Windows Analysis Report
CV 31944.pdf

Overview

General Information

Sample name:	CV 31944.pdf
Analysis ID:	1458482
MD5:	d33aefee20a17090334f5b11d92b4ad7
SHA1:	b8bbdb6a57baa8c6e1fc1e5cdf7580532d0093e1
SHA256:	c4303b728b8bfd336e8a3b52140ac97e0e4644455521d5544e81309e1167d983
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected suspicious PDF

IP address seen in connection with other malware

Classification

Signatures

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Source: classification engine

Classification label: sus20.winPDF@41/49@0/7

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4956

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-06-17 12-12-00-793.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\CV 31944.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,8716942340994201186,11730400643872671699,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://indeed-export-600551.pages.dev/009812389/291e"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1888,i,12805633937832967243,6919689399299974699,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1724,i,8716942340994201186,11730400643872671699,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1888,i,12805633937832967243,6919689399299974699,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CV 31944.pdf	Initial sample: PDF keyword /JS count = 0
Source: CV 31944.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: CV 31944.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Persistence and Installation Behavior

AI detected suspicious PDF

Source: PDF shot

LLM: Score: 9 Reasons: The screenshot contains multiple indicators of a potential phishing attempt. Firstly, there are visually prominent links such as 'click to download it manually' and 'https://indeed-export-600551.pages.dev/0009812389/291'. These links could potentially lead to malicious websites. Secondly, the text creates a sense of urgency by suggesting that the user needs to download the document manually if it did not start automatically. This tactic is commonly used in phishing attempts to prompt immediate action. Thirdly, the document impersonates a well-known brand, Indeed, which adds a layer of trust and can mislead users into believing the document is legitimate. Finally, the sense of urgency is directly connected to the prominent links, increasing the likelihood of a user clicking on them without proper scrutiny.

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
172.67.218.27	unknown	United States	13335	CLOUDFLARENETUS	false
172.66.47.155	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.80.1	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://get.indeedex.workers.dev/009812389/291e	false		unknown

ID:	1458482
Product:	CloudBasic
Start time:	18:10:57
Start date:	17.06.2024
Sample:	CV 31944.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	d33aefee20a17090334f5b11d92b4ad7
SHA1:	b8bbdb6a57baa8c6e1fc1e5cdf7580532d0093e1
SHA256:	c4303b728b8bfd336e8a3b52140ac97e0e4644455521d5544e81309e1167d983
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	D7FD42EDCACF786262D503420850D56F	95583D41BD5B1FC4D6203B02BE2BC31EB297293A	6F6C16A23DC4D1004D8E94AF709969A09C110F1DEDE908D8E74C1559B3785F3D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	D7FD42EDCACF786262D503420850D56F	95583D41BD5B1FC4D6203B02BE2BC31EB297293A	6F6C16A23DC4D1004D8E94AF709969A09C110F1DEDE908D8E74C1559B3785F3D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	83BF6C8234011AA53C61F1264066BEF0	C75BA020242E9033E2F731AF22F0031EE1ACC1E1	4284E3A87B63CB8CF973FB484C869286A0506EC5C2F2479D1AEBD1D06AB9D23F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	83BF6C8234011AA53C61F1264066BEF0	C75BA020242E9033E2F731AF22F0031EE1ACC1E1	4284E3A87B63CB8CF973FB484C869286A0506EC5C2F2479D1AEBD1D06AB9D23F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4e21d4ee-bbfd-4ab4-bb04-5149217d8003.tmp	JSON data	B0468111D5045AA634A25FC5A49280B0	EEE9BA3BB3164FE745884614F389E6807E431D75	12EB9940499CB240AA9DE641381C71481962FA2638DD8C27EF61A867402C9E2C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B0468111D5045AA634A25FC5A49280B0	EEE9BA3BB3164FE745884614F389E6807E431D75	12EB9940499CB240AA9DE641381C71481962FA2638DD8C27EF61A867402C9E2C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	0F36615E42700234894D232F7FFE20C5	44B98AED87FB7FEB85064D433FC9D918193F302A	7702F7CAECBC03303E6CF21D2299601CE5F7E4E78615F39A6202BA96527795E5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	2E9BE9B595DC42A49DAA5BB5AF4A2C33	B188E7D149D37EBB450567EB0FC1438FB95249D6	D1A1825DFCA3834AB32F3A82D5357E9F60384A95F9F15BC362EBBF9EB691DE00
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	2E9BE9B595DC42A49DAA5BB5AF4A2C33	B188E7D149D37EBB450567EB0FC1438FB95249D6	D1A1825DFCA3834AB32F3A82D5357E9F60384A95F9F15BC362EBBF9EB691DE00
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17	470746254A26BAFD849070F0DF293659	FFC20B4D2CF812BD398722B5E50C64DD96DDEE7F	62E034448A48EDD9E7866CEB8830E8842B64A3DFD0E217E643350D2844566A0D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	47E62C83929D74B8622CE239BDE967B2	CCD670B3791E538D53A9E1F1B6BED58DB9BF2CED	BF98CDF24374DD5B4A192054151D71EB3D89E74EDAB17D761EEC447F18346540
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	7DD06B9E4CFB870BAD66269BEF81A4B8	FCE4B6200306BB75714D6DBF4172DCF4A3329C85	CABC1C9F4B14FE83F31D82A8251BE7095CD66634AF64E9E70D29260E4B5D4A46
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	6A0274FE02C3AD09CFDA97FFF4D6DFE3	39C5513C4CDC9571FC6EF46750C992B781B8D7D7	DE01D9CEBDC76E87DB0E3F87AEC89D1D29D6DA68E237E189155187D916BDA320
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4956	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	EE49D102C79B5D09C7D63228B14B15E3	1141CB0B7E6CEB3EB55EB994F962B0915AC69A16	42A1B5B859408554CC7DD8C12779763E9CE2E1F4608CAC42F1BC3901D40A1527
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	373086E467BD6592BE35AB97040E96FF	DF8D557E5319666776F9C6486A5FC03C96A5F5BC	B9C2CC71A165A9F9ADCEB2B1EF66E1185C4B832927E8620B3B00A4E4A33E2A94
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	50E9A1A77E2A4F8387DEE72E8A592D02	928B58E2D1BD343E986E9CAD63798C789FA5444C	06C8D206D05DAFCEA98B953F2AAB1F72919D4ACD4A4352DFC6C72CD4A499FF7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	72A16C7E5AEB9D2622BE485E4DD6F743	ACF3EF6F0E607028E78FB9DE1D0A293C0AF58930	37FDBF5E579854AFDEAE237CEEB44DD81A4E05335D696FB99F8744EEEB841BF0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	A9C0AAB872177A0F3BAFB62DCF9E1FC1	940D4E377367C3CE3F270491ECFF05AFD39490AD	2DEFA01AC85293992D4BF1F29428FCB6F4E6AA25C08418ADABB5A7F8EB645FC4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	4FCEFFF1E5C2BA91B259857E91280B2D	793A38CA16495169F4835F836F557D1E114FAD08	17BDC6783DEDCAADFBE53BE44A3DE393580075C1340553838E90567998518512
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	325AA3276DCC40CF765E8AEA7752D8B3	C2E586AF9FEBE9F6CD4045C421285FBF5BE47B37	08A0F2F4022DDCB90CDB008F68CA9A5FEEF134F7C7EA2F18BCDE60C146C6A393
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	3DB2AB89DB509E5CD9FC9D460FB0471E	79EA9A29575A35813ABE6160320EEA4D34624863	30B0173FCEDA82DE010EE7C071FA1AE2616AD2C52B1368CE84A90BA05AD6B84E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	BCDC747C6007D3A46965312200EA9CD1	B939F663E7921494FBB5FE477BE3AF78098799CC	2D43F7F4FD1C5AD95C111C2CEEB1630D38B047D5DAE6937D260C0024DE8843FE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	3F72167E30572BE6CDA973E5E603856B	4AAC5AFDB48727002C0A0F2E98830B0492ACAC68	E2C25F876F23BDF2AE0ED29EDF707CA106FED9F9A1E283E2D33A6CADE55E0C76
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	2AF134045EB4D3EA90DD115E477044FE	6B4B9BF7BD9B6F8847C916516BE06CAA2969CD99	7DCA9334813E3088171B1CE7CDAECC44B8DAF9399B4FAA6084C8960328B406DC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	DFF724421327288817CB1DD75A5CC656	8BE7C5755B160C40166CB8CD3F209F48D8E72BBB	942BF4164775E44D9B9185EB1E1352594EF50F9028EB2285A851F52D1EA1340B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	961EF44F897A5D9BAF1C2341D114E359	4DBD718CAF2250FE54DABF4E2940E6DE2DC27B4C	B1BAD4C05CFFABDFAC288EE474325E5F90CDF986203B388C77DF2CBB55E221D0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	61DB55BF8443B820BB05439BF554A678	70979AE73851B32F379E008521BF8970EEA727E9	A296A06134EE3BB8B96DB4D4B32AB42F1DE7AFF17C9CA499B7261EFD2F221B6A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	C713C809EECA9CCF859CC42296D1A949	44464587EF3A898175482E7E21476D3AE0E68493	672AF2E078E1C246DDFB3073C73BC709ED93BC9A37CC11F5B0D077656682B661
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	2C7D53333BA8BE53F9C0B8958007F740	7C6F5AED3E8DDF6E251228D2939FAE6A47C8BBB6	E705A02F1A679D5D21EEE96521E5340F15148F3CD66070C96AD8B61BEA0CF9E7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	898F4BDE8CCDFCC5B69B9607742252AF	73EF74FDB64197E81C81628DEEC3DC974BF0A351	6BB94CD073BA2E0E75F7E0EE3A02B8FF9C3FB8B8B8EBEF5AEB8299574C0FC6F6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	DF48360C2ED86ACF09392237143F8938	5E629F8BA5C0D22AB0978B84C31B2DE77785A4D6	D9064C702857F98CC166B9FC2B753B3F8DAFA3CE8D4846BC84FD65D656B70842
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	C19AB16EA8DABE9A4569D3E9BFCEC779	51D13DF663D1005116F9CE1DE4B71BE19249C2F3	72157B136A22DCA7DD8BBA5A0CE4FB02D98B3AF31F7EBAE3D14F4DF461DA030B
C:\Users\user\AppData\Local\Temp\MSI3b9a9.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	60F35B3E37918D6B260829052454E35D	DB766ECFAC0D2AA91A3C3E9DB170DF8B12F066A5	EDFEA5BBEBB4A6E2091FF611711F2FDF7E84DD3F8E7CBD27EEE2ED3D345D2C44
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91k2n36o_15z1ybe_3to.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	997CE5ED3633E8FF84C2F7D1F0E48E53	D22617BDF6D8DCE13E5FCBE9BDD57A812EE1E237	E06C221FB5B43F5A25220D326EB501573C2E0CC9FBB31007BF79054B6F613907
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9elaef1_15z1ybf_3to.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	997CE5ED3633E8FF84C2F7D1F0E48E53	D22617BDF6D8DCE13E5FCBE9BDD57A812EE1E237	E06C221FB5B43F5A25220D326EB501573C2E0CC9FBB31007BF79054B6F613907
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-06-17 12-12-00-793.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	48848E45190139B4896A86DD66F66355	E95C631BC7EFA940468EF6DE1AF12C7C07B0C003	E2B8C14CB3ABC3370D31EBA51E27353A477AAB2E5869CD0778AD2CA2AE2143DF
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	6143AA0AB9499F7C256B5D9E559C15E2	A22F809924F810A2C61069A7FC820599158C907E	4AF96E3F87C15E4AA74C74619B079E9820D87BBB66F8E80E22F6E52A8A6A95B3
C:\Users\user\AppData\Local\Temp\acrocef_low\6365fb54-cb7e-411b-b082-749c983f1f5f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\7532b8ed-a4f5-41b9-8d62-b56c6c8be242.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\97e5fc7d-2aa8-48e3-bed8-e1b0d2eeee90.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	13F55292D0735B9ABD4259B225D210FC	810CC5D545BFA11D2825F6E1DFA69176794DA7EC	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
C:\Users\user\AppData\Local\Temp\acrocef_low\ff0089c9-3327-4648-9dc8-417066317671.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	B7A9A5A223B9DCE0E7D10E2B32A0BA07	FFB925FA80873CF50D8CB6DA530BA8CD7F0D9922	4EF52E63D45F5230C47DBD3764AA90768F708B24885579375724473BB3FFB255
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	152F65AAA856C44E87C8ED561AE43C0F	B6440383DBC4D3446E91CBB58EEB8C8BD6671F50	48AC59FC9FA38016B6D5A4CB5D89A2C0CABCD8A0404AF29FBE995B4AA647A292

Windows Analysis Report
CV 31944.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted URLs

Windows Analysis Report CV 31944.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted URLs

Windows Analysis Report
CV 31944.pdf