Edit tour

Windows Analysis Report
http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf

Overview

General Information

Sample URL:	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf
Analysis ID:	1435389
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found potential malicious PDF (bad image similarity)

Drops files with a non-matching file extension (content does not match file extension)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1376 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2020,i,14378566819949752466,8443063879488141184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6536 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Acrobat.exe (PID: 6024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3204 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1572,i,7696756996481466979,377290051609145949,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: keep-aliveContent-Length: 146Content-Type: text/htmlStrict-Transport-Security: max-age=15724800; includeSubDomainsVia: 1.1 varnish, 1.1 varnishAccess-Control-Allow-Origin: *Accept-Ranges: bytesAge: 2707Date: Thu, 02 May 2024 14:23:09 GMTX-Served-By: cache-fra-eddf8230094-FRA, cache-lga21923-LGAX-Cache: HIT, HITX-Cache-Hits: 107, 0X-Timer: S1714659789.122654,VS0,VE18

Source: downloaded.pdf.crdownload.0.dr, chromecache_141.2.dr

String found in binary or memory: https://nabot.yftejum.com/9565112701457389466222?fopulenabatovadalatoludupozalabogufanexebopegopamuj

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 69.192.108.161:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.108.161:443 -> 192.168.2.4:49741 version: TLS 1.2

System Summary

Found potential malicious PDF (bad image similarity)

Source: downloaded.pdf.crdownload.0.dr	Static PDF information: Image stream: 7
Source: chromecache_141.2.dr	Static PDF information: Image stream: 7

Source: classification engine

Classification label: mal56.win@35/45@5/7

Source: chromecache_141.2.dr

Initial sample: https://nabot.yftejum.com/9565112701457389466222?fopulenabatovadalatoludupozalabogufanexebopegopamujenavufusefiwovawugekezuzuwubobogegoro=desoxefebovizoluregedolamoliwebererixitebaxivonesajevigekavumupirigaliwalegetokutivemapinozezobefedovefojojagusabumawukifudoxikufaletiviwinujovugodolozupanilalavegabavozusunaritiferibajefakoninavojugedevedifa&keyword=cbt+downward+arrow+worksheet&wupetobigojaritomozupunixezejuwokapezotomigexudugefuraza=xezajajajiwasozeserusuworanebosutamototevafebuwusubipizedibimedekabotudivatawexenokezuxujagipalunegaketizoganoxewivujov

Source: http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.22.254.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf HTTP/1.1Host: jimdo-storage.global.ssl.fastly.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: jimdo-storage.global.ssl.fastly.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdfAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf HTTP/1.1Host: jimdo-storage.global.ssl.fastly.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: jimdo-storage.global.ssl.fastly.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2020,i,14378566819949752466,8443063879488141184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1572,i,7696756996481466979,377290051609145949,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2020,i,14378566819949752466,8443063879488141184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1572,i,7696756996481466979,377290051609145949,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 141
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 141			Jump to dropped file

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
jimdo-storage.global.ssl.fastly.net	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
file:///C:/Users/user/Downloads/downloaded.pdf	0%	Avira URL Cloud	safe
http://jimdo-storage.global.ssl.fastly.net/favicon.ico	0%	Avira URL Cloud	safe
https://nabot.yftejum.com/9565112701457389466222?fopulenabatovadalatoludupozalabogufanexebopegopamuj	0%	Avira URL Cloud	safe
http://jimdo-storage.global.ssl.fastly.net/favicon.ico	1%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jimdo-storage.global.ssl.fastly.net	151.101.1.194	true	false	0%, Virustotal, Browse	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.251.40.228	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
142.251.40.228	www.google.com	United States	15169	GOOGLEUS	false
151.101.1.194	jimdo-storage.global.ssl.fastly.net	United States	54113	FASTLYUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.41.168.139	unknown	United States	6461	ZAYO-6461US	false

Name	Malicious	Antivirus Detection	Reputation
http://jimdo-storage.global.ssl.fastly.net/favicon.ico	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	false		unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
file:///C:/Users/user/Downloads/downloaded.pdf	false	Avira URL Cloud: safe	low

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435389
Start date and time:	2024-05-02 16:22:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@35/45@5/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.182000033503862
Encrypted:	false
SSDEEP:	6:DY+9+q2Pwkn2nKuAl9OmbnIFUt86YZJZmw+6YZ9VkwOwkn2nKuAl9OmbjLJ:DYdvYfHAahFUt86Yz/+6Yp5JfHAaSJ
MD5:	3906BB3366D9C84D7030216140542AC6
SHA1:	02E62DBE0317B03002CA8AB583E04829DFC95DF5
SHA-256:	EAAA8719E7F0EBDA2E510BB574687C26DFEB1EF752FE8005EA5324ADD407A866
SHA-512:	6DEBCC71C279612C9C2F7E731AFCA0CC9EE26C67C2F3BC7050F04A02EE00196A22B7867063DF82A54B76533FE09B18F9DA884E010B5353149441EE1A6D8E38EC
Malicious:	false
Reputation:	low
Preview:	2024/05/02-16:24:21.450 1b08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/02-16:24:21.451 1b08 Recovering log #3.2024/05/02-16:24:21.451 1b08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4
Category:	dropped
Size (bytes):	3513
Entropy (8bit):	7.70816494386353
Encrypted:	false
SSDEEP:	48:FHP39VP4JpuERAXUvYKD4D/e6EBKTTemXd8PV7DEMKFJnDrJ4KnWfk7KxfAnSHWH:xPP4JAEfvr2ekUt7PerK47KdAnPVt
MD5:	597E0488DC8E7DFF6691B0047C2B4AEA
SHA1:	995264E2FA3757029FBAF46B1BF70605F5B0BD81
SHA-256:	25C0EE3057DDBE087A1711A71DAD72FFCA6BEA4FBABF5FCA11EED46F874DC4C2
SHA-512:	B636EEFD464F154E1067AFB0237F6F201AEF79055CD600CD243560D57A70EE3669EDF50024ADC7D9A5C3F15BB8D0DCCAC5DD54839FA0297B242F04463597B3C2
Malicious:	false
Reputation:	low
Preview:	%PDF-1.4.%...1 0 obj.<<./Title ()./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...5)./Producer (...Q.t. .5...1.1...3)./CreationDate (D:20231008032855+03'00').>>.endobj.2 0 obj.<<./Type /Catalog./Pages 3 0 R.>>.endobj.4 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endobj.5 0 obj.[/Pattern /DeviceRGB].endobj.7 0 obj.<<./Type /XObject./Subtype /Image./Width 625./Height 155./BitsPerComponent 8./ColorSpace /DeviceRGB./Length 8 0 R./Filter /DCTDecode.>>.stream.......JFIF.....d.d.....C....................................................................C.........................................................................q.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 16:23:05.914669037 CEST	53	53672	1.1.1.1	192.168.2.4
May 2, 2024 16:23:05.930918932 CEST	53	50015	1.1.1.1	192.168.2.4
May 2, 2024 16:23:06.472651005 CEST	53	64270	1.1.1.1	192.168.2.4
May 2, 2024 16:23:08.133198977 CEST	63261	53	192.168.2.4	1.1.1.1
May 2, 2024 16:23:08.133336067 CEST	54270	53	192.168.2.4	1.1.1.1
May 2, 2024 16:23:08.224857092 CEST	53	63261	1.1.1.1	192.168.2.4
May 2, 2024 16:23:08.225574017 CEST	53	54270	1.1.1.1	192.168.2.4
May 2, 2024 16:23:10.231127024 CEST	61119	53	192.168.2.4	1.1.1.1
May 2, 2024 16:23:10.233838081 CEST	58283	53	192.168.2.4	1.1.1.1
May 2, 2024 16:23:10.320456982 CEST	53	61119	1.1.1.1	192.168.2.4
May 2, 2024 16:23:10.322304964 CEST	53	58283	1.1.1.1	192.168.2.4
May 2, 2024 16:23:28.544948101 CEST	138	138	192.168.2.4	192.168.2.255
May 2, 2024 16:23:28.871551037 CEST	53	63953	1.1.1.1	192.168.2.4
May 2, 2024 16:23:51.440289021 CEST	53	55807	1.1.1.1	192.168.2.4
May 2, 2024 16:24:05.448978901 CEST	53	60860	1.1.1.1	192.168.2.4
May 2, 2024 16:24:14.387725115 CEST	53	55513	1.1.1.1	192.168.2.4
May 2, 2024 16:24:28.044939041 CEST	57029	53	192.168.2.4	1.1.1.1
May 2, 2024 16:24:28.133164883 CEST	53	57029	1.1.1.1	192.168.2.4
May 2, 2024 16:24:29.939655066 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:30.028873920 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.029083967 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.029097080 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.030798912 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:30.046303988 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:30.047766924 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:30.048636913 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:30.133826017 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.133841991 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.133857965 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.133907080 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.134423018 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:30.134495974 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:30.135152102 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.136965990 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.139339924 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.165887117 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:30.221996069 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:30.248648882 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:34.589101076 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:34.678055048 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:34.679950953 CEST	443	52686	162.159.61.3	192.168.2.4
May 2, 2024 16:24:34.706688881 CEST	52686	443	192.168.2.4	162.159.61.3
May 2, 2024 16:24:48.561644077 CEST	53	54806	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 16:23:08.349478960 CEST	532	OUT	GET /file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf HTTP/1.1 Host: jimdo-storage.global.ssl.fastly.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 2, 2024 16:23:08.439694881 CEST	583	IN	HTTP/1.1 200 OK Connection: keep-alive Content-Length: 322193 Content-Type: application/pdf referrer-policy: same-origin cache-control: max-age=31536000,public x-frame-options: DENY content-language: en x-content-type-options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains Via: 1.1 varnish, 1.1 varnish Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 1210008 Date: Thu, 02 May 2024 14:23:08 GMT X-Served-By: cache-fra-etou8220078-FRA, cache-lga21923-LGA X-Cache: MISS, HIT X-Cache-Hits: 0, 0 X-Timer: S1714659788.392986,VS0,VE1
May 2, 2024 16:23:08.440838099 CEST	1289	IN	Data Raw: 25 50 44 46 2d 31 2e 34 0a 25 c3 a2 c3 a3 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 69 74 6c 65 20 28 29 0a 2f 43 72 65 61 74 6f 72 20 28 fe ff 00 77 00 6b 00 68 00 74 00 6d 00 6c 00 74 00 6f 00 70 00 64 00 66 00 20 00 30 00 2e 00 31 00 32 00 2e Data Ascii: %PDF-1.4%1 0 obj<</Title ()/Creator (wkhtmltopdf 0.12.5)/Producer (Qt 5.11.3)/CreationDate (D:20231008032855+03'00')>>endobj2 0 obj<</Type /Catalog/Pages 3 0 R>>endobj4 0 obj<</Type /ExtGSta
May 2, 2024 16:23:08.440918922 CEST	1289	IN	Data Raw: fa 63 fc f3 4d 6c 4b dd 2f eb a7 63 9d 9b e1 07 86 d2 43 9d 39 49 72 48 53 73 29 2d eb fc 5f ca 9a 3e 0c 78 75 65 04 d8 12 1f 24 8f 3a 63 e9 df 77 15 d3 ba 85 70 39 03 1b 71 db eb e8 33 48 9b c4 6d 80 e1 87 76 39 38 1e 98 eb fc fa 50 b6 29 bb cb Data Ascii: cMlK/cC9IrHSs)-_>xue$:cwp9q3Hmv98P)Ts?\|4gqw7i370'POL!s@?'9/fL%C 93ryp~nMfqL4R2Wfc8
May 2, 2024 16:23:08.440985918 CEST	1289	IN	Data Raw: d7 87 22 04 36 9c 24 c3 f7 9e 5c 0e 49 e3 e6 eb 83 8f 7c 57 4b 18 d9 33 0d ea 59 8f 7e 31 fd 7a e7 f2 eb ea a4 b4 05 d8 21 2a 07 23 1c e3 3c 90 07 24 f7 fc a9 be c2 8b da 4f a5 ff 00 af eb fc ce 64 fc 22 f0 fc b2 02 9a 73 fc 8d c6 2e e6 00 91 c0 Data Ascii: "6$\I\|WK3Y~1z!#<$Od"s.Up~lzS.y;HR6y0?uBA,@JEG3{n:>oilVIo\wwm@BG_O^VVa%)#J~=v9xsk
May 2, 2024 16:23:08.441025019 CEST	1289	IN	Data Raw: a4 04 24 0f 5e d9 f4 ff 00 1a 58 47 ef 09 57 0e ad 95 e4 8e 3a 71 f9 e6 81 ab df 5f eb fa fe bc f9 a3 f0 73 c3 6f 20 df a6 ed 00 e3 fe 3e 26 c7 5e 3f 8b d4 ff 00 9e 70 37 c2 5d 02 4c ee b0 3b 58 82 36 cd 37 1e c7 e6 e9 9c 57 4c 30 80 11 9c 07 e7 Data Ascii: $^XGW:q_so >&^?p7]L;X67WL0#B(bAaLsMAv]9h'zSeG)_/W8?p7sOV9H\|]~xj@i'nCZX>x~JXsJ}7u}N<
May 2, 2024 16:23:08.441107988 CEST	1289	IN	Data Raw: d9 24 10 30 e5 9b 90 9c 72 41 cf 19 c7 23 af 5e 9d e9 32 24 95 b6 b1 c0 1b 58 1e 7b 76 ed 9f d3 9a 22 1e 52 6d d9 b6 46 cf dd e8 3b fb 64 64 ff 00 fa a8 b0 39 5f 44 3b 76 1a 43 91 86 21 57 60 3c 1e e3 8e fe ff 00 4a 54 50 55 b0 0e d6 c9 20 f4 c7 Data Ascii: $0rA#^2$X{v"RmF;dd9_D;vC!W`<JTPU 3Nxs1*#9/9}}~B0NdL28=d$;8T@rF<?COFteNzm*J,iz8y[&
May 2, 2024 16:23:08.441181898 CEST	1289	IN	Data Raw: 18 48 48 ce d0 dc 74 04 36 47 ff 00 af f5 a8 fe 58 27 45 79 23 5f 37 e5 8f 76 14 b9 00 93 f5 c8 52 71 8e d9 a4 68 c8 84 37 2a d1 a9 55 dd 93 f9 e4 ff 00 3f 6e 7b d3 b1 31 6d 5d a5 eb fd 7c ef ff 00 0e 4c e3 c9 8d 48 52 c1 14 9c 92 06 07 f9 fc 38 Data Ascii: HHt6GX'Ey#_7vRqh7*U?n{1m]\|LHR8M%fA9sBm%W#ryfF I<T=ShB?SfKE==5".s-2[JfD\`c#< ?t?f
May 2, 2024 16:23:08.441276073 CEST	1289	IN	Data Raw: b6 df b1 6f 03 a9 2c c5 8f 2b d3 23 f1 fe 86 88 95 16 dd 48 00 2a f2 a7 af 1e b9 e7 b7 7e f9 af 2c ff 00 86 b1 f0 c4 52 ba 2e 9f ad 32 ff 00 08 fb 3c 41 48 eb d0 c9 df 39 e9 df 9e 94 df f8 6b bf 0f 43 0b 95 b0 d7 18 a9 c0 fd cc 4c 47 3c 1e 24 27 Data Ascii: o,+#H*~,R.2<AH9kCLG<$'MZw=Y8i499yb~^Z,D=(Hln+bcih^`+zF8^<+zs^W7q7El<i'\|4f[/V,
May 2, 2024 16:23:08.441358089 CEST	1289	IN	Data Raw: bf d3 34 c9 26 fb 39 0a cd 99 31 bc 2a 8c 90 be c3 bd 34 0e 56 d5 ed fd 7f 5e a0 00 89 dc 81 b5 43 12 fe 8d c1 eb 9f f3 c0 a7 00 cf 9d aa 19 94 70 59 4e 3b e3 b7 e8 3a 66 94 b9 75 04 e3 39 18 38 07 df d7 db fc f5 a5 f2 88 54 46 62 5b a9 ea 01 e7 Data Ascii: 4&914V^CpYN;:fu98TFb[lQ[m#6/N?^?4,r~yMPqtpvNp;=})\k_EO=7mVg#8jX?sjY ?hw1$Nv
May 2, 2024 16:23:08.441428900 CEST	1289	IN	Data Raw: c8 da 54 9e b9 23 23 18 c5 7d f9 ff 00 06 cc f8 8a f3 c5 7f 05 be 29 5e df 5c dc 5c df dd 78 95 66 96 79 cf 98 d2 b3 5b c6 49 3d f9 e3 ad 7e 29 bd c0 f3 1f 6b b2 b9 38 1b 0e 78 ee 09 c0 c9 ea 0e 3d 3d 6b f6 83 fe 0d 7b 91 24 f8 03 f1 28 96 39 1e Data Ascii: T##})^\\xfy[I=~)k8x==k{$(9#F>q+1eRPrij2LV6;^.2dy&e9aqzT\|Qnfd<+3jF]IP\?Z0UpC18
May 2, 2024 16:23:08.441512108 CEST	1289	IN	Data Raw: 8e f9 f6 cf e3 42 b1 8f 21 46 e6 62 72 48 da 59 bb 7e 83 af b5 1a 74 2d 5d 6b 2e a2 46 a8 ac c1 46 3a 3b 72 70 4e 4f af 7e 3d 73 9f d5 15 4f 99 85 27 68 25 b2 09 24 e7 39 e7 9f 51 8c 7d 29 cf 18 28 42 85 1b 48 21 47 63 d4 53 7c c2 f2 16 54 43 26 Data Ascii: B!FbrHY~t-]k.FF:;rpNO~=sO'h%$9Q})(BH!GcS\|TC&1#&k_(qdLno*C>h >})%<[8?#}p:vCrFA#!6yoc O>t^=)A\|
May 2, 2024 16:23:09.081217051 CEST	496	OUT	GET /favicon.ico HTTP/1.1 Host: jimdo-storage.global.ssl.fastly.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 2, 2024 16:23:09.186002970 CEST	432	IN	HTTP/1.1 404 Not Found Connection: keep-alive Content-Length: 146 Content-Type: text/html Strict-Transport-Security: max-age=15724800; includeSubDomains Via: 1.1 varnish, 1.1 varnish Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 2707 Date: Thu, 02 May 2024 14:23:09 GMT X-Served-By: cache-fra-eddf8230094-FRA, cache-lga21923-LGA X-Cache: HIT, HIT X-Cache-Hits: 107, 0 X-Timer: S1714659789.122654,VS0,VE18
May 2, 2024 16:23:13.524946928 CEST	357	OUT	GET /file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf HTTP/1.1 Host: jimdo-storage.global.ssl.fastly.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 2, 2024 16:23:13.613847971 CEST	583	IN	HTTP/1.1 200 OK Connection: keep-alive Content-Length: 322193 Content-Type: application/pdf referrer-policy: same-origin cache-control: max-age=31536000,public x-frame-options: DENY content-language: en x-content-type-options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains Via: 1.1 varnish, 1.1 varnish Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Thu, 02 May 2024 14:23:13 GMT Age: 1210013 X-Served-By: cache-fra-etou8220078-FRA, cache-lga21923-LGA X-Cache: MISS, HIT X-Cache-Hits: 0, 1 X-Timer: S1714659794.566474,VS0,VE2

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:23:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-02 14:23:13 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=40464 Date: Thu, 02 May 2024 14:23:13 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:23:18 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-02 14:23:19 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=59999 Date: Thu, 02 May 2024 14:23:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-02 14:23:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:24:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-05-02 14:24:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-05-02 14:24:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 02 May 2024 14:24:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 87d8acd21e117d26-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 14:24:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+PC)

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:24:30 UTC	1353	OUT	OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-key Origin: https://rna-resource.acrobat.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 14:24:30 UTC	508	IN	HTTP/1.1 204 No Content Server: openresty Date: Thu, 02 May 2024 14:24:30 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id X-Request-Id: hJeb2KahYO0ctrBhGLHkpdfxtfc6aB1T

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240502142427Z-214.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Windows Analysis Report
http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:24:30 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: a4ecfc44-3976-4051-8c45-0a7e26b55a37 x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-05-02 14:24:30 UTC	544	IN	HTTP/1.1 200 Server: openresty Date: Thu, 02 May 2024 14:24:30 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 3120 Connection: close x-request-id: LqJYBrKLGAo3R5UXcWXHTVzZejkvm9EA vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id
2024-05-02 14:24:30 UTC	3120	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 52 48 50 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 52 65 61 64 65 72 20 44 43 20 52 48 50 20 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 48 6c 77 5a 53 49 36 49 6d 4a 31 64 48 52 76 62 69 49 73 49 6e 52 6c 65 48 51 69 4f 69 4a 47 63 6d 56 6c 49 44 63 74 52 47 46 35 49 46 52 79 61 57 46 73 49 69 77 69 5a 32 39 66 64 58 4a 73 49 6a 6f 69 61 48 52 30 63 48 4d 36 4c 79 39 68 59 33 4a 76 59 6d 46 30 Data Ascii: {"surfaces":{"DC_Reader_RHP_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","dataType":"application/json","data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:24:34 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-05-02 14:24:35 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Thu, 02 May 2024 14:24:34 GMT Connection: close

Target ID:	0
Start time:	16:22:59
Start date:	02/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	16:23:03
Start date:	02/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2020,i,14378566819949752466,8443063879488141184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	16:23:05
Start date:	02/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	16:24:19
Start date:	02/05/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	8
Start time:	16:24:21
Start date:	02/05/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre