Analysis Report Janette De La Caridad Guillen ASJ2 Records (2).pdf

Overview

General Information

Sample Name:	Janette De La Caridad Guillen ASJ2 Records (2).pdf
Analysis ID:	336774
MD5:	097e5a2956e5c698f987b27e33f2df50
SHA1:	a58eccbca7aa1b9105b336b960a7cdd1c823f259
SHA256:	e9bef2b78bcfd6ac88b7f44f38db5c5bd94dc9261327d48c91ac3913a3ff3cf9
Most interesting Screenshot:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

High memory usage for Adobe Reader (potential heap spray)

IP address seen in connection with other malware

Classification

Signatures

Exploits:

High memory usage for Adobe Reader (potential heap spray)

Source: Adobe Reader

Process Stats: High memory usage

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 80.0.0.0 80.0.0.0

Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/)
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/K
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: http://sourceforge.net/projects/sevenzip/files/7-Zip/4.65/7z465.exe/download
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/r
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/y
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#1
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#L
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#E
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/5
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/drm/default
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/anchor
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/subclip/1.0
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: AcroRd32.exe, 00000001.00000002.890629296.000000000B1CB000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/
Source: AcroRd32.exe, 00000001.00000002.890704522.000000000B24E000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/
Source: AcroRd32.exe, 00000001.00000002.890704522.000000000B24E000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/0b
Source: AcroRd32.exe, 00000001.00000002.890704522.000000000B24E000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/:b
Source: AcroRd32.exe, 00000001.00000002.890704522.000000000B24E000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/Jb
Source: AcroRd32.exe, 00000001.00000002.890629296.000000000B1CB000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/s
Source: AcroRd32.exe, 00000001.00000002.890629296.000000000B1CB000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y
Source: AcroRd32.exe, 00000001.00000002.890629296.000000000B1CB000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/yd
Source: AcroRd32.exe, 00000001.00000002.905929730.0000000011848000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000002.907036613.0000000011BFF000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com
Source: AcroRd32.exe, 00000001.00000002.905929730.0000000011848000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.comileLeng
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/OfficeAlly/Images/tab-help-center.jpg
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/OfficeAlly/Images/tab-request.jpg
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/ResourceCenter/OfficeAllyFormsManuals.aspx
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/ResourceCenter/PayerLists/PayerList.aspx
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/Support/AboutUs.aspx
Source: AcroRd32.exe, 00000001.00000002.881349176.00000000094A0000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: AcroRd32.exe, 00000001.00000002.881349176.00000000094A0000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.comg
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://oarx.officeally.com/erx/Logout.aspx?app=emr
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/emr
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/emr/Appointments/VirtualVisits.aspx
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/emr/Logout.aspx?Goto=home
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/oa.asp?GOTO=hipaa
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/pm/default.aspx
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/secure_oa.asp?GOTO=ServiceMenu
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://secure.logmeinrescue.com/Customer/Code.aspx
Source: AcroRd32.exe, 00000001.00000003.650766793.000000000A8A3000.00000004.00000001.sdmp, Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://webapi.officeally.com/OA/
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://webapi03.officeally.com/xAD/
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://www.samplecenter.net/officeally-ehr/

Source: classification engine

Classification label: clean1.winPDF@13/48@0/2

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1vx9tj8_4h2j1s_5j0.tmp

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\Janette De La Caridad Guillen ASJ2 Records (2).pdf'
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Janette De La Caridad Guillen ASJ2 Records (2).pdf'
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=7285576016619014750 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7285576016619014750 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=13665176154593383583 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=5049533098483960058 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5049533098483960058 --renderer-client-id=4 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job /prefetch:1
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14602781306462947134 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14602781306462947134 --renderer-client-id=5 --mojo-platform-channel-handle=2068 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Janette De La Caridad Guillen ASJ2 Records (2).pdf'	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=7285576016619014750 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7285576016619014750 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=13665176154593383583 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=5049533098483960058 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5049533098483960058 --renderer-client-id=4 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14602781306462947134 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14602781306462947134 --renderer-client-id=5 --mojo-platform-channel-handle=2068 --allow-no-sandbox-job /prefetch:1	Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf

Static file information: File size 7249601 > 6291456

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: AcroRd32.exe, 00000001.00000002.905822569.00000000117AD000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Code function: 1_2_00BCF490 LdrInitializeThunk,

1_2_00BCF490

Source: AcroRd32.exe, 00000001.00000002.875903456.0000000005C00000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: AcroRd32.exe, 00000001.00000002.875903456.0000000005C00000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: AcroRd32.exe, 00000001.00000002.875903456.0000000005C00000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: AcroRd32.exe, 00000001.00000002.875903456.0000000005C00000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.0.0.0	unknown	United Kingdom		5089	NTLGB	false

Private

IP
192.168.2.1

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0	data	FDA999DAB9297709E409513FB4CB36F9	1CB4C3F244D3B322077B5CA45B78FBB1390CBD3C	1C10719BC98684B3795D84952D92F0A06FC47EA37413DD99BBB428A7CB9898AD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0	data	C9D024F871528ABC89334CAC43B2A31F	BFA7F9C3F4D9B0A6C3C5C6E226974F1498FEF843	C3B0F978C81D73C0D6C92738DF17EF2596D9302C69AA6BAAEC559F63D4A648BE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0	data	5409497B9EFF649CA00312E86DD8055A	B3F11E66E084BE6215D7251E1C115056119E9E6C	2DC00FBAAA836248559B32109CDA80E2516142AC18AE8F84786E4863A5B76615
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0	data	470DB1DFC70724B4E0770D80F5F38AD6	51A91444734C3F1DA21F84DBF20BB27754F009F7	7F9BE03D71D9BD40C07C70D1807874A14867515A7BEDC0D3953B0AE6101E38A2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0	data	A71486ED687ABF48E8115D23E14E4000	AACA03312D7AC956A8224BE22DAE3254211A1EC0	673E46112C96E4262543D9D2C95B89F3E74BBAE7CFFBC531524A6121CCE1F793
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0	data	8350E6C77FAA2E3DCBEB3FCA827B45EA	CEF764CA5C4A39C05D91AE46781A738627A84A46	843875F28D0FE504EFB0CD3EA3D33AC5DA143D9ABDFA78DB8F59E98722026ADF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0	data	2A003C34AE906645C73784471519CB39	CABF1B3A4669301F8B64B0480F666557088A704E	B546CF5199D89F81152A91A300C412B7DB1870FDD71C35352172FC3CBEB229D0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0	data	76E00D4183C0AF9F72BAA6260F4B5FB0	6814D8C71C6600E6CE25DFA37A7C06056042E5C6	1DB6C993457B03BC8133210CDEF9B1D986A8EAE00DC8D895D41848DB4FCBC0C5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0	data	5292CE6DD1F381E15E7928E5A145D84C	B2281C0AFCA35EE99CB9EA96B077FCA6B021B320	F098A1F33543B641E3B6D7056B9EF5BEEF6AC984CDF1159DB825150ACE71826B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0	data	44BAA70A35528F0FEB8EEC8435BCF122	CF629DCADE2CADDC684E9AF7895B81350F883470	5B0DA5EC25D8611535D7AE0716D8C0CA708B7BA81059752C4221D5A097C8F436
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0	data	CA9BFA9A2B19E9C1266EB56F8DDFE41B	D526366DBCDD46A96AFC47E095490508F54DF9FA	17A4F84DE4F5C9C7249D95D9C7154BF7860D8F3FC1864111C3E6DB6B02030B93
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0	data	02B3EDEB14BD9DFD5279539D087E0FE2	DA362C86DCA53008D8DFE85BDC5771018C4F1B27	3C9459089979625B0655886C987696B01CA1415B586E13913053D1DB3414A6DC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0	data	AB1894846869EC3AB32BD3604247A82E	95A524EBD919507339321C457C342B94CAECED53	3CE1038C1B849A51081EAEEBAC0B60188F12B2576F8DF498359F200C4C8EB529
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0	data	6AC0A28B62543D334E825D7E393AB0CD	6A967E49E822DF972AF0DE519ADBB97697EDAF80	74A2047562EFB5E60BB997744B7B45D46433DB3891536475DF8D07E0C3726466
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0	data	844960B7F962BF5C525488CBE4D4385D	A43E02634B944D6AEF0452D4EFD707B86F63981A	46DEF61F7E4DBAF82DD91D4EC223BF3FCF4A54FC377AACF84F441E1555C8DCB6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0	data	3F7E26D8F8FD65AAC7D9549E76EAF8DA	F7497717E23FCC6C5658FC4CB6C7CDF3E393CE0A	2CF73E72B9991BEA2DD8948FCE99A9181C9E41EB2A6108CFDAE21B7BDECA2976
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0	data	738C733B5F0DC06B140F4A539862F1D8	8CBC219D0281465D51DFC86AA09321617D4E6FAB	4E4F7A4A490A1DF4417BACF670922CE7674982940A2F0907D3FAB350B11DDFA0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0	data	C44DBDD17916BE64DB5A0E60EC773AE6	64A77CD116766F3CB127EF582D45664502F7111A	023FD073FD4A8D8853E9E98DCDE1FD3F32059D58C1EE408D651FF2A45DD90AF4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0	data	9106C37254ECE04FA68C01CEC6CE91B6	A7D0395FF292179B11705E4BC022A1E000C8282B	2F80A69A7B785648AF5074EACFD483E511E092DB39936DB6ECF19F0969493D10
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0	data	F448D60C518DA4FCACAC0D57B757AAB9	14B5C3D777B043887D66DC5A9AE82F7809E6FA12	B9C47C86435358C0967720E06E2C3334FB47318E87238A2DE7C75AAA7E4C0452
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0	data	4A02BE41D2CF0BDD649CE03880B80222	F189F764BDD1DC0AD5B757C0FE4E13540FCF554F	042265508798E0340AB43C7D7CA9E04E47638257E07CB5409690CC93B5132141
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0	data	01E5B8756ABB1F6FD9EF738BFFAEA53D	E08442A7DCDF5EE7BAC5BA66C644A4A5B4A6AB9C	2A4202BCAB4EF2CFDAB1A30E267BF6255BFBA0B335D8CB7E23B946DBA38340F7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0	data	40FF02896C1514DB2CC1D84C23D466C3	77EC7B6092F85B68FB923A0CDDB2D2B62A512B0A	BD34C016D87BED6D3EF18F9EAB9A7B5B531F4712A112669EE6797A851EA2103F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0	data	DF80BB86105F2968F1328FD8263C8E04	7C024EB5B99DEEB53A464028E47FA71AC1062DC9	BAA0A2AD03E94F3552A8A42F334BEC0F8672CF885971E26E25E0CBD839F7C21B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0	data	0315E384C9F9C8649043EC62E3A1D6AE	7E125BF88236AF7A977165874089C96E6C391AEA	22A71781ACCADF2A9192EEB5E04B118F810D06A0B3E45E039F4D1AE61070473A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0	data	EFEAF6077F1F55C01986978691FF5273	24F20D0A64551922F732979F1FD2AC8C384B0AD4	B0507E04623DDFD5CBCF13C5805D84F98192F84E5FBC3827C04FC14F22ABC918
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0	data	84F27F056B79145569D7C1637FF63A9D	07D08ADAFCC4B07CCC71B1FB643D54A1D8AE8A4F	95C32082ED8E0DBCC37C43EADE48837DE90B1D840FB897BBF9EBE03B98CF5815
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0	data	9EE9DD7A5124A1A53BF056D35D993831	27C8FC4949D4DD26D08CDA75104812CF28BDD10B	F4EBD440F1C56CE9954485104F43E4B0A1766A1144EB30049910F5C961FDCB48
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0	data	B3D3FF58E8D4CFFFC54D758232762740	35413569EABC397D10BFFD4A7B7E333E24109265	7D8ED716E4BF91EE0D71ED76468ED7A1C6316E9B62619301633D2D1F09CC7DDE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0	data	C756F945537CA4D8927E79BD7CA4629F	9C3986120258DFC581B0AC1BB873AC2E47504F85	B0B317BA9109B03729AACCF934213EB0B73B7962B9B59B1E3F7E0BC8D7A304F0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0	data	14A5BE566A8D3D0CE4A3057A0E921528	3BF5FDFFEB56E06D27E9377A5450E7CDAA9ABBCD	9BDF462B9FA80D3421295E560457C3C4ECEDD1F74B1A62FAFE753DCD677DD638
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0	data	E615313A2B84523927E0E8ABBD3D2185	446B896DEA03987D1DFC4698EB239EF0C8964039	442B8C4ABF9721CE0E33600536BA119FCA011E668A0DD69B97A348A2CEC7B6C7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0	data	D708CCF3E6B085A95010ECB168731B2E	164D1EB7962F5B949A2706E955A356018D8253D2	098B658D316C96084E0C7737F8DF2C209AADB81AFF7E9C337E657CC324F14C45
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0	data	2CDC413ED3FA75312CB2F94C8F7C5380	9EEC875C102C4FDCB9D9D304E17B8D275219CE5B	CFD20ACB03938D51E2C37680F006154802909E9D6E2478D5E24BC15877C3E5F6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0	data	56CAF7DABCA9EC1F928728F21FD65EA4	D3A3758CF27EE0B9D3843285C4A96216CA738F02	B4C38093342AD4D3ACA3B3E6F03D3C05F4B80A982F373344727744ACD90B99B1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0	data	4DFECA3A3C2F950FD312D91F8BFBA449	99CF0B2EB0C2D15FA9842E310DF28733AE5442BC	514BD767721EE735B12478BDA38DA620DFFCD11C323BD5A0C77E088E87A5E940
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0	data	1F2A34A631EEF5BE5FF88C8CBCF4FCB4	3D17E971C8B6253E113E39F4FB669297488EECD0	4364E31432882BA3285D079FEA8B9C26C0E51B70D29A5B96F83469D4776FE0AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0	data	0BF9AAE81FC2938B6AF829360153BAD7	E66A7E4A6482D943F025FD834076BF173A76DAFA	DFCDFF0EB6BB256A03DA82CEE928121FD15D334CE5595195A9293CF490F39CF3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0	data	CA779C1BF9B080266E3EC0576269184B	061B641FC321FD474D0CFF2DA8324A6AC70DDA3D	182D6C94D0091BCA08DB074C3467F9F9491A57267D2D79FE0FF864568C43A2DC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index	Maple help database	BBE5867BA77632106E5195E819654492	CBA3180DC3E6D8A4FD820133BB77BD6E5B42993A	31FB8365810DCC89AF02FC5A318838C97D4B47D9E9975E363A34F8AD6F8A5347
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	0AFFE19A5743ECEC6D27D63F6FA35A47	E57B068D4B7CF03E514D52B2FE1A387D1CD5B2E2	AFD383212DDF3E35DFBAF1CFB90F41EEFAF31C998B4B03CB7269D131E43B4636
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	05C31564F5D129E37A363E150A042D4D	FA62CA0C75E503D2C5E83FE48A9846CD48FFF480	64044EF0EAA6C2CCA1F6D5E32B8C1AD305D642A8AF7F91C89CACC2BF8642C5D1
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-210106184038Z-190.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32	BAE95E8DB3A54B7A318D4FAFEDD39BC1	9AF96D1787DE1602834EECDDB00A1716376F5C96	BFDAD7199AE27F715C96A81A3AA0DDD4E88758465E58288E2B18CD956B2349BE
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3024000	8EF74993391E51928562B084725356F4	092915212572FAC0775C11029FDFB86A0C981D97	1519458975DB1C14AF4DA5BD8AC4F5F7DA367B15DA5E44BC6CE69DC9DF1EE886
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	data	35455DB20624988EF2AAE86D31441476	FDB44B13CDA6A1C3A5140129D2CB0942BA1B4C8B	98C5BB249CAC63CC94C2DF1773EE18AE177C03778DECBABC4D1AEE2ED74243C3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.7164	PostScript document text	159ACCAFBA209FBC642499809CE2B513	6D94F57B63CE3BE71EDFB081ECB848B7D06EB2BE	ACE286E29DFDB19080E514F3447F46E0E4ED658263AC209A9B4BBCECC36139D3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.7164	PostScript document text	63B24EA3A13EAC476D6309BB202EF459	89502C393549C20C933E4553F51F74F3DBE085EF	2B4BE0BED267BBD4E4FFFC912A6C7ED6A8D4735DCF9B69FF90F37CDDEF4110EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin	data	9BFE2B6273A5BA0034C2AAB75B6C748D	CF23E4DABC2083CB124E4EF8DE7FF56C5C617676	1D34BA8ECB56950C34BC6BB77BBE357758C53B9B2ED00F789872623150B50A42

Exploits:

High memory usage for Adobe Reader (potential heap spray)

Source: Adobe Reader

Process Stats: High memory usage

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 80.0.0.0 80.0.0.0

Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/)
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/K
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: http://sourceforge.net/projects/sevenzip/files/7-Zip/4.65/7z465.exe/download
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/r
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/y
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#1
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#L
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#E
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: AcroRd32.exe, 00000001.00000002.905715688.0000000011731000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: AcroRd32.exe, 00000001.00000002.905773214.000000001179B000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/5
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/drm/default
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/anchor
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/subclip/1.0
Source: AcroRd32.exe, 00000001.00000002.876458830.0000000007D50000.00000002.00000001.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: AcroRd32.exe, 00000001.00000002.890629296.000000000B1CB000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/
Source: AcroRd32.exe, 00000001.00000002.890704522.000000000B24E000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/
Source: AcroRd32.exe, 00000001.00000002.890704522.000000000B24E000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/0b
Source: AcroRd32.exe, 00000001.00000002.890704522.000000000B24E000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/:b
Source: AcroRd32.exe, 00000001.00000002.890704522.000000000B24E000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/Jb
Source: AcroRd32.exe, 00000001.00000002.890629296.000000000B1CB000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/s
Source: AcroRd32.exe, 00000001.00000002.890629296.000000000B1CB000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y
Source: AcroRd32.exe, 00000001.00000002.890629296.000000000B1CB000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/yd
Source: AcroRd32.exe, 00000001.00000002.905929730.0000000011848000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000002.907036613.0000000011BFF000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com
Source: AcroRd32.exe, 00000001.00000002.905929730.0000000011848000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.comileLeng
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/OfficeAlly/Images/tab-help-center.jpg
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/OfficeAlly/Images/tab-request.jpg
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/ResourceCenter/OfficeAllyFormsManuals.aspx
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/ResourceCenter/PayerLists/PayerList.aspx
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://cms.officeally.com/Support/AboutUs.aspx
Source: AcroRd32.exe, 00000001.00000002.881349176.00000000094A0000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: AcroRd32.exe, 00000001.00000002.881349176.00000000094A0000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.comg
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://oarx.officeally.com/erx/Logout.aspx?app=emr
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/emr
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/emr/Appointments/VirtualVisits.aspx
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/emr/Logout.aspx?Goto=home
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/oa.asp?GOTO=hipaa
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/pm/default.aspx
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://pm.officeally.com/secure_oa.asp?GOTO=ServiceMenu
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://secure.logmeinrescue.com/Customer/Code.aspx
Source: AcroRd32.exe, 00000001.00000003.650766793.000000000A8A3000.00000004.00000001.sdmp, Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://webapi.officeally.com/OA/
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://webapi03.officeally.com/xAD/
Source: AcroRd32.exe, 00000001.00000002.880394092.0000000008C0D000.00000002.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf	String found in binary or memory: https://www.samplecenter.net/officeally-ehr/

Source: classification engine

Classification label: clean1.winPDF@13/48@0/2

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1vx9tj8_4h2j1s_5j0.tmp

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\Janette De La Caridad Guillen ASJ2 Records (2).pdf'
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Janette De La Caridad Guillen ASJ2 Records (2).pdf'
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=7285576016619014750 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7285576016619014750 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=13665176154593383583 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=5049533098483960058 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5049533098483960058 --renderer-client-id=4 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job /prefetch:1
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14602781306462947134 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14602781306462947134 --renderer-client-id=5 --mojo-platform-channel-handle=2068 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Janette De La Caridad Guillen ASJ2 Records (2).pdf'	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=7285576016619014750 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7285576016619014750 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=13665176154593383583 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=5049533098483960058 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5049533098483960058 --renderer-client-id=4 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,11888547961166346982,3110281861747858717,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14602781306462947134 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14602781306462947134 --renderer-client-id=5 --mojo-platform-channel-handle=2068 --allow-no-sandbox-job /prefetch:1	Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Janette De La Caridad Guillen ASJ2 Records (2).pdf

Static file information: File size 7249601 > 6291456

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: AcroRd32.exe, 00000001.00000002.905822569.00000000117AD000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Code function: 1_2_00BCF490 LdrInitializeThunk,

1_2_00BCF490

Source: AcroRd32.exe, 00000001.00000002.875903456.0000000005C00000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: AcroRd32.exe, 00000001.00000002.875903456.0000000005C00000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: AcroRd32.exe, 00000001.00000002.875903456.0000000005C00000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: AcroRd32.exe, 00000001.00000002.875903456.0000000005C00000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

ID:	336774
Product:	CloudBasic
Start time:	19:39:42
Start date:	06.01.2021
Sample:	Janette De La Caridad Guillen ASJ2 Records (2).pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	097e5a2956e5c698f987b27e33f2df50
SHA1:	a58eccbca7aa1b9105b336b960a7cdd1c823f259
SHA256:	e9bef2b78bcfd6ac88b7f44f38db5c5bd94dc9261327d48c91ac3913a3ff3cf9
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Analysis Report Janette De La Caridad Guillen ASJ2 Records (2).pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Exploits:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private