f8cfde8e707015b120f
SHA1:	d9bbdb48203e6dd4e83c3f27ac04b9cf7c75071c
SHA256:	07ee270ec3cf7ee5e088b38ec7fb7a04657bf49c7b07cf6bb39875351a34090b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	AEAE6F0D275B6A296459A3356AC7A2F8	50A1E011B67CC84AE6B4A24BB361720C1DD80003	48D0D4ED90E4AD636EC0AB0DA78816488E3CED2C5F64D74D633D124A9D65A174
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	AEAE6F0D275B6A296459A3356AC7A2F8	50A1E011B67CC84AE6B4A24BB361720C1DD80003	48D0D4ED90E4AD636EC0AB0DA78816488E3CED2C5F64D74D633D124A9D65A174
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	B352ABE02632D445BB8700A3082BD21F	AEC2E2425FB39B4B63B1FA40DBB131A931500720	9D429D6E0D84CDAD9B647F26F450725BB9EF7F3ADF17FFB1038C9A0BDEF90390
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	B352ABE02632D445BB8700A3082BD21F	AEC2E2425FB39B4B63B1FA40DBB131A931500720	9D429D6E0D84CDAD9B647F26F450725BB9EF7F3ADF17FFB1038C9A0BDEF90390
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF51641e.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a59c001d-bb5e-430e-9b51-506bd6ed3c25.tmp	JSON data	F810756E5463A2040E4D4C41A5ECAD74	00C517809F74F3568A27F8B0E975D4DB2A1DF577	5E2351751C0BCC4A6125B3D66CD847D91BB17BCDBCA08544DD498DEDC986E23B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bb3fb758-f2fc-4a3e-8420-bd41172aa778.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	22ED9F3AC69B603F662E3B313A42E983	D3420A78EADF35AB886AC3AC571E907DE3B056C4	30BFD0598B1FB488146B90C32A1249C13955321BA6C6B8D06BA4CD1077F2E23A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	2BF74582DA262D04F6F61BC0F5157796	9E83E7004E8F4C246104DBC71392E29B4CBF950E	42200A1E9D08C6A157F0C611B0ACED35E027267F5DAF5AD41193669B20596B1C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	2BF74582DA262D04F6F61BC0F5157796	9E83E7004E8F4C246104DBC71392E29B4CBF950E	42200A1E9D08C6A157F0C611B0ACED35E027267F5DAF5AD41193669B20596B1C
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240425160014Z-170.bmp	PC bitmap, Windows 3.x format, 164 x -117 x 32, cbSize 76806, bits offset 54	424B1130562538F866AB1E0867AD0CFC	13BD9FA62CD71A0EB0300BB0283EDBF42E5EE215	4F02943E95FB852C0A0ED3140DA6CAD07A97190930C27066A28834CD7508E796
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	3EB18D4B61B8629972F8C42FAD478BE3	26C8F049053BE776CA91D6CBCB668B06E480B844	88B282603EFAACBD047F0D020EF34D7FF73E0AF4C3A113E73346C7B6F0F5C7D3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	4CF7079CD562015BEA5C34036244D671	35E09CDDD355B80FC4B3D29E515D6F6611528A66	A50539004DBBB945A61BC62FAD7730E77EA57056A303690E39EB9689ACAC7846
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	50E63F647075604A8E21E5EBCCE588C9	A51E1197E548143117686DCD2566898B65BBA1D6	A2D1934A36733627FF35C9889F35CDF7C56E91CB00AF20B2EDDF939F9F80B4EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	82FC7D18B1452C0A9808FC103E23F91D	77C99B5A8201DDF1E40255BA02501FD53838D4D8	A092F9246FCB11C8A6A180799AFC0478A8B1A671E29AFADF57FA1031F7E54B31
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	9B5F2534830C60CDC0642D08FC15E273	C0699F375FDBDDF174BF9F1BDF76C6EE4ED7EE69	431B25D20C627EDE5630B45CCE21AFD7A7CC5A2BEA9D93617CC03DF95BC1331F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	AD2FC3932302225F22C595264AA9A6ED	7898FFC9CE17D5074C19B29AE3563502608D199F	31A067D412D35A2A1DB1327123A5B346EB8DCB33E93B568D6918102504D1998D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	4B0AF0E3F539CD7ED2ACC1C927972FF5	22CD70D491FD5B77F6FF5F301975D8E7033B1037	390EE2E0ADBF07F3798A442471F0AA7D90AD8C380561D014FA7B09270210FBDD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	24B667A57261DF5C8F4858C82C8188A7	0CEA1FEA413787BD1C49B4949F4ADD3617549F24	C11311977E53847FCBEDD6EE9338123E52ED6343751B523AA4E1634A9C2B76CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	8ADCABC70A619B4229EAA39451AAA712	413604548C86C7EAB22B8F8A49862370903EF6FB	6328FAC0E06AAFA73BB8D373D38AF96F98052AB7959C08E0A0550D62427F34C6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	6C946763D0BDFF33CC14A8863F40130C	0E17D4F626D8866FF5CC638F55B8B4AEACBC7581	F27ECC92ABCBD4B146586D8B9CDAD20A7EC52CF960E059D3B7D21CF256A037ED
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	279FEFC8147B50009434CC4B1F0DA969	52CD79E534110BCAD6598F88E5D398AEC1DBE40E	6F5D889312ABCDEF5E9213AA72123E2720BD33C7480F5BB060AC91AAB340FA88
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	46AA0C777E7F4E8824B7A999487A5135	F77CC0B74B4FAF7DF357A5E4725AAD1C0B1ED83D	53E566A4CA1145076D2B0006093D5C4803A2DFD77BAA9EDBA0EAACB1174FACD6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	6E1CDB81E5F1E15B61E917DC292AF815	3904E809F482A0F6F4DB2EDF279E8F187D521F2C	EE2532055BDC7B7AD1FCE9F7725FE487DD077D652FD4350C4EDBD1114EDFB98D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	AE352F5EE3B0B3D3B612D5ABC7484A8F	3AD8BB62091B3D6B2C609A282EBD2A8BC1614F64	C64FD83D59F0875A8B3AEFA89F6209EBC019EF4C8E0BEA879011D52CE2860169
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	EF9E67BC5BA30EDAA49BE10831A2FE58	A5D3F5F6C7F49D4312E020030ECF4F2764231D95	555716F73E6330830FB54039E3E848C917DDCD1A92B97EDFCD3067CDB7033F46
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	3553CA905C0333F80C2CE5D550776E86	D7B276446190F8EE7B8975F4DA646F3543AEDD24	37AE0AA63B569C1EA2DE3AF9EABC0ED8BE65F86A86FBBD6ED08B69FFFF22F864
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	1125EB67538EADC48511C20E5A9B35F8	E701154C7F3750551C75DED6309A0FE4897AB3DA	07C50E48B215260EFA4B88C66E61DB4F078C4A2A2E151557A8C31F69C626BEAF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	E31CB02E6833BC4D50EFE546E0ED5332	122199BE1CAB329AD49C81AE084C08C77379110C	BF5AC86EEB5201712F2785061DCC7660B3F4B123FDD08848B116A8363314A6F6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	065A813B25F4E7255DF76E7B46BC40D0	D3E5D7E9AD119A48AAB89B8D8E6BFBAF83F3DE76	782AA00E0079B0F01DABE17AD864426C6AAF20915F8995668B18AA6A2498737F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	FF55627EE67C57FE15720C1F50586456	D13941FF78F59C866162B0073EA989EAFDC0861F	C0643B03EFDEA515825B0C0D8EC7664CB2FC4CE0CE777484820213BFA0B1F0F3
C:\Users\user\AppData\Local\Temp\MSI582d.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	1C3261C1FEC48BCF73A4DC732CAF687C	5D4034E948DC0C30FFCD63BC67886F70B85CCF06	D9B8533C54B6264B53BE067DA57C7BDAE417E6284F8773DE564D1F1289082E90
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 18-00-12-332.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	167F736F2F64D011741391B8315A876C	A530ADD33D865FA68230B6E01A4A05F43A5F7AF7	E0BB34D35D242D1CD39C22BB1662E65F8781AA4F314EED6CC022B6D2C6C370C1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	6E70D327FB5E2D9242DB6CE25466986F	813063B53124B8F0D4A37DDFE824A1349A53D0D9	89E46C679D91BFA572C23BC26E3CD9F4EA119BA8B252272574DC2CC71D0B9F1F
C:\Users\user\AppData\Local\Temp\acrocef_low\4115c2f0-4590-4f80-9ccf-4388ff541479.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	AAAAB43627E96B02BC54A78F0EE8E32C	03808205C51BA031BF69F0DF07C9C80835098104	B9ED5860C1528CAE5717E553381762D9C4ED093E546F7500F55B6B18B5C20CEA
C:\Users\user\AppData\Local\Temp\acrocef_low\85382ace-4d52-4601-9b15-3a7040b0b011.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\b839b129-a269-46bf-94b6-c94ce6ce2e4b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\f7d24f9c-4839-4aad-92ee-c924b34132ab.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
onetreeplanted_14442931519550.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report onetreeplanted_14442931519550.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
onetreeplanted_14442931519550.pdf