Windows Analysis Report
CERT-1416920247.pdf

Overview

General Information

Sample name:	CERT-1416920247.pdf
Analysis ID:	1432433
MD5:	05f30d9cb8f7b79c65256dca2447549a
SHA1:	3a00a290c43fa03f3312237074d0395b52d8ea94
SHA256:	0f14c0cb3b105175dee0032ac24b96d071aef81fe5329cccffa18f3663058985
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 96.17.64.189 96.17.64.189
Source: Joe Sandbox View	IP Address: 107.22.247.231 107.22.247.231

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/46@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-27 03-20-34-600.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CERT-1416920247.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1592,i,11691557971963258939,14076181574158468208,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1592,i,11691557971963258939,14076181574158468208,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CERT-1416920247.pdf	Initial sample: PDF keyword /JS count = 0
Source: CERT-1416920247.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9skb9_nxo82l_3h0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9skb9_nxo82l_3h0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: CERT-1416920247.pdf

Initial sample: PDF keyword stream count = 198

Source: CERT-1416920247.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: CERT-1416920247.pdf

Initial sample: PDF keyword endobj count = 281

Source: CERT-1416920247.pdf

Initial sample: PDF keyword endstream count = 198

Source: CERT-1416920247.pdf

Initial sample: PDF keyword obj count = 281

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.17.64.189	unknown	United States		16625	AKAMAI-ASUS	false
107.22.247.231	unknown	United States		14618	AMAZON-AESUS	false

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	1C1BC6CFE890C57261B8C164E866A5B7	FC882DFB5D189300E2DD04C835E96568FC893A9B	389301B5CB2946746F0B222CDC18C75F35CD31B1F3F227ED3EE22A3DBB791097
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	1C1BC6CFE890C57261B8C164E866A5B7	FC882DFB5D189300E2DD04C835E96568FC893A9B	389301B5CB2946746F0B222CDC18C75F35CD31B1F3F227ED3EE22A3DBB791097
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	E7AA2A0F25A77D138B35E2994338B572	A5263E34558E9A126F142F0A4DE17A651061AC0A	5F910CB066BC8E39FC05979FA662D671F66A50D990872982B57582D2771796F4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	E7AA2A0F25A77D138B35E2994338B572	A5263E34558E9A126F142F0A4DE17A651061AC0A	5F910CB066BC8E39FC05979FA662D671F66A50D990872982B57582D2771796F4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0adb0edd-c452-48ba-80ae-657430bfab77.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\22b650c7-1897-4b99-ac16-0027fd94b8ac.tmp	JSON data	B5E18B7B8BF4BFE4668690FFF2D82495	50C47FA782C4CE4B811A94C34D4B9BC6884FCE2E	5326C5D9C23AC990770F590ECAF8137CEE89B5F2B9D3F0E065598702091D647F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF635dfd.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	1CF78D31DEB2E748D2F93ABC60D4D1CD	9376D11235B0A48AAB64CE176C8D17391F646BC1	5A9ABF8C6586E844BA38383AF8EDD9C69724DD6D733B61EE3DF3554664429D88
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	D790BD969A1CA8D3D712682797C99129	A88BBF4143E0D231CA0495815BA48A474B33D709	B35B38162F686BE10AC85588BCBF68AB6D23D07026A55C1AF57B43293E7B4046
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	D790BD969A1CA8D3D712682797C99129	A88BBF4143E0D231CA0495815BA48A474B33D709	B35B38162F686BE10AC85588BCBF68AB6D23D07026A55C1AF57B43293E7B4046
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240427012039Z-270.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	BF382857478FEDAB01C2180B0183B729	7CB965D68B3A5A1FD138BCD761569556F37B19BA	D6DFA2C7914BE1446A74F48647DEFE1023A5B47C594A7AC40430D6AF81F2C0E1
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	CD2488F3E855D967ECBD1134A6169B7F	C314F785DF655A1C684A1457D7D836E33FE6D805	E0A46FE73A5E9A880809A7D21D6AE818D78CD2A384063CE32E9F8FBE2F3BBED7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	3BAC380347F5AD79A67357118C3F18DA	0CA3DF28861693C19528AF8766181E56B0C0A43A	C912993BB46039CC61CDF8F0797DC5BB748B56C2ED1EF134A152289D07FE7445
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4500	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	31EBB2C68BD777990EA708A1D9F3B26C	DE3BF413AB10F8604FA31B86C25F2A2BF3FD6699	75054878974D4A5BDE734E84D9ABC66AC6521B3F36626CD8A4D274CDA5EAA905
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	8EA7855200AF7B296A56F9DA8294E53F	9B452FD2102F9703B8D0D69061BD48922D29D6A4	4203F14ACA47C7BB055976164444F13B7188F42A4E20C2842FDA11A0A42AFB52
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	2DBD9919707792B1E5FBEDFAA27ECEEF	1BA02CB81F00FE54F13A0E6CE17EF18D677571EC	C252B8A3217AAACF49A286A21603569451CADB7D25BD32C32E0D84E328C58A85
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	3379E3C74793B4EE32577F52A365A4E9	39CD9C9369877B6BD3609EEE81FDEC819BB5A81C	5A255D58FDAC8FAFB4B8F652DD1D9ACFD38CA5412E7A6CFEE193F26F59D268DC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	F2E45ACA523600A70B5A01C318DD1EF5	AD1F959B0066BC4BA6AE00E29812F6FC18FF7A9E	7E06353DE9BBABB5338831C72D99A18A0A7ED0AFA718068E25C6DE287B54E1DE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	0D92902AA0F70916E08113DF13DAC52B	91EF91A4A7D0E437721598D471287F7464101312	086680BFAC74412BCB88BC80FD4A604CC8043ED5D18BACF3C525DCE78D17E11B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	39CBB9A2F953538F0FACFB44FB144FD2	C02C4D132A23961FF5B162F9D89111FF1E084054	815E66675C003571276A240D376074C4383C2FDE8A4D565DEBB6E48AFB30B5B2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	03CF473D9FC7D48E2D083F24E3099BE2	56157FD8DA7A2631A892A9D1A6249A2D6C37BD28	E9611B8410AD7D50A5B345EE836B5B257D4A377D7E0306C44F829B1572B77D45
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	47D341C5C3CE5AD46FA1D42EC64129A8	E71107343D51A10B1B212DE7A205BFB16749B2E3	0AEF4578DD0B340738BF976282ED8105261489ADB7C57886D8E170C5045D7CD2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	743E68CA25E3F88BE70E93FE6CE6EB80	87D62A0B56513CF743E9CCB310EB1A9F7A8DD3CC	C8DF45F92EBB82DACF4DC5F50DFF2028F7AFF8DD825A23FC054CB46367B52DC3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	FE330269A9232706562D530CC9D0A071	C547575708546E7DCA8229DC5A21CD0484676B64	1DF47866C4E03471C5B3123B02934AEB8178217F8C89A5B4E29D4F90BDCB9B2E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	69AB3BF59D1C071E338A676573B8BC30	F15A01C85BC87923791DD1D9A9C53B40FB7C7D31	702C4D95D787BADF14804EAA08674C2F2E82C67A016B3BE3FC87C0F261F047E8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	F3D155A9ABEAC0313EB03B2CC27EC8E9	C53C1ADBCC0DDF1E7BB83EEF11A34D0B78DDF914	DAFE659C5C4A1C243115DA51973305714E8D63D516A82BED8F6ABAC64B962F77
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	E032F149F434C2BC18D200F689F74749	DCB4E60F318A4F8FB2FD2517B78F46802B9BFCE3	41384E7B59B7EA039A7056AB0E3C111A3121C35D59708177BBF7455C47ABABA7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	D80D2416752416BDE76D26B7BDDCEC79	C14EE96105CFFBD460D44FF802D5FF4EBC2F2F7F	27B318B135424E2250A2722213CFE107BF5C22855E2E516EEEBAF3A9F79A6333
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	2F6C90A147462146D3DFA9E1B5770C8C	D583432D2659071A36EFF51658433DFA888110F5	FF20A258D08ECD12F949C6CF2613248C1BDC5EC4A0F04ED8DB30CDE84F1A97A3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	F95B660BF230D70AB424D1D56F04267B	F2A0185A714B4B7F81C3FD94A21C71407D539963	28880670C6DF20A687CDED00D01F387A4502D58A425334A0DA65F6FE184A224B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	83D2C43AFD738C6F68DB0C227DFF100D	D1E98B1B58B694F5DAC951241DEEF25E6C0AF7AD	7A0D369072514CBA448CB1084648063BBAA53C3DBCF491A0AC8F8133984D9040
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	5042E4CA169A1EFCC1EB5CD2164AE637	E633747758D38E6CF83488BD08CD48A5E7A50312	E09089585B9BB1B99E8123BCF702EC5F8AF9EA02CE318E843F7AE46AF6190B66
C:\Users\user\AppData\Local\Temp\MSI2ad69.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	82E2EA14600DF66666DA51899211E499	601C46122B32C674F311AAB08B7E1B67374301FC	FD30F9AED1AE75810E5A171F736D85537F65E7D4E2884082ECA5EAB9D88049CC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9skb9_nxo82l_3h0.tmp	PDF document, version 1.6, 0 pages	9093A4A4E32D32CDB09B9D30AAC4C8C7	3F29ECD85DA46243CD8976C2667748EE81538AE0	918CAFF40F1C10B74BFF90FE806315D96BD1BC5E543DEB97BC55C70D682B2AE6
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-27 03-20-34-600.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	3B442D4738024710C2D0D1507FFD049C	A94676CBD33BA184600D42F899B7B42918A310E7	A93D133D0EB03E69AAAD2F01C5F534AE195FC17B9224AB9AA9EE8119D3B0E2A1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	D1C6B1CA434BDF2689BD22A61F876778	3D45A70FE02385331CFD4880EE887D1992A027E1	556AF9A4BD95CD30578EEDFE2C29D5255FEDA3560A2316030EFEE537D3654D4C
C:\Users\user\AppData\Local\Temp\acrocef_low\10afed75-b974-4b01-b24d-dfe517735db1.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\319e3de3-e50a-4298-8123-287950c37541.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\7f4f0031-edda-4a8b-8eb2-1523c2f2f52c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	F51616785803EE6E460DABFE7DEF339C	1CB166E973F34BB8F95FFAEE8339F042B6B45A4E	C52B372A19A913D8F2E936209E41C296DDD8342041D4075AB2C324DD7CEDF38C
C:\Users\user\AppData\Local\Temp\acrocef_low\8dc283ce-f7e2-4f76-b930-8d1f9685b4dc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290	DE3FBE7CDF2D98BC9374D18B5AA61F8D	6E067082A48A8ABA07CB7131A6762E4EEB1807DF	13099604A80B39BE30ED03CA5CF294741D29929C880782866E2B803108478E4A

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 107.22.247.231:443
Source: global traffic	TCP traffic: 107.22.247.231:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 96.17.64.189:443
Source: global traffic	TCP traffic: 96.17.64.189:443 -> 192.168.2.4:49742

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 96.17.64.189 96.17.64.189
Source: Joe Sandbox View	IP Address: 107.22.247.231 107.22.247.231

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-aliveAccept: /Access-Control-Request-Method: GETAccess-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-keyOrigin: https://rna-resource.acrobat.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Mode: corsSec-Fetch-Site: cross-siteSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.189

Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: classification engine

Classification label: clean2.winPDF@14/46@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-27 03-20-34-600.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CERT-1416920247.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1592,i,11691557971963258939,14076181574158468208,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1592,i,11691557971963258939,14076181574158468208,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CERT-1416920247.pdf	Initial sample: PDF keyword /JS count = 0
Source: CERT-1416920247.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9skb9_nxo82l_3h0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9skb9_nxo82l_3h0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: CERT-1416920247.pdf

Initial sample: PDF keyword stream count = 198

Source: CERT-1416920247.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: CERT-1416920247.pdf

Initial sample: PDF keyword endobj count = 281

Source: CERT-1416920247.pdf

Initial sample: PDF keyword endstream count = 198

Source: CERT-1416920247.pdf

Initial sample: PDF keyword obj count = 281

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

ID:	1432433
Product:	CloudBasic
Start time:	03:19:43
Start date:	27.04.2024
Sample:	CERT-1416920247.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	05f30d9cb8f7b79c65256dca2447549a
SHA1:	3a00a290c43fa03f3312237074d0395b52d8ea94
SHA256:	0f14c0cb3b105175dee0032ac24b96d071aef81fe5329cccffa18f3663058985
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Windows Analysis Report
CERT-1416920247.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report CERT-1416920247.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
CERT-1416920247.pdf