Edit tour

Windows Analysis Report
Review-Report-Scannable.pdf

Overview

General Information

Sample name:	Review-Report-Scannable.pdf
Analysis ID:	1619445
MD5:	8c9df2c3427ff815776a80e9c18cdb84
SHA1:	dddfa84b0a8957b56cbb52d119464759b58edacc
SHA256:	bb904ca6263b77a3ec186ba6d7765e3f7098fc74e1504d62bebf7aadbf768a20
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Sigma detected: Malicious PowerShell Commandlets - ProcessCreation

Suspicious PDF detected (based on various text indicators)

Detected non-DNS traffic on DNS port

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Review-Report-Scannable.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7740 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7940 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1512,i,9956858854306803330,8917847987877056085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 3720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://zpr.io/xr2yxXN4DCYD MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1988,i,6750101603013777856,15764434734045457411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

System Summary

Sigma detected: Malicious PowerShell Commandlets - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Review-Report-Scannable.pdf", CommandLine: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Review-Report-Scannable.pdf", CommandLine|base64offset|contains: , Image: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, NewProcessName: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, OriginalFileName: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Review-Report-Scannable.pdf", ProcessId: 7564, ProcessName: Acrobat.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains QR code

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: Chamberbenefits shared a file with you Scan QR Code with your Smartphone Camera to Access Document This link will work for only you on your computer.

Source: Joe Sandbox View	IP Address: 2.23.197.184 2.23.197.184
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xr2yxXN4DCYD HTTP/1.1Host: zpr.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: zpr.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zpr.io/xr2yxXN4DCYDAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: zpr.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic	DNS traffic detected: DNS query: zpr.io
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52709 -> 443

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Review-Report-Scannable.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1512,i,9956858854306803330,8917847987877056085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://zpr.io/xr2yxXN4DCYD
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1988,i,6750101603013777856,15764434734045457411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1512,i,9956858854306803330,8917847987877056085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1988,i,6750101603013777856,15764434734045457411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Review-Report-Scannable.pdf	Initial sample: PDF keyword /JS count = 0
Source: Review-Report-Scannable.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
Review-Report-Scannable.pdf	0%	Virustotal		Browse
Review-Report-Scannable.pdf	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
e8652.dscx.akamaiedge.net	2.23.197.184	true	false	high
zpr.io	44.216.228.147	true	false	high
www.google.com	142.250.185.100	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://zpr.io/favicon.ico	false		high
https://zpr.io/xr2yxXN4DCYD	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
100.27.146.46	unknown	United States	14618	AMAZON-AESUS	false
44.216.228.147	zpr.io	United States	14618	AMAZON-AESUS	false
2.23.197.184	e8652.dscx.akamaiedge.net	European Union	1273	CWVodafoneGroupPLCEU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1619445
Start date and time:	2025-02-19 23:06:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Review-Report-Scannable.pdf
Detection:	MAL
Classification:	mal52.phis.winPDF@28/54@10/7
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Source	URL
Screenshot	https://zpr.io/xr2yxXN4DCYD
Screenshot	https://zpr.io/xr2yxXN4DCYD

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.23.197.184	Moog__Review_202516370.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	Annual Business Assessment (955 KB).msg	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	Rockwool Employee-efile.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	maliciouspdf.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	0723Request.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	0723Request2.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	Signature_Required_685059704036125863132448255093837927707447788985385580pRnvURiyWINiZlIBYuMn.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	capcut-installer.exe.js	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	Aaron Bentley_2025_Benefit_Distribution_2609.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	zHH1eSjWTK.exe	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
239.255.255.250	https://thetollroads.com-fastrakwy.top/us	Get hash	malicious	Unknown	Browse
	http://cta.berlmember.com	Get hash	malicious	Unknown	Browse
	Fulcrumair- Insurance - Agreementfdp.pdf	Get hash	malicious	HTMLPhisher	Browse
	Shilton_Agreement-8401_Incensitive.docx	Get hash	malicious	Unknown	Browse
	https://link.shoppermeet.net/deep-link?clickid=01H1RW78ZQF6QB5RM2RB5KGV69&geo=us&ip=66.249.66.3&merchantid=108994&propertyid=417896&publisherkey=0f210dc9-c1ef-4153-bd53-8fb98995be03&subid=01GWHNP35ZW7N25QKXMEA9EHVQ&url=https:%2F%2F4L8bLJ1zQ4l1JyaJHaYR.brightnexst.ru%2Fpax6lf1%2F%23%23lap@tahltan.org	Get hash	malicious	Unknown	Browse
	https://dl2.tlauncher.org/f.php?f=files%2FTLauncher-Installer-1.6.6.exe	Get hash	malicious	Unknown	Browse
	https://dl2.tlauncher.org/f.php?f=files%2FTLauncher-Installer-1.6.6.exe	Get hash	malicious	Unknown	Browse
	https://fortfieldglb.com/v/gbp.zip	Get hash	malicious	LummaC Stealer	Browse
	https://iknv44bab.cc.rs6.net/tn.jsp?f=001bQYYUdCAtnu-kYyOM60W9vgr4iqtsaCqPTNtZTVOHs1gbMYfgY0prPMMPSUaxX1i-stkOaoqAOZM9EPo2nyt8NvueFSSzR-RKccwNzS_voq_Coh9MJo00T7xWexFY7weU9fBWT7jPa_Vt7vc21VPzT3z_WRwf-NaI9i0Np2N_OE=&c=szcwij2KkWd1pBJghTGfIxMR_ZXqaEi_NMmZGyMJKhcnlw8LNplUfA==&ch=keK9Fu17bgNZit9wbd-PmBbwR3TsgZQ4NuoLv94CnTGg0RsE_duZRA==	Get hash	malicious	Unknown	Browse
	https://korbtaylor.com/wp-admin/options-general.php?page=limit-login-attempts	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
zpr.io	https://zpr.io/2TketNc7Mvtf	Get hash	malicious	HTMLPhisher	Browse	107.20.233.181
	https://decep.emlnk.com/lt.php?x=3DZy~GDKI3Gf5pJ-_g5NW.Vz2XEmjtL3jxYvYHM3UnPM5XSsyky.xuG-142imNf#user_email=amy_yang@amat.com&fname=Amy&lname=Yang	Get hash	malicious	Unknown	Browse	35.169.17.235
	https://decep.emlnk.com/lt.php?x=3DZy~GDKI3Gf5pJ-_g5NW.Vz2XEmjtL3jxYvYHM3UnPM5XSsyky.xuG-142imNf#user_email=kseong@zendesk.com&fname=Kyong&lname=Seong	Get hash	malicious	Unknown	Browse	3.210.177.154
	http://zpr.io/Kv3PL3bahS66#/yl4Wu36827Bu431QZ961hL12343hL3105bG14HH36065Ve26730Ek67523jA69203Zh08983yN1415487657=	Get hash	malicious	Unknown	Browse	34.239.90.156
	http://7xv6.mjt.lu/lnk/AXMAAFFvlI0AAAAAAAAAA8Ye8moAAABKhgwAAAAAAAq7pgBnByOSeYt8cGpTTPaPBTAKJeV-UQAKnpI/1/EWmySlSHcyP6g54g0SDc-g/aHR0cHM6Ly9zbmlwLmx5L2V6NGxydw	Get hash	malicious	Unknown	Browse	44.222.54.177
	https://zpr.io/DuMYPyJ79qyM	Get hash	malicious	Phisher	Browse	54.82.42.206
	https://l4vm89ff.r.us-west-2.awstrack.me/L0/https:%2F%2Fsnip.ly%2FFedExx/1/010101917bbe6db8-0435991f-93dd-44cd-b7b8-51bfd5cf53c7-000000/HIvKUOwubES5gbenLtlgHO_SzP8=389	Get hash	malicious	Unknown	Browse	52.205.17.31
	https://zpr.io/D4Ds4BwNqbSq	Get hash	malicious	HTMLPhisher	Browse	54.221.79.189
	https://zpr.io/CCttTX8DkxHn	Get hash	malicious	HTMLPhisher	Browse	54.242.107.68
	https://zpr.io/gKq9ft87gpZS	Get hash	malicious	HTMLPhisher	Browse	34.234.243.234
e8652.dscx.akamaiedge.net	Fulcrumair- Insurance - Agreementfdp.pdf	Get hash	malicious	HTMLPhisher	Browse	23.209.209.135
	https://www.icloud.com/attachment/?u=https%3A%2F%2Fcvws.icloud-content.com%2FB%2FAVjG_PNMYS3-EQrrqtec88lfyuAcAcZJ-X2kQx0XzVhj0bgezyOvue77%2F%24%7Bf%7D%3Fo%3DAjZOIINnUr_RGIbD_Icbgam8btmNxNgoTnnO-gHuSsTK%26v%3D1%26x%3D3%26a%3DCAoglu6aFygm4lmcA6xNzPbD54y7z9GNpUv9ffJGPfOvbaYSdhC2rdzz0TIYtr3Xx9syIgEAKgkC6AMA_x8xTiBSBF_K4BxaBK-57vtqJTNEgx6xLMhWGBhqyHEiAglN7ruZoGSElYPqM0jaAqRZk_QlLyxyJRQRc7O_B4ye7YWCwpBLU2AawdyofBeLiWCjxWnddvv6vulFwss%26e%3D1742564875%26fl%3D%26r%3DA6119B6F-E87E-45EF-84F4-AF90553209B9-1%26k%3D%24%7Buk%7D%26ckc%3Dcom.apple.largeattachment%26ckz%3D6B7EAEC9-C4E6-4020-898B-95FC4BFA156E%26p%3D125%26s%3Dph0Ck2lMpxev3AMIFvKS_qGyF-w&uk=oZPOnxX8bSHuHHADy2Qc_g&f=B1_Kapitel1.pdf.zip&sz=34834993	Get hash	malicious	Unknown	Browse	23.209.213.129
	Ebizcharge-BonusSupport-request-approved.pdf	Get hash	malicious	Unknown	Browse	23.209.213.129
	https://atstrack.com/customer-support/software.html	Get hash	malicious	Unknown	Browse	2.19.105.127
	file.ps1	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	104.76.201.34
	#U94f6#U884c#U8f6c#U8d26#U51ed#U8bc1.lnk	Get hash	malicious	Unknown	Browse	104.76.201.34
	i#U043en.pdf	Get hash	malicious	ScreenConnect Tool	Browse	2.19.105.127
	Ymcaret W-2,Tax_Return.pdf	Get hash	malicious	Unknown	Browse	2.19.105.127
	Invisalert Solutions Revised Billing Proposal for 2025.pdf	Get hash	malicious	Unknown	Browse	23.209.213.129
	Moog__Review_202516370.pdf	Get hash	malicious	Unknown	Browse	2.23.197.184

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.201882935950185
Encrypted:	false
SSDEEP:	6:iOXBkjLUq2Pwkn2nKuAl9OmbnIFUtFBkjLE2hZmw7BkjLE27kwOwkn2nKuAl9Omt:7xkEvYfHAahFUtTkNh/lkN75JfHAaSJ
MD5:	EC0E1C43E40360C79F69FC97BBA7AACB
SHA1:	D2B8D821FB2163610A2FEE9661E76039F6184107
SHA-256:	60AF5AAC3E7FDCD555328C011C7EA08601DF2E98F4D9D62385D66792FCE223F0
SHA-512:	25F8193C04ADE27E2E8C1F77E6E873CBAB176BD8D1068E449B313528DCADB9453EC86AA1C2BB1BE4176FF924031C6F92EA3A3EBE4F86839029A3A0CA7A99DFAD
Malicious:	false
Reputation:	low
Preview:	2025/02/19-17:07:39.161 1e60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/02/19-17:07:39.163 1e60 Recovering log #3.2025/02/19-17:07:39.163 1e60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	31
Entropy (8bit):	4.018081793978685
Encrypted:	false
SSDEEP:	3:YAdJMMKFDn:YAdkn
MD5:	9C9365047C3A61FD94A14B9270F6C663
SHA1:	E062CDBB7AB530CB950563C19A9A805A01A9ABA5
SHA-256:	2E1A34D210E6E390601D59040118AF53666E0E004DC885760370D7925AEB3964
SHA-512:	0A502EE3BAC35BC07F69CF73FB609B4C236B6538E1ACB45826E05E0B626A4E28DCD5F4679F0C9C73FFA9C0E8AB22FF433A708D8EFB83B4CB385F66A65F31BB4A
Malicious:	false
URL:	https://zpr.io/favicon.ico
Preview:	{"error":"no link found! :-("}.

File type:	PDF document, version 1.7, 0 pages
Entropy (8bit):	7.513304907240447
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Review-Report-Scannable.pdf
File size:	6'124 bytes
MD5:	8c9df2c3427ff815776a80e9c18cdb84
SHA1:	dddfa84b0a8957b56cbb52d119464759b58edacc
SHA256:	bb904ca6263b77a3ec186ba6d7765e3f7098fc74e1504d62bebf7aadbf768a20
SHA512:	1985463b06935d4cde1cca18c8900173cb4d4054dbec69954aa76b74164e81c2a50660f060306fee3e3ccb28666d83f2dbfd4230cb03718281dc2dcd7f154484
SSDEEP:	96:BvHBy4rdszeXumH4PYYWHtcavI1t55ZzyT55AzU+qPXXAYLMWCqEaKwpEUfPoAE:7A4FbHthvGKTfusX1MvqEaKwpEUfPoAE
TLSH:	CDC13B1EF69E4C85C8938CCDC92E74CA565D794256CCA9FB20246D8F6844E28F212F9F
File Content Preview:	%PDF-1.7.1 0 obj.<< /Type /Catalog./Outlines 2 0 R./Pages 3 0 R >>.endobj.2 0 obj.<< /Type /Outlines /Count 0 >>.endobj.3 0 obj.<< /Type /Pages./Kids [6 0 R.]./Count 1./Resources <<./ProcSet 4 0 R./Font << ./F1 8 0 R./F2 9 0 R./F3 10 0 R.>>./XObject << ./

General
Header:	%PDF-1.7
Total Entropy:	7.513305
Total Bytes:	6124
Stream Entropy:	7.839224
Stream Bytes:	4204
Entropy outside Streams:	5.121605
Bytes outside Streams:	1920
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	12
endobj	12
stream	3
endstream	3
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5	Preview
11	005a00adad005400	a80af8bca9efbe5583e9bd5f1769847d
12	007172e4231c5940	101b133627f852c5f7e3af7e532cbf28

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2025 23:07:45.312720060 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:45.312730074 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:45.312882900 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:45.313787937 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:45.313807011 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:45.995677948 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:45.996273994 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:45.996285915 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:45.997325897 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:45.997380972 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:45.999494076 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:45.999555111 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:45.999630928 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:45.999639034 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:46.048648119 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:46.111581087 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:46.111773968 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:46.111819983 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:46.116209030 CET	49740	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:46.116235971 CET	443	49740	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:46.416193008 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:46.416246891 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:46.416309118 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:46.416764975 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:46.416781902 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:46.901478052 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:46.966180086 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:47.156269073 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:47.156347036 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:47.157903910 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:47.173643112 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:47.174024105 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:47.174031019 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:47.215339899 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:47.271224976 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:47.283965111 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:47.284610987 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:47.285459995 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:47.296863079 CET	49746	443	192.168.2.4	44.216.228.147
Feb 19, 2025 23:07:47.296892881 CET	443	49746	44.216.228.147	192.168.2.4
Feb 19, 2025 23:07:47.323379040 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:47.323399067 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:47.323460102 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:47.323659897 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:47.323672056 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:47.329040051 CET	49672	443	192.168.2.4	173.222.162.32
Feb 19, 2025 23:07:47.329071045 CET	443	49672	173.222.162.32	192.168.2.4
Feb 19, 2025 23:07:48.001275063 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:48.003612041 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:48.003638029 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:48.004673958 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:48.004719019 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:48.006635904 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:48.006844997 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:48.007531881 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:48.007539034 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:48.059180975 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:48.121121883 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:48.121273994 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:48.121329069 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:48.125878096 CET	49748	443	192.168.2.4	100.27.146.46
Feb 19, 2025 23:07:48.125894070 CET	443	49748	100.27.146.46	192.168.2.4
Feb 19, 2025 23:07:49.813774109 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:07:49.813796043 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:07:49.813936949 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:07:49.814218044 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:07:49.814229965 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:07:50.446646929 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:07:50.446957111 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:07:50.447006941 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:07:50.447884083 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:07:50.447945118 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:07:50.452768087 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:07:50.452835083 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:07:50.505506039 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:07:50.505533934 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:07:50.552381992 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:07:51.850905895 CET	49757	80	192.168.2.4	2.23.197.184
Feb 19, 2025 23:07:51.856164932 CET	80	49757	2.23.197.184	192.168.2.4
Feb 19, 2025 23:07:51.856226921 CET	49757	80	192.168.2.4	2.23.197.184
Feb 19, 2025 23:07:51.856364012 CET	49757	80	192.168.2.4	2.23.197.184
Feb 19, 2025 23:07:51.861394882 CET	80	49757	2.23.197.184	192.168.2.4
Feb 19, 2025 23:07:52.503046036 CET	80	49757	2.23.197.184	192.168.2.4
Feb 19, 2025 23:07:52.503061056 CET	80	49757	2.23.197.184	192.168.2.4
Feb 19, 2025 23:07:52.503112078 CET	49757	80	192.168.2.4	2.23.197.184
Feb 19, 2025 23:08:00.382841110 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:08:00.382903099 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:08:00.383030891 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:08:01.805098057 CET	49753	443	192.168.2.4	142.250.185.100
Feb 19, 2025 23:08:01.805176020 CET	443	49753	142.250.185.100	192.168.2.4
Feb 19, 2025 23:08:02.831897974 CET	49757	80	192.168.2.4	2.23.197.184
Feb 19, 2025 23:08:04.388541937 CET	52556	53	192.168.2.4	162.159.36.2
Feb 19, 2025 23:08:04.393613100 CET	53	52556	162.159.36.2	192.168.2.4
Feb 19, 2025 23:08:04.393682003 CET	52556	53	192.168.2.4	162.159.36.2
Feb 19, 2025 23:08:04.398703098 CET	53	52556	162.159.36.2	192.168.2.4
Feb 19, 2025 23:08:04.875303984 CET	52556	53	192.168.2.4	162.159.36.2
Feb 19, 2025 23:08:04.880748987 CET	53	52556	162.159.36.2	192.168.2.4
Feb 19, 2025 23:08:04.880812883 CET	52556	53	192.168.2.4	162.159.36.2
Feb 19, 2025 23:08:49.827038050 CET	52709	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:08:49.827060938 CET	443	52709	142.250.186.36	192.168.2.4
Feb 19, 2025 23:08:49.827327967 CET	52709	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:08:49.827488899 CET	52709	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:08:49.827502012 CET	443	52709	142.250.186.36	192.168.2.4
Feb 19, 2025 23:08:50.471271038 CET	443	52709	142.250.186.36	192.168.2.4
Feb 19, 2025 23:08:50.471620083 CET	52709	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:08:50.471632957 CET	443	52709	142.250.186.36	192.168.2.4
Feb 19, 2025 23:08:50.472309113 CET	443	52709	142.250.186.36	192.168.2.4
Feb 19, 2025 23:08:50.472733974 CET	52709	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:08:50.472825050 CET	443	52709	142.250.186.36	192.168.2.4
Feb 19, 2025 23:08:50.521028996 CET	52709	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:09:00.414359093 CET	443	52709	142.250.186.36	192.168.2.4
Feb 19, 2025 23:09:00.414417028 CET	443	52709	142.250.186.36	192.168.2.4
Feb 19, 2025 23:09:00.414460897 CET	52709	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:09:01.804234028 CET	52709	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:09:01.804270983 CET	443	52709	142.250.186.36	192.168.2.4
Feb 19, 2025 23:09:49.884581089 CET	52829	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:09:49.884696007 CET	443	52829	142.250.186.36	192.168.2.4
Feb 19, 2025 23:09:49.884860992 CET	52829	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:09:49.885628939 CET	52829	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:09:49.885667086 CET	443	52829	142.250.186.36	192.168.2.4
Feb 19, 2025 23:09:50.519121885 CET	443	52829	142.250.186.36	192.168.2.4
Feb 19, 2025 23:09:50.519517899 CET	52829	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:09:50.519584894 CET	443	52829	142.250.186.36	192.168.2.4
Feb 19, 2025 23:09:50.519886017 CET	443	52829	142.250.186.36	192.168.2.4
Feb 19, 2025 23:09:50.520169973 CET	52829	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:09:50.520235062 CET	443	52829	142.250.186.36	192.168.2.4
Feb 19, 2025 23:09:50.568171978 CET	52829	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:10:00.430219889 CET	443	52829	142.250.186.36	192.168.2.4
Feb 19, 2025 23:10:00.430383921 CET	443	52829	142.250.186.36	192.168.2.4
Feb 19, 2025 23:10:00.430565119 CET	52829	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:10:01.805250883 CET	52829	443	192.168.2.4	142.250.186.36
Feb 19, 2025 23:10:01.805321932 CET	443	52829	142.250.186.36	192.168.2.4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Review-Report-Scannable.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\983939bc-0844-4787-85d3-99ce7088a319.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250219220744Z-180.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7652

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7652

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Windows Analysis Report
Review-Report-Scannable.pdf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2025 23:07:45.252387047 CET	53	50323	1.1.1.1	192.168.2.4
Feb 19, 2025 23:07:45.301294088 CET	53785	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:07:45.301469088 CET	58982	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:07:45.309348106 CET	53	53785	1.1.1.1	192.168.2.4
Feb 19, 2025 23:07:45.312330008 CET	53	58982	1.1.1.1	192.168.2.4
Feb 19, 2025 23:07:45.325282097 CET	53	56422	1.1.1.1	192.168.2.4
Feb 19, 2025 23:07:46.441421032 CET	53	49179	1.1.1.1	192.168.2.4
Feb 19, 2025 23:07:47.302737951 CET	61347	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:07:47.303055048 CET	53983	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:07:47.322026968 CET	53	53983	1.1.1.1	192.168.2.4
Feb 19, 2025 23:07:47.322416067 CET	53	61347	1.1.1.1	192.168.2.4
Feb 19, 2025 23:07:49.759150982 CET	54867	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:07:49.759329081 CET	53542	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:07:49.812902927 CET	53	53542	1.1.1.1	192.168.2.4
Feb 19, 2025 23:07:49.812920094 CET	53	54867	1.1.1.1	192.168.2.4
Feb 19, 2025 23:07:50.325123072 CET	138	138	192.168.2.4	192.168.2.255
Feb 19, 2025 23:07:51.839428902 CET	59285	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:07:51.847110987 CET	53	59285	1.1.1.1	192.168.2.4
Feb 19, 2025 23:08:03.530103922 CET	53	63795	1.1.1.1	192.168.2.4
Feb 19, 2025 23:08:04.387967110 CET	53	50206	162.159.36.2	192.168.2.4
Feb 19, 2025 23:08:04.913352966 CET	62012	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:08:04.922967911 CET	53	62012	1.1.1.1	192.168.2.4
Feb 19, 2025 23:08:49.818835974 CET	57286	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:08:49.825931072 CET	53	57286	1.1.1.1	192.168.2.4
Feb 19, 2025 23:09:06.287350893 CET	58653	53	192.168.2.4	1.1.1.1
Feb 19, 2025 23:09:06.294646025 CET	53	58653	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Feb 19, 2025 23:07:51.856364012 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Feb 19, 2025 23:07:52.503046036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=26738 Expires: Thu, 20 Feb 2025 05:33:30 GMT Date: Wed, 19 Feb 2025 22:07:52 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUX
Feb 19, 2025 23:07:52.503061056 CET	509	IN	Data Raw: a9 bc b2 a8 50 d0 0c b1 d8 1a 69 20 27 29 08 ac 61 75 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 Data Ascii: Pi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj

Timestamp	Bytes transferred	Direction	Data
2025-02-19 22:07:45 UTC	661	OUT	GET /xr2yxXN4DCYD HTTP/1.1 Host: zpr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 22:07:46 UTC	127	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 22:07:46 GMT Content-Type: application/json Content-Length: 31 Connection: close
2025-02-19 22:07:46 UTC	31	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 6e 6f 20 6c 69 6e 6b 20 66 6f 75 6e 64 21 20 3a 2d 28 22 7d 0a Data Ascii: {"error":"no link found! :-("}

Timestamp	Bytes transferred	Direction	Data
2025-02-19 22:07:47 UTC	580	OUT	GET /favicon.ico HTTP/1.1 Host: zpr.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://zpr.io/xr2yxXN4DCYD Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 22:07:47 UTC	127	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 22:07:47 GMT Content-Type: application/json Content-Length: 31 Connection: close
2025-02-19 22:07:47 UTC	31	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 6e 6f 20 6c 69 6e 6b 20 66 6f 75 6e 64 21 20 3a 2d 28 22 7d 0a Data Ascii: {"error":"no link found! :-("}

Timestamp	Bytes transferred	Direction	Data
2025-02-19 22:07:48 UTC	341	OUT	GET /favicon.ico HTTP/1.1 Host: zpr.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-19 22:07:48 UTC	127	IN	HTTP/1.1 200 OK Date: Wed, 19 Feb 2025 22:07:48 GMT Content-Type: application/json Content-Length: 31 Connection: close
2025-02-19 22:07:48 UTC	31	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 6e 6f 20 6c 69 6e 6b 20 66 6f 75 6e 64 21 20 3a 2d 28 22 7d 0a Data Ascii: {"error":"no link found! :-("}

Target ID:	0
Start time:	17:07:38
Start date:	19/02/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Review-Report-Scannable.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	17:07:39
Start date:	19/02/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1512,i,9956858854306803330,8917847987877056085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	17:07:41
Start date:	19/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://zpr.io/xr2yxXN4DCYD
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	17:07:44
Start date:	19/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1988,i,6750101603013777856,15764434734045457411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre