Windows Analysis Report
Presidio-605520.pdf

Overview

General Information

Sample name:	Presidio-605520.pdf
Analysis ID:	1431810
MD5:	78475d805c24eb83d0160f43f179feac
SHA1:	4c01010796b1d35a7362f78ea0aea8e18d452ad7
SHA256:	7cf1ffa5a46a07f96c0a56ab4f3fe986c0611d3afae41a4efedc80d8eb246342
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Suspicious PDF detected (based on various text indicators)

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Phishing

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: DocuSign You have a secured Documents to review and sign. SCAN TO REVIEW SECURED DOCUMENTS Dear Sstewart, A Secured Documents has been shared with sstewart@presidio.com Please sign at your earliest convenience. To review and electronically sign the pending document, proceed to scan the QR code with your mobile device camera and follow the secured link that pop up. When DocuSign is applied there is no requirment for a paper copy to be produced. Thank you!

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 54.227.187.23:443
Source: global traffic	TCP traffic: 54.227.187.23:443 -> 192.168.2.7:49708
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 192.168.2.7:49710 -> 184.31.48.185:443
Source: global traffic	TCP traffic: 184.31.48.185:443 -> 192.168.2.7:49710

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 54.227.187.23 54.227.187.23

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: c583ad55-e27a-405e-ae1a-c48b4361aa9dx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 54.227.187.23
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.48.185

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: c583ad55-e27a-405e-ae1a-c48b4361aa9dx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: ReaderMessages.0.dr

String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: classification engine

Classification label: sus22.phis.winPDF@14/46@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 20-06-30-921.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Presidio-605520.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1732,i,4167328604085593503,12386720638169524665,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1732,i,4167328604085593503,12386720638169524665,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Presidio-605520.pdf	Initial sample: PDF keyword /JS count = 0
Source: Presidio-605520.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Presidio-605520.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.227.187.23	unknown	United States		14618	AMAZON-AESUS	false
184.31.48.185	unknown	United States		16625	AKAMAI-ASUS	false

ID:	1431810
Product:	CloudBasic
Start time:	20:05:33
Start date:	25.04.2024
Sample:	Presidio-605520.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	78475d805c24eb83d0160f43f179feac
SHA1:	4c01010796b1d35a7362f78ea0aea8e18d452ad7
SHA256:	7cf1ffa5a46a07f96c0a56ab4f3fe986c0611d3afae41a4efedc80d8eb246342
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	0C425F46B5BBFC672856F307A35373BF	CFD553C064D3C0537AEDA25AE08168F61AFA13C6	FEABF9AB16C73E977B83C2D35E554EB8C589FE84BC49DD44CAF7BEE75CFF93A8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	0C425F46B5BBFC672856F307A35373BF	CFD553C064D3C0537AEDA25AE08168F61AFA13C6	FEABF9AB16C73E977B83C2D35E554EB8C589FE84BC49DD44CAF7BEE75CFF93A8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	A8AB331971FBF86DFB76DE4EB7983BA9	9EF87357A976BDA91590C28F3D0BA65D2F5A84A8	A41A4F6ADC4E201969E1238FFA45E666B48BA4379058327CF7156983823C6AAC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	A8AB331971FBF86DFB76DE4EB7983BA9	9EF87357A976BDA91590C28F3D0BA65D2F5A84A8	A41A4F6ADC4E201969E1238FFA45E666B48BA4379058327CF7156983823C6AAC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	FBDCC2772AA26D64959F72A60AEED4DF	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF67413a.TMP (copy)	JSON data	FBDCC2772AA26D64959F72A60AEED4DF	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b0f37ebf-c4c4-4df9-a3d8-516b90946cce.tmp	JSON data	D65998002F76139C63C65111CFEC14FF	F10FB40A9C5B5A539AEF5B537D0E1934B92EFCBE	1226CE36B6D1126B4A35708C78439B3AF87A9F105BEA90ACF7484F67FEC12149
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\df283f39-3d9b-43ec-a494-94d841e01eaf.tmp	JSON data	FBDCC2772AA26D64959F72A60AEED4DF	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	6D2031945276D9B04AD88B6D6DF3A89C	04F62A25D2B34111E390F447E17BE69616992D9B	4901A5BB7560CFDBC255A056EB6B48B28168BCA7F7B571C16E10D66E9FF5536C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	5D60B68E51B6094232C821432D2A4E12	1EE4AA2ED6974AF98A5019D6B9C4F4989311B8C0	04F21FD2E0F00810B1E2F8E42DE33E22A12EB0469005E3FFCAC4408012A9134A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	5D60B68E51B6094232C821432D2A4E12	1EE4AA2ED6974AF98A5019D6B9C4F4989311B8C0	04F21FD2E0F00810B1E2F8E42DE33E22A12EB0469005E3FFCAC4408012A9134A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240425180634Z-191.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	64D65139BE4DA3CE79125F6CC7F314A0	F475F38752D76C918FCCF171036A7B249A1DBBAF	600C6D2BC20D62B27A4A737D5FD28BB11CA5FDB5A31E6BDA8DE85AC789C14F3E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	AC03DE5662F2949C632C5B8BF8DAF91F	42545CF47749D5AA30A469815C167DB4FC2324BE	3FE7270DA75B851401D0584BBFE30CE654786E492D0F0FD95831ECEDF508732B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	40A358434C6C3C93E63822BCBF360B6C	98E3A45AAD4A2655DF7E1CFD1257681911B4BDB8	FF31B7F8263ABC3ED90F75C701B37345973DB4A07AB6232AC040B0C24F797E00
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4456	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	C11248DE3EDEB5F39EE8D1E2C1FFE7D8	7EC6B85BDB7C99BA691BB08A051EF7C4D4A43231	57612AEEE8F8E8471B730963F8E111C9890F83D8120380A6FF0676A3814A4B41
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	E16038FC1826BE0C67353D3944987233	FDD31CC48F6195A7ED08DD6AB7B8C302C8652E65	3A302D80A8EBE1038E9B74EDE920A477CC8A3FB1FCE4F7DE9829184A1F4C1C55
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	4B45CA50BE7F22D8BF3DEFA7C3F9D12F	88E3A6C1A9451135B0B7482409379EE1561D2DC5	006034FBDC91ED586530EEE8E695349B17700CA145FEBF0B9BBA41F7D6A86F67
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	84EBB05E49F973F191D78CD7C351C1E4	55B6F590D005DC483FCF9F43AF6CC5BBA23E9F01	BC30A52348DAAF8342B663270D5AFC9E5DADDC2A0D6550498223929EB7B35AA8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	25EB3F72C3110CB81CE07DBB67F1FEDA	203E8BCD6EBA47114EE1F044898BA2E8CE8A2D9F	A645829BDA636D52D78F8D4AC9733BE6C5A9EA699F82089F669AADFF15195420
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	AD6277FBCC9100B7E1DE70D8A3B5CEA4	CE23FA033B898B9E46BA84F1BC839E7C4AB1BF3F	D79AFDA1398068546638C348166E33F6CDB21572140951D7ABB0046D5A8EE62F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	7A38901B83BE6512A5189930BD7DB93E	44AB44099A6DD746284BB3E0A6517970C4D94F0F	217C46ACB72EDB8B1D8C9CB015A9FED75E6C11342CE782456A158133A140C641
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	3DBFF70C68BB1D5D91ED4C4F48B0BF2F	993780D4124AB3BA943FCBADF2B06EA9A531384F	D733B4F934BA1DDA6A8BF2D86CD6A6F7C71BDFC933FC82C697BC6BE692E3EF13
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	3CDB8FEF54BB56864F4A654FB5AC48BC	9D94D7DB77FC274B81EA6964FC2A60B4E5D2D1F7	37ED53B1502D14D3DA49955A0195213648F2099D8606D03A1FFECAABC73A4CC0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	61BA06613C337E0D48A058C394533DC1	DDE2679F0D29C47FAD9294B55BD3FA152ABFC158	1233B4A608D3BABE1EC08DC8DCB8D0EF566DC707E9E969C36857B97F72361341
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	DA69792004D7183B6F1AA37A75468391	4635273EEC67D4B4DA81204F59CF0C635DAF6C4C	04E322DC4CC7C4AA100D8D2BDD5D43923D73A243A59E3A1336C15316A46794E0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	81CFFB8CF1E55160E9169C27D9F70411	6575C36A341AA8C9540C971D9016E4BA8EA9B494	9EDB21703EFDAFB3D50784ED2C7083602F92A1B00795683FF53AE7E73FFB8EFA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	E5931D3A7938AFA1658DBFB81ED2E6B9	B623E4B9FB12CC064EC9F627B700ED875D7AE088	9D7927E1AC42FAB4123E7167F623E2430CF74436429BB0AEB968A3F8230B1820
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	F4E9902BEA4A4C61078231C8FC3D22C9	0019B2E2580E035742726ACA333221765133F8F8	4968DE3D06E44080E19C0806E5942DBD7AE527B2BBFABF0EBFE1179D406D0B2A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	40168B3B0615CCC01E5C8749BB94FDFB	BC133D498DF3CD011980185651712B8C17F04188	F178E4B518F97E18B28E7F6D463A2943FB2E3DBFC27CFA1085EE4D119CFBE9F0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	1CD00395549F0EE4AE082425A85A3F0F	5D84034DFE1F1386C9C7AD00F06857E824428FEF	7DC3FB0CB004BAA2DFEDD79BB338AB5AFCC27E41E2A3953B3101DA38422FFA74
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	18033EEDBEBFC30B517B757A2D700104	5E4F0BF71CC625090A1F6F360D55192474DD922F	8D116FBB2ADCD5A33D6C5F69A5E020F8FBA9AA8B18FFF703B144984A9FBB635E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	715B8EE2727EB2EEA08ECA520ED94C2A	8F73E41EEC07486EDAE8880534BBFC6AC4F46819	CAAA53C14DC1123B11D46ACEC98CC0DE4142B5F7F43C67D1B86201D40FCA69F0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	E398217FF8747788AE87A6DDC5341DDF	C86305CEFF5689F3D9444F23F26D4F7BAA4227E6	B1981BA02C8C327808A17A3172F6C3C2B60E4A21E01F62A1CC3EC8A07CB6534E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	14A74A518F553D6F9DB27BD1191AF9A6	52867AD4ED81CCC04896B70D8E084802DE8B03C5	B42A82A8AB46CD806F66E9D496D00D8D1E199C137D409096E4CCAD2056CC18A6
C:\Users\user\AppData\Local\Temp\MSI701b0.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	ED9F3E55EADCD78098092B80E98F3D3D	C76C959447C2BA232AAEBCBF85234651B65AD444	2864CD31DA254CE9A88EEA0BD35545522050D0F88F5F0FD37C7DC3BA3848AD64
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 20-06-30-921.log	ASCII text, with very long lines (393)	F49CA270724D610D1589E217EA78D6D1	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 21-57-09-897.log	ASCII text, with very long lines (393)	6B23462DDF77AB5D1279EDF58CCBBF7A	8178595A4C4D507050FF2558EECD047D248C5A5D	E8F7EAA43D14B8EAE3AEB1F5EC4237A0C352733DD12E03F949B106C8EF09FB90
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with CRLF line terminators	FA69A6D8A6C13F61F50E9AF82F63E8B6	E4C8355E5BABE96E33841C152AB5ABB8A290F202	461157F6E53428E92A1E5EE33B5AA1239F75C494DD74112900E91E64F230014D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	8D8FDC3E148D44EC21E936E845B4A777	9EF12135F77B9887292495C47D8F86467BBA8ECD	9D941401929DC7F451936DEB84E93DDD5A4E2EF94CC79BF2E1DE23C0F5B2FC23
C:\Users\user\AppData\Local\Temp\acrocef_low\09fe93f2-94fa-4ca7-ac3a-ab5d0ff599b7.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CA6B0D9F8DDC295DACE8157B69CA7CF6	6299B4A49AB28786E7BF75E1481D8011E6022AF4	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
C:\Users\user\AppData\Local\Temp\acrocef_low\0da73c0e-13f9-4422-8ea0-d6d114743d8b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\c861637f-5269-4efe-9106-17943f7097bd.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\ddc27109-e9fa-45ce-b105-8f2e98e3fb9c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
Presidio-605520.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report Presidio-605520.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Presidio-605520.pdf