Windows Analysis Report
Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf

General Information

Sample name:	Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf
Analysis ID:	1711283
Has dependencies:	false
MD5:	19948161a10913f4de48ceaeebb3155e
SHA1:	17a5affb9a83eed4f119bee171db0d78976ae4a4
SHA256:	0076be57d1efb411b083484b92bed90f05767cb3cf43c028019590699b8b8818
Infos:

Detection

Score:	3
Range:	0 - 100
Confidence:	80%

Signatures

IP address seen in connection with other malware

PDF is encrypted

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.39.37.95:80
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.39.37.95:80
Source: global traffic	TCP traffic: 23.39.37.95:80 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.39.37.95:80
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.39.37.95:80
Source: global traffic	TCP traffic: 23.39.37.95:80 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 23.39.37.95:80 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 23.39.37.95:80 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.39.37.95:80
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.39.37.95:80
Source: global traffic	TCP traffic: 23.39.37.95:80 -> 192.168.2.16:49712
Source: global traffic	TCP traffic: 192.168.2.16:49712 -> 23.39.37.95:80
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.16:49713
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 23.200.196.138:443

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 23.39.37.95 23.39.37.95
Source: Joe Sandbox View	IP Address: 23.200.196.138 23.200.196.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1host: armmf.adobe.comaccept-language: en-US,en;q=0.9user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: emptyaccept-encoding: identity

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1host: armmf.adobe.comaccept-language: en-US,en;q=0.9user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: emptyaccept-encoding: identity
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.3.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 132eb6fd-2510-4633-be5f-24a3fbfa0a02.tmp.6.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: classification engine

Classification label: clean3.winPDF@16/50@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6200

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-06-10 12-58-40-789.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1552,i,5071983132029350567,6716144300352404056,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1552,i,5071983132029350567,6716144300352404056,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf	Initial sample: PDF keyword /JS count = 0
Source: Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf

Initial sample: PDF keyword /Encrypt count = 1

Source: Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

PDF is encrypted

Source: Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf

Initial sample: PDF keyword /Encrypt

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.39.37.95	e8652.dscx.akamaiedge.net	United States		16625	AKAMAI-ASUS	false
23.200.196.138	unknown	United States		2860	NOS_COMUNICACOESPT	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
e8652.dscx.akamaiedge.net	23.39.37.95	true
x1.i.lencr.org	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	false		high

ID:	1711283
Product:	CloudBasic
Start time:	18:57:53
Start date:	10.06.2025
Sample:	Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	19948161a10913f4de48ceaeebb3155e
SHA1:	17a5affb9a83eed4f119bee171db0d78976ae4a4
SHA256:	0076be57d1efb411b083484b92bed90f05767cb3cf43c028019590699b8b8818
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	99C0E07A1B93693D03F7757F2A8C4C84	535446BD49AD2DCABBF8587639C4C36F5699AFC1	0776EC42AD97183057B9EE489D3DAEE75E88E1DCF0FC8AE7B5A93DAC47CF64DB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	99C0E07A1B93693D03F7757F2A8C4C84	535446BD49AD2DCABBF8587639C4C36F5699AFC1	0776EC42AD97183057B9EE489D3DAEE75E88E1DCF0FC8AE7B5A93DAC47CF64DB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	080D839E2CE601ADB058B577CD72D2C6	E2FE5C61ECCB13F32CA40A1948DF09AEB021F9AA	58B84189B8539517D3C0E10359EF70EF20619C78423C331B2E407B7C5CBF458D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	080D839E2CE601ADB058B577CD72D2C6	E2FE5C61ECCB13F32CA40A1948DF09AEB021F9AA	58B84189B8539517D3C0E10359EF70EF20619C78423C331B2E407B7C5CBF458D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\132eb6fd-2510-4633-be5f-24a3fbfa0a02.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\86bb22d6-d358-4c24-b08f-33451a007e23.tmp	JSON data	5AC48705E2952FCB6BC677E4D4A2388B	91ADBD7FB36C6F1BFFE3DA0A36918EC5AA806F9D	F7003EBD57E57CD7AE811EA9A78407F81B5B2A344E55571839D9C5BBAC37BC19
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF41427b.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\TransportSecurity (copy)	JSON data	5AC48705E2952FCB6BC677E4D4A2388B	91ADBD7FB36C6F1BFFE3DA0A36918EC5AA806F9D	F7003EBD57E57CD7AE811EA9A78407F81B5B2A344E55571839D9C5BBAC37BC19
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c1cb22c2-4b55-4daa-bf01-c2511625e039.tmp	JSON data	6A7A55E73CAB33F7DEEA012240C3DF66	667A4CFCCEAF0DA4368E1D6EE11EE0F7F7E8EDA7	D655940E705B4FC7D9D1A6D8528CC12F9C5B7B49554FDD82C645337D61A483CB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	63D4E612E54F3EDE1D824A191615015A	53CD225CDA578F343555C676034F622C08F6578B	DEF429A629770979836EE676C9448840674F7788955E75FD8E23AE61B5C6774D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	914C33F698C1B1235F0E5CBE4459BD4E	01FC3A2D57724826098E487E45F8810FE9B90909	143F661AEC4FCDFD397ED3752FE99813A5949BDF5FF186539F66EDCE3847EDD8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	914C33F698C1B1235F0E5CBE4459BD4E	01FC3A2D57724826098E487E45F8810FE9B90909	143F661AEC4FCDFD397ED3752FE99813A5949BDF5FF186539F66EDCE3847EDD8
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	79E160DD9A91AE7C7B0CF3B1E878498C	BF71D1A6917F421C26BB4EE382C6EB06E0327033	A9D4E0A222F402FB0B33C8D95CF0A0972DD7517976F16D9C04FCE945AE9C5CB6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 73758 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	396207FAA085427DC55FB0609B191624	2D5484ED85456580780CEF77DFB576C2A9C36E5B	A2C770D32A0D972F7501A97CB4E5E5AD7904A5155DC28D3A78C2462D32E0CF71
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	413AC998850163E7FD05D75DC9AE9642	78FB0D75AB4B1C4D058D2DC3FA0B2B94FE37D129	E86C4AD62FB6D0CAF02553646F44BB6511653F5C6BDD4933B15DF97406D29A50
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	2E5C3950723DDCB00E0E3A0FDDCBC5EA	E6C6373B7B655DBEEA45D0388BE06BEEBC2FE8C4	BA91986B3B7E25A18FABBCF57EEB00A9DC57A923569FC5D2A8E4A33356538EA8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6200	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	78BF17C31F63191675C07FEE6B05DE87	E45661E07D618F3F8D5564BE3DF5DC75221FBB88	90A96B7685522FFDA5BC2A157565E25E99B260F908E37D7B8242A4BFF7DEAAE4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	D842F08083D031CAD8479A2CDE2FACC6	4FB13504623469FC081D5DE7194A7B70C1A95AC4	34B71BD958893203E1547B3569A952DAAA9FC9B1D059D5E6E55DF7E3EDB5E014
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	50B37CA81352E0934270F94B2FB53B33	322551A497844CCF5820A6620FB73EB4224C7E22	476C48C109D2AD7B198AC5E5C5B8E181BEE8BE8CCCF25EBF8ED768AE4B5F288E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	6BFCC6AC6EC62F36CC4DF644F8B0D748	6C0F24657B78DEBFEF80B160B96A7F456C1D4505	E2D1E791C292D5F601D6C3C62F734AD632F0D3B47D78CB16A2FC1BF096020D11
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	E29BD361395F0446E25784F045FB99B7	16E1B1DAD8EC9E9EA2ACC625F8EFC9FCC3892F9D	348A187A5E746FEA3C94EBF8B312A49A204A5814640BE545BABD6705F683454C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	1C0A07C5133721BA6FA71ACDCDB3BF58	155024DD2AC1A6BF14D33BD3D6808740FED90DD2	D4466575D03B7658DEA4B0AE55A7FF5C5D3907305045B3FFDC5716C7DB97CA80
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	D940CE77887FE1C9B6116FBB16DB59F8	893368D2AC6C73BDB50F6C3C8E315EFCC617514F	723CA81FC9E86F0A717C18EDE3721F5BE5E02936A423FAE49E7F0289B6CC4EC5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	51C0300621B954100EFE09CF822BB976	294C48C38AA6F30571E17E2A4F0180976DA796A7	616E147E573373627EE42438404EC5024CFC208FC525721FC051FA0FB809ED94
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	8CF1FF8E8E5020274D5BCB8D50A91507	5011845E904C31C044028A8BA88672656F91BC8C	88AE7457278E9B3AFE5408E864D05842611140EFA46F5DE757B3ED229D0B17D2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	8ABB41D3636B9F69B0179E746185251A	C9653ACC1D407E573162A949FC13B4FB187E5BE9	29C26CEB54AF0976FD66EB9F1AB9C72481898CDDFDC19541539D2E222B6B62EB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	860176A7318995A065F31FF583CA3EEB	BCC83E20305FFCA4584AA54509FFAD73D5D251EE	AEA9774421C257AE92D388C373E55A93B109E93840BF576DF506BC26357CBFBF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	BD2EF184C2C75303B63093204FC181A0	861F816290F9AC3B7D9ED0A03C405945F9369287	1A2F9C32CD4A247A980BF90E4DEA4902754B577418E79193853FB54DBBC94E7F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	0D9350155E102B150DF98E914BF9C7EE	CB0DE3AED3A12C0E1AC118C8DBB25C2F26C49C99	3B62EEF885CCA98260FE490264E308FE6A51E7B9627E77D85B24825CFFCEAEAF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	3CE15FB7199376842A9C96D5F9FDFDAC	8B25489F43F31E1F065F63FCD4A992602DFC98DB	79B6FF3A8706DD28F2F0CC608A604238872D5E2CB5C50F9A90F50EBD5100E631
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	A9AF020591EA9F764AA58CCA92B6BFB6	8908538FE1E9E3DBB49E59AC350D26F1D56ED736	1B0CBC758F05C38B5B655F261A7B5E5523385AB48D3271ED246369095A613EFA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	E49795379C6F87539283739C58EB6D34	151D234EAE0B826829F3EE687A5CB95386379C00	8772C26A092876EEFD481867DBBF1ED8D8C4C11621B6D06DA66977EEF5D2CD12
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	63A441EFE60939335818951DE69A790A	0DD101F882A4780BB65F7AB111C05FE63A8C7549	3A1438A44C6DB50A500A2A132F7E649D7442AB0C77F31234C7F21CDEDEFE7649
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	9697666D836D8803C9DE69E6A65B38B3	5164ECBFCA5ACA2A02E094AF8AFC86443E397C35	7B4E0A0E989C6BB314E80BCBBAADE16A9DD2166805D9B078D54810759E2FD2DF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	FFC01702CE2C94403A1AC57000F77EEB	4B3AA129B1D4F61B7379C1F8D40700B2B6139A46	2B5FA3AB18299C51DD3BC490192B515E9F328041ADC1473904B59F2B2D0DFEBA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	27B84FC49FED189BB5BFFD2B80A8F37E	49337272205E55EF8D88A6734C9E6518594CD80E	C40F5917835583217DB3A0275057C686211029134FE9745E41ABE1ED9AABDDA4
C:\Users\user\AppData\Local\Temp\MSI2b8d.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9B341B5D12ABFE7B8B94F1476120CED3	C43FFE34BEF0ECBC7C247917C5FD0F2C51664043	53F6E9CBF1385A3329E634F7F47B47792F54D0298A713EE1065197713937FF83
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-06-10 12-58-40-789.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	3BFB614C18F1EA7840F0D00A26AB5DE6	93C522C416AB2B7126809D3469135DB53954B7F9	E2F4B67912A96E103CFAEFBECAD86EAC9D3DDFD05DB9288BB519B68B74F1FA0D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	DB4DC2802005D212B2BF64F106841815	91C7FA2C4F9E7CCF3F0D6009F1F62D1ED64059E8	1BE04F892A8F128ED2632FF802375A167664B7A1AAA8C216E1E60B5816A64E78
C:\Users\user\AppData\Local\Temp\acrocef_low\76463924-e2f8-4d2b-a3e0-ab6bea4001ea.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\945a61c7-9b6c-41b4-8d71-83efe3a423ea.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	22B260CB8C51C0D68C6550E4B061E25A	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
C:\Users\user\AppData\Local\Temp\acrocef_low\a6cc42ff-7107-4584-8d00-0f94610a7d84.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	ECFA20D7144E6C6EDB6129A2266A8080	FF0C474BFF1FA6E59B8346345CBF60210C562E38	6E890EA390AE240E67BE50068F415F83B90730601D7B9A57D981236F5EE3E853
C:\Users\user\AppData\Local\Temp\acrocef_low\d8b6b2e6-78bd-4ba9-9bb2-691a03162c5f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
Paradigm-corp_Remittance_Advice_Monday, June 9, 2025 at 07_36_45 PM.pdf