Windows Analysis Report
2751726_2359360_Confirmation_Letter.pdf

Overview

General Information

Sample name:	2751726_2359360_Confirmation_Letter.pdf
Analysis ID:	1432114
MD5:	052941218142e98f29f40b8f713df627
SHA1:	897fe6954b612f46dc4277cf77cbcd386f2d5ec3
SHA256:	665d45d4b4ac02dc33b7c98dd1a0b05a145b8bdc96c6e23996a2f19f9f3e58dc
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 52.5.13.197 52.5.13.197
Source: Joe Sandbox View	IP Address: 104.94.108.142 104.94.108.142

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo2.adobe.comConnection: keep-aliveAccept: application/jsonAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo2.adobe.comConnection: keep-aliveAccept: application/jsonAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: classification engine

Classification label: clean2.winPDF@15/50@0/3

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2788

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9185n31m_1uob9pl_25g.tmp

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\2751726_2359360_Confirmation_Letter.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,2299410425946571322,14647256495210331629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,2299410425946571322,14647256495210331629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 2751726_2359360_Confirmation_Letter.pdf	Initial sample: PDF keyword /JS count = 0
Source: 2751726_2359360_Confirmation_Letter.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9185n31m_1uob9pl_25g.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9185n31m_1uob9pl_25g.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: A9qh1rcy_1uob9ps_25g.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9qh1rcy_1uob9ps_25g.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: 2751726_2359360_Confirmation_Letter.pdf

Initial sample: PDF keyword stream count = 51

Source: 2751726_2359360_Confirmation_Letter.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: 2751726_2359360_Confirmation_Letter.pdf

Initial sample: PDF keyword obj count = 109

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.5.13.197	unknown	United States	14618	AMAZON-AESUS	false
23.193.120.142	unknown	United States	16625	AKAMAI-ASUS	false
104.94.108.142	unknown	United States	16625	AKAMAI-ASUS	false

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	017B2FA478487E6929276FA4CBE863FB	D503E46D3876C6D3A7E7F33DF442A41F126A9F6E	CEC8CC5AFFD3718B1AF279679246E5E6CA0FB7367A799FC9DAF1AC61E49D1DA8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	017B2FA478487E6929276FA4CBE863FB	D503E46D3876C6D3A7E7F33DF442A41F126A9F6E	CEC8CC5AFFD3718B1AF279679246E5E6CA0FB7367A799FC9DAF1AC61E49D1DA8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	4F9B934F06E19C146BE07658E26FE263	1DDB65C3C98412FD529459B28129C11BBF87C767	F203DA4C0CFA601CBC34643D7D0D7FE665EE1A0BC61986ECB8A33C839F6757AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	4F9B934F06E19C146BE07658E26FE263	1DDB65C3C98412FD529459B28129C11BBF87C767	F203DA4C0CFA601CBC34643D7D0D7FE665EE1A0BC61986ECB8A33C839F6757AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\161501ca-6174-437f-aa92-2442bd5e8d47.tmp	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF650786.TMP (copy)	JSON data	70321A46A77A3C2465E2F031754B3E06	5E7E713285D36F12ACFC68A34D8A34FD33C96B34	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d5e44509-81b5-4b1a-9ae9-e83beeb88fd5.tmp	JSON data	C13F87092CDCC68B1C86C2155F160D20	0F7AA673E22FC0712E12A31513B43CD001159E46	D4E0085228677133746DDD5AC793A560326242D0DE44E2F2D8495ED6461D9B23
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	FF33B5278B1C4D3F2CA5F5372F13B332	9ED0F32DA467EE5D86965167D7CFE2774CA51435	2C0757747628976F5A3F24806582E8ED1BB8BCB05DC9CBB5B96DA6294A18CFEE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	04703D957408A0F7A59EFEF3E54B2D44	D9B811B2039908B9FD508CDDE92422C1E8166D50	8735158550644E7142AA15ABA29044E7CC94BFC988B761408D93B622572BB97D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	04703D957408A0F7A59EFEF3E54B2D44	D9B811B2039908B9FD508CDDE92422C1E8166D50	8735158550644E7142AA15ABA29044E7CC94BFC988B761408D93B622572BB97D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	B623A727CD94F2BB69F027CEC7746ABE	5DFE5B80B1C87F74CE3F16E1C2BCEB5D0F112029	9ABFE0767F9AF078D11D27635673F1C5B939950AB450E6E73FEDB10782F9F309
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426121427Z-195.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	26649B3E8592530BCF3E948D52991652	89AB63A2BD6D36FBEA9DABCD4F18F3073BCA4D00	9F1304D28FD185B720259CA950820E74B0EBDD8CEFE67B8EBE17507FEBC1C78A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2788	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	A9BE9FFE814BC3E25567922B44A12EBB	A183B6735C2547ADC608F124D3413833989DAA1C	B6AD62653562F8CA2F0F36F2C862E118F8EA7C014A106744A3444DEC5ABC9B80
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	974D18CB4DF41F9B5E8433E5A67034A7	E4A0D4006D1BF1333C742276926DCC1F4CE60232	C0A762937E116F29DEC0F8778817ADC64484523502B4822D7AB3D2931922F3E9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	92D80BC5F97C8569F98904E1430A2F9F	C2474404B1510DBD6D111098BB3E82B6134AD23F	480A17CC54640CF45CE951EF3D6BBCB9785FD87D2B90938DE6DFF8BCDE59A17E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	F327FC7A962EC35B6D156027A5C1E6C9	9701E003C77064B6814A77CF15E3F3E8B363BF44	9E4EF92E4757E6548441E2154D6F87EA6BC5B37352D2A5AAB1BE1EB6733CA128
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	BFFF422EBA795ACFCAE7699B9302968F	2533A4BBBC8F9815BD593904CF99E0F2EB43E097	7C2FF549AC980322D2B4AD8F705058E548BB1B12FFFDB641F6377A60D8B52007
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	3809AC7274E73D5BA136DFFEDB324176	FF8F8C659830EACBDB3D0B189AA4BF93F111CE3C	85E631E18D6AB4318DB7999CEA9BC9602EB89811570D107A2F13B9768503B828
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	B254347E85EC659A2D06B9A024C6816E	830D88C264AD227C21290BD455684FB6FC938046	5968085FCBCD9F5BD8DC9BFB4F6F8F3F95F44E4BD468064C162419B2CA432973
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	72DE126E6CF8C772409F993A7500E235	9553B0DB1303E68AC87ACCBE1B9BE7B4C08F7204	482173C4F64A4FA20FB4D38DFC1724C227014ABA4AC9D0B0E4C9FD402B34D086
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	E4DDF1B14A10BDA81DFEEAEAC9FEA184	178DBA3A07F5D1F1EAB03577A0A09BE4BC07D3B4	183947623BC99B034408903EDA007946C66A9C02DEF3A2CADD91DD15DEFCB148
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	196EEC89AD1A97850128C46502DDF1F2	12B8DB7F7CFA4EDA99458C0EC72DB6800FA05017	0E0359D0D5FB0938FCF0312F69FF5BC6F38DEFA85CF36BF91CFE8911AFA63C62
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	2DD71592D1655588AEDF418F080C4263	440E082D83C09E615D315369C2FEF3224DD2F2C2	348DECE90A2383041E09D4DEFB740842BD1983D7930C06746FAB5E6B6ABB3F0D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	CA2A8B404EEA0FD22021DAED71CDCB83	017DD038C650CE01BC09C7A58A497B1A4FDE8AB3	E0B81359282EEB442EA82DB12381C2ECAE82E8FA06022F3DC2C953AF5A2C18A4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	3377409601B188DF40D0B7A9210D27FE	6FB7B98001AB0FA448CDA29F79F73A15AAAE783A	1428CC9DE164EBC27A4C79167DA7B7364197FD4E8E4C66AB1D3F81ECE4A17BFE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	6E0183AAD6679D5E5D4DD734EC704D01	5212B9AA0FB387E01C2C64F19DF225872D6E4865	8CC464C006A3915EC518736588484E0442DC3165E9D22118615C6B09FCA7C6D9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	D1D570577CA3B55EB9AF8AD6D8328D35	C554B683AEEEF584076D4B4AD2A7F847331F26A7	055E551EC4F960C2943A401E719EE72599F0CF51BA299647122C94BC9FB42F94
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	FBD924F9660BD3F63A741455C17464A0	EA4E64A23230CA2AE6C9E1834B4C8BF57F4B4BD1	A4EA6EB65270468BC887421259EC45E4F8572D4B1A87B4982D0D1A3375AA1D4E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	540C8D58351296ADC0EA92E726A16E00	244646CDF16DA670BFB14CC0B4C0F6DE186E71BB	3F1B3EB3739FAA034417A192E916D3FD6BC2DE21259C81B3B367966FD578E842
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 20, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 20	708C5E962EF20C6467D3F4818F531033	9093DC21B9EBFC1B4DC1A9E14451977502CFA374	97C3640D3FF1CF0178E2209C57A299395353ADFA37F9AEAA0EECE5B61232D3A1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	E1DE830679793EDC68A757E5D5E94F9D	8E2E978430DBD1B1770EF4EC517F1F1DB0E64979	19320867C552217817A27E738895457A31024C14AB884E6BF08316F7AF0248E0
C:\Users\user\AppData\Local\Temp\MSI4cd8a.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9A8541A1E3898CC781748956D907B1A1	4015AD14B24EA4A7BE24354A78359A3C38A6B26E	AE7A7F46A30C9562057154E11CED7DCC28526CCD65539E583919944E8B65AA42
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9185n31m_1uob9pl_25g.tmp	PDF document, version 1.6, 0 pages	42F73129F749C43414F891E5D123BF27	5F20C5AF6D30AE1225F7F7BC1397205413CDDDDD	AADA07B0153FCFE325BFC09DBC6A36130DDB4CD3CF2B832A4702EDB456AEC8C0
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9qh1rcy_1uob9ps_25g.tmp	PDF document, version 1.6, 0 pages	60C1A38A0134C1205C9E977E2FDB205A	8CAB4EC43BB1F09FD335BCC93D9C00D32D9AE4DC	93EE334326AACE55F6F393DA7114F308F5B5B53D83192684EECDE8DDD8D173E6
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-26 14-14-24-867.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (392), with CRLF line terminators	6299ADF61BE6AC163ED4D834D9301B53	B43563CDE564063CFB4BB1FF8EBF6B9A0A26018C	B0AAF4BD246DD793247732486364B96FA3C7706A11DEA34FD4C4B21E650695BF
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	168993983CC4652F07B18BC686734969	79B1AFCE105F81FABC759E9949E0A642D6BF8C85	841CBEF4257AA03C0D0A630D85BF516149D1756ADC10954238C254A5245F7FE6
C:\Users\user\AppData\Local\Temp\acrocef_low\092b3f67-cb41-4316-a2eb-d35f01679286.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\0952751e-ed85-4308-aeb6-728d3fc5b57f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\81edaf18-333f-4542-aa8b-6d5a32d7e4ff.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	28445BE71675F3B540A8E21F22E376FC	BDD3CEAFC77B125C552D323ED0A8D6C61960E949	ABF98267BA151CB28C87623E2B0F833476618181DC4838512C8E6C11B44CA539
C:\Users\user\AppData\Local\Temp\acrocef_low\a30c297e-e81b-4d1e-9b6f-2a8adffd402d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\a508d8b7-91a6-428e-8b92-ba2465eed1aa.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	6AF7FC589063937DE2978CF360E97841	37527C18159D15807FEAF40F00A285198FBF37DE	A376AFEE5B3CDC4FA6CFA9D7DD79283874B01CE7259E3229E169E5748C15BD28
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav	data	5C6B932A79952B4B27833691305E61DB	09804DB0986A989C2C49CDCEA563567FB4C7B1A0	DEE5A5925227B125F4AC6D9B70A277E6EC8494FFC73D1CCE9E08CC7A78D6208A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav	data	6A614A7743B0C781AAECA60448E861D6	67B7DF5EBEB4527E4C31F3F9B7E52A0581DC4B6D	9703120DC62C2C3F843BAD5B1E77594682CA7820F0345AE0BBD73021C1427146

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 23.193.120.142:443
Source: global traffic	TCP traffic: 23.193.120.142:443 -> 192.168.2.5:49711
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49713
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 52.5.13.197:443
Source: global traffic	TCP traffic: 52.5.13.197:443 -> 192.168.2.5:49714
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 104.94.108.142:443 -> 192.168.2.5:49717
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 104.94.108.142:443

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 52.5.13.197 52.5.13.197
Source: Joe Sandbox View	IP Address: 104.94.108.142 104.94.108.142

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo2.adobe.comConnection: keep-aliveAccept: application/jsonAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.142
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.5.13.197
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo2.adobe.comConnection: keep-aliveAccept: application/jsonAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: classification engine

Classification label: clean2.winPDF@15/50@0/3

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2788

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9185n31m_1uob9pl_25g.tmp

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\2751726_2359360_Confirmation_Letter.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,2299410425946571322,14647256495210331629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,2299410425946571322,14647256495210331629,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 2751726_2359360_Confirmation_Letter.pdf	Initial sample: PDF keyword /JS count = 0
Source: 2751726_2359360_Confirmation_Letter.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9185n31m_1uob9pl_25g.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9185n31m_1uob9pl_25g.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: A9qh1rcy_1uob9ps_25g.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9qh1rcy_1uob9ps_25g.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: 2751726_2359360_Confirmation_Letter.pdf

Initial sample: PDF keyword stream count = 51

Source: 2751726_2359360_Confirmation_Letter.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: 2751726_2359360_Confirmation_Letter.pdf

Initial sample: PDF keyword obj count = 109

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

ID:	1432114
Product:	CloudBasic
Start time:	14:13:36
Start date:	26.04.2024
Sample:	2751726_2359360_Confirmation_Letter.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	052941218142e98f29f40b8f713df627
SHA1:	897fe6954b612f46dc4277cf77cbcd386f2d5ec3
SHA256:	665d45d4b4ac02dc33b7c98dd1a0b05a145b8bdc96c6e23996a2f19f9f3e58dc
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Windows Analysis Report
2751726_2359360_Confirmation_Letter.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report 2751726_2359360_Confirmation_Letter.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
2751726_2359360_Confirmation_Letter.pdf