Edit tour

Windows Analysis Report
438XXX5089.pdf

Overview

General Information

Sample name:	438XXX5089.pdf
Analysis ID:	1640336
MD5:	1a0b41ff87ad80ebc84cee4018d77351
SHA1:	cb8fdf8990fcdcd300ebb5c5479fcfa456337285
SHA256:	62ce3a50cc269b6f4fc576045acba29dadf1b0b41d95e12811ded410f874d22c
Tags:	pdfuser-Sandro
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Drops PE files

Drops PE files to the windows directory (C:\Windows)

PE file contains more sections than normal

PE file contains sections with non-standard names

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7960 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\438XXX5089.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1564,i,11499258054788275092,4564941714989364334,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://1mt2p8rhtntfgyso2j4mxthtmb46mjuyqb/ MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 8852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,10233801712020348684,9566547754299151242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2040 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 9600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,10233801712020348684,9566547754299151242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5232 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains QR code

AI detected suspicious Javascript

Source: 0.3.d.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of an obfuscated URL. The script appears to be redirecting the user to a suspicious domain, which is a strong indicator of malicious intent. Additionally, the script is collecting user data, which could be used for phishing or other malicious purposes. Overall, this script poses a significant security risk and should be treated with caution.

Source: global traffic	TCP traffic: 192.168.2.5:61646 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:60970 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.96.42
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.24
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.163

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61649
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61660
Source: unknown	Network traffic detected: HTTP traffic on port 61649 -> 443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir8276_976689094	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1109651438	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1109651438\privacy-sandbox-attestations.dat	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1109651438\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1109651438\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1109651438\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1109651438\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir8276_1857353101	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_271465360	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_271465360\Google.Widevine.CDM.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_271465360\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_271465360\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_271465360\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_271465360\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir8276_1576225923	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1865505149	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1865505149\LICENSE.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1865505149\Filtering Rules	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1865505149\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1865505149\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1865505149\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1865505149\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir8276_1153188111	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_573404493	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_573404493\cr_en-us_500000_index.bin	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_573404493\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_573404493\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_573404493\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_573404493\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir8276_1911759391	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_845261931	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_845261931\keys.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_845261931\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_845261931\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_845261931\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_845261931\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_845261931\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir8276_594245295	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_646524078	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_646524078\history_search_strings_farmhashed.binarypb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_646524078\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_646524078\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_646524078\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_646524078\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir8276_924816505	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1555295984	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1555295984\ssl_error_assistant.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1555295984\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1555295984\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1555295984\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1555295984\manifest.fingerprint	Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\438XXX5089.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://1mt2p8rhtntfgyso2j4mxthtmb46mjuyqb/
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1564,i,11499258054788275092,4564941714989364334,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,10233801712020348684,9566547754299151242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2040 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,10233801712020348684,9566547754299151242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5232 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1564,i,11499258054788275092,4564941714989364334,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,10233801712020348684,9566547754299151242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2040 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,10233801712020348684,9566547754299151242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5232 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: 438XXX5089.pdf	Initial sample: PDF keyword /JS count = 0
Source: 438XXX5089.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9evoo6_rfu0ea_5eg.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9evoo6_rfu0ea_5eg.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Google.Widevine.CDM.dll.7.dr	Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.7.dr	Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.7.dr	Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.7.dr	Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.7.dr	Static PE information: section name: _RDATA

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	21 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Google.Widevine.CDM.dll.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://2k.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://33across.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://360yield.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://3lift.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://a-mo.net
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://acxiom.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://ad-score.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://ad-stir.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://ad.gt
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adentifi.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adform.net
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adingo.jp
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://admatrix.jp
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://admission.net
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://admixer.net
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adnami.io
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adnxs.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adroll.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adsafeprotected.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adscale.de
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adsmeasurement.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adsrvr.org
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adswizz.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adthrive.com
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://adtrafficquality.google
Source: privacy-sandbox-attestations.dat.7.dr	String found in binary or memory: https://advividnetwork.com

Source	Detection	Scanner	Label	Link
438XXX5089.pdf	0%	Virustotal		Browse
438XXX5089.pdf	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_271465360\Google.Widevine.CDM.dll	0%	ReversingLabs
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_271465360\Google.Widevine.CDM.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
google.com	142.251.36.78	true	false		high
www.google.com	142.250.186.132	true	false		high

Name	Source	Malicious	Reputation
https://mediavine.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://connatix.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://yelp.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://nodals.io	privacy-sandbox-attestations.dat.7.dr	false	high
https://getyourguide.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://mediaintelligence.de	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandcastle-dev-dsp.web.app	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandbox-demos-dsp-a.dev	privacy-sandbox-attestations.dat.7.dr	false	high
https://permutive.app	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandbox-demos-dsp.dev	privacy-sandbox-attestations.dat.7.dr	false	high
https://adthrive.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://ad.gt	privacy-sandbox-attestations.dat.7.dr	false	high
https://easylist.to/)	LICENSE.txt.7.dr	false	high
https://gumgum.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://trkkn.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://logly.co.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://media6degrees.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandcastle-dev-ssp.web.app	privacy-sandbox-attestations.dat.7.dr	false	high
https://inmobi.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://33across.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://dreammail.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://jkforum.net	privacy-sandbox-attestations.dat.7.dr	false	high
https://iobeya.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://a-mo.net	privacy-sandbox-attestations.dat.7.dr	false	high
https://ebis.ne.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandbox-demos-ssp-y.dev	privacy-sandbox-attestations.dat.7.dr	false	high
https://aphub.ai	privacy-sandbox-attestations.dat.7.dr	false	high
https://gama.globo	privacy-sandbox-attestations.dat.7.dr	false	high
https://audienceproject.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://adsrvr.org	privacy-sandbox-attestations.dat.7.dr	false	high
https://finn.no	privacy-sandbox-attestations.dat.7.dr	false	high
https://lucead.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://verve.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://r2b2.io	privacy-sandbox-attestations.dat.7.dr	false	high
https://bluems.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://edkt.io	privacy-sandbox-attestations.dat.7.dr	false	high
https://atomex.net	privacy-sandbox-attestations.dat.7.dr	false	high
https://crcldu.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://rubiconproject.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://sitescout.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://apex-football.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://dotomi.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://ctnsnet.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://toponad.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://shinobi.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://superfine.org	privacy-sandbox-attestations.dat.7.dr	false	high
https://360yield.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://usemax.de	privacy-sandbox-attestations.dat.7.dr	false	high
https://display.io	privacy-sandbox-attestations.dat.7.dr	false	high
https://adform.net	privacy-sandbox-attestations.dat.7.dr	false	high
https://eloan.co.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://postrelease.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://aqfer.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://docomo.ne.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://shared-storage-demo-publisher-a.web.app	privacy-sandbox-attestations.dat.7.dr	false	high
https://weborama-tech.ru	privacy-sandbox-attestations.dat.7.dr	false	high
https://innovid.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://demand.supply	privacy-sandbox-attestations.dat.7.dr	false	high
https://nexxen.tech	privacy-sandbox-attestations.dat.7.dr	false	high
https://2k.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://advividnetwork.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://undertone.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://creative-serving.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://unrulymedia.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://tailtarget.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://paa-reporting-advertising.amazon	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandbox-demos-ssp-b.dev	privacy-sandbox-attestations.dat.7.dr	false	high
https://bypass.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://dotdashmeredith.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://atirun.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://adingo.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://impact-ad.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://admatrix.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://openx.net	privacy-sandbox-attestations.dat.7.dr	false	high
https://taboola.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://ayads.io	privacy-sandbox-attestations.dat.7.dr	false	high
https://i-mobile.co.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://uinterbox.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://mail.ru	privacy-sandbox-attestations.dat.7.dr	false	high
https://simeola.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://gmossp-sp.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://primecaster.net	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandcastle-dev-ssp-a.web.app	privacy-sandbox-attestations.dat.7.dr	false	high
https://worldhistory.org	privacy-sandbox-attestations.dat.7.dr	false	high
https://adnxs.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://dabbs.net	privacy-sandbox-attestations.dat.7.dr	false	high
https://seedtag.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://casalemedia.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandcastle-dev-dsp-x.web.app	privacy-sandbox-attestations.dat.7.dr	false	high
https://authorizedvault.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandcastle-dev-ssp-y.web.app	privacy-sandbox-attestations.dat.7.dr	false	high
https://sportradarserving.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://semafor.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://lwadm.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://appconsent.io	privacy-sandbox-attestations.dat.7.dr	false	high
https://vg.no	privacy-sandbox-attestations.dat.7.dr	false	high
https://fout.jp	privacy-sandbox-attestations.dat.7.dr	false	high
https://elle.com	privacy-sandbox-attestations.dat.7.dr	false	high
https://privacy-sandcastle-dev-dsp-a1.web.app	privacy-sandbox-attestations.dat.7.dr	false	high
https://flashtalking.com	privacy-sandbox-attestations.dat.7.dr	false	high

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1640336
Start date and time:	2025-03-17 07:51:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	438XXX5089.pdf
Detection:	MAL
Classification:	mal48.winPDF@48/54@6/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
google.com	SecuriteInfo.com.Win64.TrojanX-gen.9137.19817.dll	Get hash	malicious	Xmrig	Browse	216.58.212.132
	https://paulsss.com/1q2w.js	Get hash	malicious	Unknown	Browse	216.58.212.164
	41QUE01 - TAX INVOICE - 7274916 from SFG (Brisbane).html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.250.185.132
	https://apply.atu.ie/_entity/sharepointdocumentlocation/a10f35db-a302-f011-bae2-7c1e524f2423/903e00e6-7542-ee11-bdf3-6045bd8c56d2?file=CONFIDENTIALDoc_Au89994.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.250.185.100
	#U6d59#U6c5f#U6eab#U5dde#U75c5#U6bd2.exe	Get hash	malicious	Unknown	Browse	172.217.18.3
	Flash Player Download Manager.exe	Get hash	malicious	Babadeda, Chaos, Sality	Browse	142.250.185.132
	Fork.exe	Get hash	malicious	Babadeda	Browse	142.250.186.163
	http://paulsss.com	Get hash	malicious	Unknown	Browse	142.250.184.196
	http://paulsss.com	Get hash	malicious	Unknown	Browse	142.250.185.196
	ORIGINAL INVOICE COAU7230734290 pdf.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.185.225

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_271465360\Google.Widevine.CDM.dll	Discord Nitro Gift Generator.exe	Get hash	malicious	Unknown	Browse
	https://digimobil-recrgar.com	Get hash	malicious	Unknown	Browse
	.html	Get hash	malicious	Gabagool	Browse
	https://centrepatronal.blob.core.windows.net/heberhard/centrepatronal.html	Get hash	malicious	HTMLPhisher	Browse
	cndx.com.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	Fd-Employee-Handbook(1).pdf	Get hash	malicious	Unknown	Browse
	ATT001_2674865722.htm	Get hash	malicious	Unknown	Browse
	https://drive.usercontent.google.com/u/0/uc?id=1oVYWzJi9Tw6x0zGRa8di76JxbjhDHWgd&export=download	Get hash	malicious	Unknown	Browse
	call_playback_Senecacollege.html	Get hash	malicious	HTMLPhisher	Browse
	HwusQ091ed.html	Get hash	malicious	Unknown	Browse

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2195095892521115
Encrypted:	false
SSDEEP:	6:iOG7VgkAQL+q2P92nKuAl9OmbnIFUto7VgY5wGKWZmwC7VgY5wQLVkwO92nKuAlz:7GRh9+v4HAahFUtoRB5zKW/CRB5NV5LC
MD5:	FC4425C2DF7FCEDF65944193C445F413
SHA1:	1165491D444548656568F8E029DFA2CAB7445306
SHA-256:	220FC260627C2F1FF38D4B55D5FEF4E555CBDC858FD9DE00D85A20189EEFEF72
SHA-512:	4A024671C0EDE0634088BC6A3E87C03FC42BA554C0702EA3B45554B5DDA4FEC476614C55886741A9B3B6389DE579FE4017340E6F3B2778E944468DC06AAACE7B
Malicious:	false
Reputation:	low
Preview:	2025/03/17-02:51:58.367 5ec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/17-02:51:58.369 5ec Recovering log #3.2025/03/17-02:51:58.369 5ec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1792
Entropy (8bit):	6.019348476983808
Encrypted:	false
SSDEEP:	48:p/hP+drAdRW37aktiyC2xCe69xqYGCRk7NOzPI4Ek:RSQw37anyC+CDGGccA4f
MD5:	0F48EA696FDF31DABB72FD4A472E4A93
SHA1:	A24862DAB4B7146073F74165D733E8EDA45C5185
SHA-256:	57645239B1AECD3BFF0EDF2C489A55221855D4DD690541F57129449D34DC2CE6
SHA-512:	1A32EE516B00800EBE49A17D0DC05A0A21589016A28A6B0CA2934A951DF0E09CDF46B75A9DE7AF62435807DF1EEB10F128284E03AD84A324F7F71EE9AD191CBF
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoib1hRamtrQnY5dDFiX1Jzc0NBNjJhNzEwZEZZYVl2MktzOHpZTUFXWEUxMCJ9LHsicGF0aCI6InByaXZhY3ktc2FuZGJveC1hdHRlc3RhdGlvbnMuZGF0Iiwicm9vdF9oYXNoIjoiSnBiZFpKbk9wY0tXZE1zWVhZQVozTzNJR1BDZkg1NzZaS1FqbjZWUEtfZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5paWtoZGdhamxwaGZlaGVwYWJoaGJsYWtiZGdlZWZqIiwiaXRlbV92ZXJzaW9uIjoiMjAyNS4zLjEyLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"D1yGWCJ13w_a4aZS-GmRy1UaSnKuPyDaexx705PHm_LYjgxXA8UjTQ9bScleEJZkORAwk9gKs65NUkOIZOPGdPUDhQg3gDWqrESXFzPZk4RzaEwwlPh-33zUE0qWXcz4FwKu1WGN_Ok4HrKRgdihn7ea4OvP8VqvfNRP56CMpOuQxMLdGtj33weeTm9wBG2D-g2De2hqPBC6G0Jr9FnJ_wLkuNsuMmotIuVgQMViTCStpvxyrUiSyBwWdJH9By924Uu66zgVGLnpcv5tMoSwVylMy3ouQ3_lj2ul-hu5YJa7RzW2gOxCwb7ZtnFkfFx

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.812834931858194
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	438XXX5089.pdf
File size:	36'210 bytes
MD5:	1a0b41ff87ad80ebc84cee4018d77351
SHA1:	cb8fdf8990fcdcd300ebb5c5479fcfa456337285
SHA256:	62ce3a50cc269b6f4fc576045acba29dadf1b0b41d95e12811ded410f874d22c
SHA512:	6623513303f8e1ea335d9c2887773d3de4c78fc7650300d0c7af9ca91e3e94f24390b898496fb53f354fbfc9abfc48dcbe0c0d2a7853225a2ddeaf5476ff3f0b
SSDEEP:	768:o60UZj5k+/JYI+1rDAQ5lkMZmicA8AdnkckJUjvRw7FSmlfC7JQ:o60UZju+/JYI+1rE76wTAd0avRSFS4qW
TLSH:	E4F2CF32ADD4AC1EFCFF5791B9A0B28E1418B30D0AD6799234B84D15FEC5A80F7451E9
File Content Preview:	%PDF-1.4.1 0 obj.<<./Title (..)./Creator (..)./Producer (...Q.t. .5...5...1)./CreationDate (D:20240808021558).>>.endobj.2 0 obj.<<./Type /Catalog./Pages 3 0 R.>>.endobj.4 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>

General
Header:	%PDF-1.4
Total Entropy:	7.812835
Total Bytes:	36210
Stream Entropy:	7.864159
Stream Bytes:	33632
Entropy outside Streams:	5.073946
Bytes outside Streams:	2578
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	24
endobj	24
stream	6
endstream	4
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 438XXX5089.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fa4f93b4-001f-44f6-8c87-c9086dfe6ea5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250317065204Z-292.bmp

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Temp\MSI2901b.LOG

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9evoo6_rfu0ea_5eg.tmp

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-17 02-51-59-147.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

C:\Users\user\AppData\Local\Temp\acrocef_low\7a6e994c-893b-4ee6-a01a-94f297667e10.tmp

C:\Users\user\AppData\Local\Temp\acrocef_low\a4a61ca4-af71-491f-a2d1-3cd5bf93551a.tmp

C:\Users\user\AppData\Local\Temp\acrocef_low\a652ea10-e96a-4a8f-9453-4ddc49262a7f.tmp

C:\Users\user\AppData\Local\Temp\acrocef_low\d6be8658-4965-4d94-af38-8ff299205bc1.tmp

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1109651438\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1109651438\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8276_1109651438\manifest.json

Windows Analysis Report
438XXX5089.pdf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 07:51:52.444660902 CET	49672	443	192.168.2.5	204.79.197.203
Mar 17, 2025 07:51:56.289597988 CET	49676	443	192.168.2.5	20.189.173.14
Mar 17, 2025 07:51:56.600882053 CET	49676	443	192.168.2.5	20.189.173.14
Mar 17, 2025 07:51:57.210238934 CET	49676	443	192.168.2.5	20.189.173.14
Mar 17, 2025 07:51:57.257097960 CET	49672	443	192.168.2.5	204.79.197.203
Mar 17, 2025 07:51:58.413363934 CET	49676	443	192.168.2.5	20.189.173.14
Mar 17, 2025 07:52:00.835246086 CET	49676	443	192.168.2.5	20.189.173.14
Mar 17, 2025 07:52:05.082417011 CET	49731	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:52:05.082457066 CET	443	49731	142.250.186.132	192.168.2.5
Mar 17, 2025 07:52:05.082525969 CET	49731	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:52:05.082844019 CET	49731	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:52:05.082859993 CET	443	49731	142.250.186.132	192.168.2.5
Mar 17, 2025 07:52:05.690457106 CET	49676	443	192.168.2.5	20.189.173.14
Mar 17, 2025 07:52:05.729070902 CET	443	49731	142.250.186.132	192.168.2.5
Mar 17, 2025 07:52:05.729192019 CET	49731	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:52:05.743928909 CET	49731	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:52:05.743951082 CET	443	49731	142.250.186.132	192.168.2.5
Mar 17, 2025 07:52:05.744334936 CET	443	49731	142.250.186.132	192.168.2.5
Mar 17, 2025 07:52:05.866986990 CET	49731	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:52:06.918478966 CET	49672	443	192.168.2.5	204.79.197.203
Mar 17, 2025 07:52:13.624224901 CET	60970	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:52:13.628969908 CET	53	60970	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:13.629101038 CET	60970	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:52:13.633771896 CET	53	60970	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:14.074812889 CET	60970	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:52:14.079760075 CET	53	60970	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:14.079863071 CET	60970	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:52:15.304141045 CET	49676	443	192.168.2.5	20.189.173.14
Mar 17, 2025 07:52:15.632055998 CET	443	49731	142.250.186.132	192.168.2.5
Mar 17, 2025 07:52:15.632128000 CET	443	49731	142.250.186.132	192.168.2.5
Mar 17, 2025 07:52:15.632316113 CET	49731	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:52:16.696564913 CET	49731	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:52:16.696598053 CET	443	49731	142.250.186.132	192.168.2.5
Mar 17, 2025 07:52:43.423669100 CET	49698	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:52:43.428610086 CET	80	49698	2.16.164.24	192.168.2.5
Mar 17, 2025 07:52:43.428666115 CET	49698	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:52:45.417809963 CET	49704	443	192.168.2.5	2.19.96.42
Mar 17, 2025 07:52:45.418078899 CET	49707	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:52:45.418226957 CET	49708	80	192.168.2.5	2.23.77.188
Mar 17, 2025 07:52:45.897320986 CET	49706	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:52:45.902235985 CET	80	49706	2.16.164.24	192.168.2.5
Mar 17, 2025 07:52:45.903059006 CET	49706	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:53:03.577064991 CET	61646	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:53:03.582407951 CET	53	61646	1.1.1.1	192.168.2.5
Mar 17, 2025 07:53:03.582578897 CET	61646	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:53:03.587508917 CET	53	61646	1.1.1.1	192.168.2.5
Mar 17, 2025 07:53:04.026743889 CET	61646	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:53:04.031615973 CET	53	61646	1.1.1.1	192.168.2.5
Mar 17, 2025 07:53:04.031780958 CET	61646	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:53:05.024322987 CET	61649	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:53:05.024372101 CET	443	61649	142.250.186.132	192.168.2.5
Mar 17, 2025 07:53:05.024576902 CET	61649	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:53:05.024576902 CET	61649	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:53:05.024607897 CET	443	61649	142.250.186.132	192.168.2.5
Mar 17, 2025 07:53:05.661247969 CET	443	61649	142.250.186.132	192.168.2.5
Mar 17, 2025 07:53:05.661499023 CET	61649	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:53:05.661524057 CET	443	61649	142.250.186.132	192.168.2.5
Mar 17, 2025 07:53:15.564610004 CET	443	61649	142.250.186.132	192.168.2.5
Mar 17, 2025 07:53:15.564659119 CET	443	61649	142.250.186.132	192.168.2.5
Mar 17, 2025 07:53:15.564702988 CET	61649	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:53:16.696254015 CET	61649	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:53:16.696280956 CET	443	61649	142.250.186.132	192.168.2.5
Mar 17, 2025 07:53:30.570297956 CET	49685	443	192.168.2.5	40.126.31.71
Mar 17, 2025 07:53:30.570383072 CET	49686	443	192.168.2.5	40.126.31.71
Mar 17, 2025 07:53:30.570431948 CET	49684	443	192.168.2.5	40.126.31.71
Mar 17, 2025 07:53:30.570485115 CET	49687	443	192.168.2.5	40.126.31.71
Mar 17, 2025 07:53:30.570529938 CET	49694	80	192.168.2.5	2.23.77.188
Mar 17, 2025 07:53:30.570585012 CET	49695	80	192.168.2.5	2.23.77.188
Mar 17, 2025 07:53:30.570625067 CET	49696	80	192.168.2.5	2.23.77.188
Mar 17, 2025 07:53:30.570666075 CET	49697	80	192.168.2.5	2.23.77.188
Mar 17, 2025 07:53:30.570708036 CET	49689	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:53:30.570751905 CET	49691	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:53:30.570796013 CET	49690	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:53:30.570839882 CET	49692	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:53:30.575225115 CET	443	49685	40.126.31.71	192.168.2.5
Mar 17, 2025 07:53:30.575306892 CET	49685	443	192.168.2.5	40.126.31.71
Mar 17, 2025 07:53:30.576293945 CET	443	49686	40.126.31.71	192.168.2.5
Mar 17, 2025 07:53:30.576308966 CET	443	49684	40.126.31.71	192.168.2.5
Mar 17, 2025 07:53:30.576318979 CET	443	49687	40.126.31.71	192.168.2.5
Mar 17, 2025 07:53:30.576328993 CET	80	49694	2.23.77.188	192.168.2.5
Mar 17, 2025 07:53:30.576339960 CET	80	49695	2.23.77.188	192.168.2.5
Mar 17, 2025 07:53:30.576347113 CET	49686	443	192.168.2.5	40.126.31.71
Mar 17, 2025 07:53:30.576376915 CET	80	49696	2.23.77.188	192.168.2.5
Mar 17, 2025 07:53:30.576385975 CET	80	49697	2.23.77.188	192.168.2.5
Mar 17, 2025 07:53:30.576392889 CET	49684	443	192.168.2.5	40.126.31.71
Mar 17, 2025 07:53:30.576395035 CET	80	49689	2.16.164.24	192.168.2.5
Mar 17, 2025 07:53:30.576406002 CET	49687	443	192.168.2.5	40.126.31.71
Mar 17, 2025 07:53:30.576407909 CET	80	49691	2.16.164.24	192.168.2.5
Mar 17, 2025 07:53:30.576426983 CET	49694	80	192.168.2.5	2.23.77.188
Mar 17, 2025 07:53:30.576452971 CET	49695	80	192.168.2.5	2.23.77.188
Mar 17, 2025 07:53:30.576479912 CET	49696	80	192.168.2.5	2.23.77.188
Mar 17, 2025 07:53:30.576504946 CET	49697	80	192.168.2.5	2.23.77.188
Mar 17, 2025 07:53:30.576514006 CET	49689	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:53:30.577611923 CET	49691	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:53:30.579744101 CET	80	49690	2.16.164.24	192.168.2.5
Mar 17, 2025 07:53:30.579794884 CET	49690	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:53:30.580075979 CET	80	49692	2.16.164.24	192.168.2.5
Mar 17, 2025 07:53:30.580118895 CET	49692	80	192.168.2.5	2.16.164.24
Mar 17, 2025 07:53:32.070096970 CET	49700	80	192.168.2.5	142.250.185.163
Mar 17, 2025 07:53:32.075709105 CET	80	49700	142.250.185.163	192.168.2.5
Mar 17, 2025 07:53:32.075783014 CET	49700	80	192.168.2.5	142.250.185.163
Mar 17, 2025 07:54:05.086572886 CET	61660	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:54:05.086611032 CET	443	61660	142.250.186.132	192.168.2.5
Mar 17, 2025 07:54:05.086679935 CET	61660	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:54:05.086895943 CET	61660	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:54:05.086914062 CET	443	61660	142.250.186.132	192.168.2.5
Mar 17, 2025 07:54:05.716449976 CET	443	61660	142.250.186.132	192.168.2.5
Mar 17, 2025 07:54:05.716736078 CET	61660	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:54:05.716753960 CET	443	61660	142.250.186.132	192.168.2.5
Mar 17, 2025 07:54:15.627227068 CET	443	61660	142.250.186.132	192.168.2.5
Mar 17, 2025 07:54:15.627269983 CET	443	61660	142.250.186.132	192.168.2.5
Mar 17, 2025 07:54:15.627321959 CET	61660	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:54:16.320882082 CET	61660	443	192.168.2.5	142.250.186.132
Mar 17, 2025 07:54:16.320902109 CET	443	61660	142.250.186.132	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 07:52:00.894273043 CET	53	54409	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:01.380981922 CET	53	59073	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:02.664300919 CET	55732	53	192.168.2.5	8.8.8.8
Mar 17, 2025 07:52:02.671277046 CET	53	55732	8.8.8.8	192.168.2.5
Mar 17, 2025 07:52:02.673877954 CET	59581	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:52:02.680820942 CET	53	59581	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:02.903347015 CET	53	49474	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:05.028143883 CET	65451	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:52:05.028338909 CET	51238	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:52:05.034794092 CET	53	51238	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:05.034876108 CET	53	65451	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:13.623753071 CET	53	50602	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:19.985066891 CET	53	62654	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:39.014113903 CET	53	57746	1.1.1.1	192.168.2.5
Mar 17, 2025 07:52:59.560214043 CET	138	138	192.168.2.5	192.168.2.255
Mar 17, 2025 07:53:00.510991096 CET	53	51960	1.1.1.1	192.168.2.5
Mar 17, 2025 07:53:02.046571016 CET	53	51257	1.1.1.1	192.168.2.5
Mar 17, 2025 07:53:03.576709032 CET	53	50409	1.1.1.1	192.168.2.5
Mar 17, 2025 07:53:03.719477892 CET	53	53640	1.1.1.1	192.168.2.5
Mar 17, 2025 07:53:32.281811953 CET	53	57732	1.1.1.1	192.168.2.5
Mar 17, 2025 07:54:16.328583002 CET	53	64270	1.1.1.1	192.168.2.5
Mar 17, 2025 07:54:19.644568920 CET	53	63706	1.1.1.1	192.168.2.5
Mar 17, 2025 07:54:32.346791029 CET	49651	53	192.168.2.5	1.1.1.1
Mar 17, 2025 07:54:32.346895933 CET	64318	53	192.168.2.5	8.8.8.8
Mar 17, 2025 07:54:32.353530884 CET	53	49651	1.1.1.1	192.168.2.5
Mar 17, 2025 07:54:32.362396002 CET	53	64318	8.8.8.8	192.168.2.5

Target ID:	0
Start time:	02:51:54
Start date:	17/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\438XXX5089.pdf"
Imagebase:	0x7ff7dd870000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	02:51:56
Start date:	17/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff7dd400000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	02:51:57
Start date:	17/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://1mt2p8rhtntfgyso2j4mxthtmb46mjuyqb/
Imagebase:	0x7ff664720000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	02:51:58
Start date:	17/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,10233801712020348684,9566547754299151242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2040 /prefetch:3
Imagebase:	0x7ff664720000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	02:52:02
Start date:	17/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,10233801712020348684,9566547754299151242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5232 /prefetch:8
Imagebase:	0x7ff664720000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre