Analysis Report doc13798320210419100501.pdf

Overview

General Information

Sample Name:	doc13798320210419100501.pdf
Analysis ID:	392872
MD5:	3290102a424ad87067467fc04458312b
SHA1:	906ed1cf70e333e1820c6daf461dc244e309e7a0
SHA256:	f3cef618295d205d3f9339da45491c2711c92add67e3839bf819c02579b4d087
Infos:
Most interesting Screenshot:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

IP address seen in connection with other malware

Classification

Signatures

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 80.0.0.0 80.0.0.0

Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/.0/
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/I
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#j)
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#))Mr
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/F
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/Q;cb
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/drm/default
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/anchor
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/subclip/1.0
Source: AcroRd32.exe, 00000001.00000002.388312297.000000000C9D9000.00000004.00000001.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/
Source: AcroRd32.exe, 00000001.00000002.380046642.0000000009977000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/
Source: AcroRd32.exe, 00000001.00000002.380046642.0000000009977000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/C
Source: AcroRd32.exe, 00000001.00000002.380046642.0000000009977000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/U
Source: AcroRd32.exe, 00000001.00000002.380046642.0000000009977000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/o
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/esbO
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/iO
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/s
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y
Source: AcroRd32.exe, 00000001.00000002.387687035.000000000B92F000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com
Source: AcroRd32.exe, 00000001.00000002.387981455.000000000BB51000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com6
Source: AcroRd32.exe, 00000001.00000002.387687035.000000000B92F000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.comgs
Source: AcroRd32.exe, 00000001.00000002.379828238.00000000097A0000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: classification engine

Classification label: clean1.winPDF@15/48@0/2

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1g3xyeu_1fzh943_4zw.tmp

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: doc13798320210419100501.pdf	Initial sample: PDF keyword /JS count = 0
Source: doc13798320210419100501.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: doc13798320210419100501.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: AcroRd32.exe, 00000001.00000002.387660948.000000000B902000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Code function: 1_2_00DE81D0 LdrInitializeThunk,

1_2_00DE81D0

Source: AcroRd32.exe, 00000001.00000002.374688128.0000000005D70000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: AcroRd32.exe, 00000001.00000002.374688128.0000000005D70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: AcroRd32.exe, 00000001.00000002.374688128.0000000005D70000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: AcroRd32.exe, 00000001.00000002.374688128.0000000005D70000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.0.0.0	unknown	United Kingdom		5089	NTLGB	false

Private

IP
192.168.2.1

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0	data	943070EDDE70B1127C835CDDCD7CE105	CDD5745215819EF8D0A32375D2E5C99A3C10FED5	085C0944D7CD0B58C43EEBB5F75E1A30631086FE343FAD61B02913EC421C2768
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0	data	C5A9F587AF05A9367BDB88D34EE294CD	ADAA12E2743669469A818C271B4781091E0CEC09	89F7FE9BEBDD723FE691B7081542E521A9D3ADE7537DF698548652FFF90FB14A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0	data	18A7E3CC194E5E26CB1806A81C43F59F	80E18AEF1FB6C436F6C54C4230C93ECC9C97C6B5	35C18E64B747FEB730C8804BB03AE44C52DCD59CCAC83CED57505E62E0D8DC7A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0	data	FB7174323C54028D37A13C9E7B392368	68E4430FD2C1D12220009D7C08299064F565A52C	3E329F1C7CCF44E60272151F65A164D0B74267B8EF3FD94B48372459B61C5228
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0	data	A27DEACC525580FA2FEA64D2F644CD30	F524AB6A8AA544832871CAB2B40275F01E8B41A0	38E785B63DCCBB5C8AC4EF89E53C60FBC01A69AADA1706373CD7BC75486385DC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0	data	603F38645AFF223431952C94FF498644	202D3B8F2B7EE778544AFBB3C8F1C1A447E24FBE	82922C033C3E9ECCFD9F29B53D85265F9BC898A37C39EC553ADB6CD58438E3BF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0	data	7F1B69A36C0D4CE8451A6289158687E3	F95D3EEB22C4AA2B2E0784C50AE9AAA08B68BF47	C59C511F5BD81809B0D92AA56EDFBB5E6680DE7F7A14C88A61C25315DBA8D856
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0	data	17225418D740C23AD700ECDE3071FCD1	FEF07EFA1CDE094D2CCCE871290C3673BC18D12F	EEA8BF0ECE574EF74D8665F5D95727391A1C610E64A242A003E6FF2DB3E8D0FC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0	data	C7338A52C137C0D0326816478E22EF8B	0EC29B67E5937596B35B96BABED3E676DD068354	2240721693E071DB40CF1E3607A00B6AE743D2CBA2FF989EED0F12BD57061596
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0	data	DA9C4CA0B3A8C662114D00B5A27EFFDB	FF547F3109000D4BFD86BD44F874C4AEF01FCAAE	A2591C63C55B6E1C419A0C7023DA860A9EA656BE82005B660A0980743973E196
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0	data	127CCC246B35CB51A4F68B7E3C8309FB	86ED1FA3F49DD5D9F7DDC41765459A33CC1F2867	8E4CBE6262B48C5E8B43FFFB82AA071B282AB4530D8B553582531C96A7CAB78A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0	data	91795E9CEFC9CC37EFF51DEB9641413F	BD7BFEF44976492718DA59E323420C36E15C2FDE	B358F91319F5493D6F0F4157E238EA5FF93B0CDBBDD6C1F7FAE5CBA7135E0768
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0	data	0CF38AD2D9FF2356D6176F2834626529	E1FF3DA98481B2B393A1740C51F2F1471DA73411	149F6F42C00B08922DD1B6A60F0B53DEFC813D969490567C4CF908FDFF550B16
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0	data	A28C8FCFBF5CE67C6930308C08F14B3E	A43395299437E82453A0773235BB469FEADDE7BA	70E512D42BA75A67AD0DFFBB52C8ABDC12BCD33C0CBC4869832C22393918E81D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0	data	8FF26F9DD8B808BBD6290149CF788F3B	263B0B4CE3A5FE970EBA1AF18B8B35755499216C	958EF74EEC64BA8330E472C4D5A0773F03603208EB283B1C250AE5402099BDC3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0	data	865E34F0CAEF519C6A5C24642233F10C	07645D7ED7A8AF957C1866932D1215A8D0C03461	9D67625084FCFEFA70670A26079E9F729473EEACFECA1A982FFAC1D7786D65BD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0	data	AD5768F8919A3317B709F13C9ECE4CBE	55D74D7AA43DE517DB6D687056EF44E0E6FDE5BE	CDD6084109336BF655C03DAEE717E21FF1F44C61EA4A4F121625E9C36639D262
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0	data	33FB870C2A905AA9B4FA0753E27DA3C2	132D0F39B0260718DC13C91C0C8978A9AB25E0D1	AF8C485E3ECD013D4F1C0AC997C148D756B3858088742DEA5E855A3E2080C743
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0	data	741245C926587FB7F1D636B9AE5D5D64	445555A2039293F43EDCE3FE7D62753378EF2FBE	46EB8E9E8AADBEE4226B425A502C5A440D5F632B81FFC12C571936B5C0AB39B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0	data	8CB6CE012E0B8D2EBA2C7104E9A56F95	FD4DE40EC37DA0DD07C82AE2A1A90B46B8767371	D20E609A7EA08997A27688415D62399038837D2F49A5EDAF197EE97EE5ADDB3E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0	data	6C64AF1E5B8E9754D21E9EB68B383C98	94B7A71336E8F5E4AD0A2487C34B9AD9C08AB51B	288EF64CB44613E594F757D00A0EA15FE367B8E2BDB763B018CEB230BA7E5D47
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0	data	83FCFB3761C9C255004718F62D4CEA38	C2C47AA4D9E65F613EA7A01E0DECB720F670905C	68CF3B4ACFCBFF74951FDA3F0CA40B2C521FEF3D075990B4674051D1105E091C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0	data	BB4FF925B3DD40AC23D7675F28F7B38B	14E1EF8D9ED9CAB20215B905FF09965F9A012146	B0CBD90252CEE849D46FE7B89D8E95217DF1859C56752DAB78C053B9F8B89A7D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0	data	6AB36FC2E8DF9D020B2B0A1C18A83EDF	34EB04AD08CEAA1222993D523CF82CD7AB7468A1	9555C86D7701EEAA3C84F395A4025F4C82C1615842E836C15E5AE44ACD508E86
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0	data	1EE5A07141380BFDD9F7415AE50B9C09	3BEAC65586963D1FA88AC26C9131957616F01C58	ADC131C83E6D599A27A188F173E0F48354CD86EC184796B9DBCF4A34F29DBE67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0	data	2DCFFF2F9B4D7975DF19CEC657FCB25B	349E4646FD434076BE7797C121FBCBDC1BEBAE13	02C0ADDE2B910538B4B6DFD5E3FC739995789FD29C0D5F4436C04FE329486D13
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0	data	569510B271C402757FAEC5E9C148D28D	ADE8A8FD087D2899F79EFAE5BFB89AE729C37674	C06366D8634C7E7C61FE3310A3CF3DD3063648A5D2520F4316F737E4BB2A0518
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0	data	F65BAE3C53398393CA8EB4DC8240303A	52D81D0D562969D3E6AF0927E2E6C228274A562E	01B3216BB839DC161182B99285A9C2AF24C000595611789786263B749EA81BE0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0	data	93C34B6041CEF6AB906B3E30AE664494	30CB1BD16B6E82095FD05D6B42E6C5EF93D3FD8B	82F5B2FD49F98DA46B0A05EE0E7F95C06A1043F6BDF5D0784A9D977D7298F038
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0	data	D1E01DD311D8D6FD8C5A074C8B1A11FF	9894EC38530138866276B2CFEBA2B11EECF3C6EE	7B218C5D6E8A69516EEB944A267F562EFDE0DB696EDAB96D04EEA4AB9A2C1BBA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0	data	BADBAC69794A51ACD99CD3A90A4A3941	00B9C554501C6ACC4302D0B5B555A8A77B85B7B2	9E39A522354689A140B924BDE0F6124B72270DF5E340439756DAFE09AEB474F3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0	data	234A673DB627868FE0A7C2CF9861A595	F9497F9394E14D74C2E90D33E16A1E20083426F9	47020558F532D39B8F5D20A61A2271B7B2DDD0621A1E7988A1C97F65F7AE56DA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0	data	BDC644862B625DB696F22185922B3768	29D4402A5A17EA5C743D64984F0AD14DE15A8857	A6A7EB17F8A20CAD96CC1FE62065F7900C0392BD1FD7B1BDC6E8BA07390E84B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0	data	A37C42368C30FB5B97A733A1994E30DE	5BCAD7E7720B3F0B4C1FAA880090FB40BA096D63	B8A1D5A996E002CDDC24CDFBB73F9916606B3EC7BBB584A2F810862AFE6A5555
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0	data	3206F180D72493477E7B6AE3644E76D8	DA68736BD2A553B00B1F9440277ED9C20140CB41	34CBB932B9D09E2CDBD08BA1FD51D05CF0C0F8CE18641C109229FEB0537A0771
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0	data	00497797C6EC41A8C5B3722E5CF23F41	45C1E0B5F082D1E64477F27E4F8C078FE73A3DED	058DEA30B76C391B642632E43EA6E77A3A6EA32CBC893F003D0144454C770ED1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0	data	1CB4950074B1D1BE6E5E50331C5BE9DA	BB4E68F790B1844AF0C1D0385FBDFB90A246B9D5	6397388528D3FAA860CBE94E79DDB8A64D7E22A5D112C3F6E0568A943DBFD6B5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0	data	FC8EDC32BA09B656B66EF073C5C592DC	1AFFEB970BCD21367E411AD8115EE0FE225CAA6D	DB5B3F5F9199630A1DE366FE99236595051BF5804F364198215986E01B5BDA39
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0	data	075CCE5D425FFF95EE8412DB7EEF9ACD	05906F5A7AFFF4156AD7494805FE4D2238D2F2C1	60BB329DF238F82D57FE4C78AF6C13446DBC5F8B079A916F2559C315D53F7310
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0	data	DE99850781D4FAC81F9AC71A344B744D	5B9EE04BE73B090261FD0B371F93DEA46B35769F	9CB5890141C195FCD02B983A6ED1B6A950CEA359062CCBDC75C8974F566B1BCA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0	data	5A5CC36AAFFFFD2C08AEC3066E6F2BAF	F591ED5A8435D885FB81083067C011FE0BBA704C	DC5F2E587B5D3391659385C2C18672BB333C62E8A43421B7467E97D2BB6B4F9E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index	data	02A44073C6103BBA310180284C2E9EBD	F9EEDD0A6BEB6CCAB3F9BFB37EFC9AA75C389D1E	AC8C7DBD12593B689624B29665AD38A64D18111F362B9861370897994E611780
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	9A3DB9E83C3482EBAAF0B12A53440A00	8C879579D7981B44253249F65B3276B0D31DCE81	1719B9ADA08864225CD32A8A6275FBE2100A92901E8741091CFFC2D1C0924AB7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	21243F04C89A197BB6B7F6F83FC3143C	86C39801641D4689AF8792AFB690A0CADBE81263	B71EB44A7471A903DEFF3A492C2981A68BFB32AB60A5D162E43364864DE135A3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-210420061313Z-191.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32	28E62CDEA0C4641DBC6742E4FEC44B4A	675521404A4D4BA86CB7EA84C8638BA6A72B2F6E	9B240A71A4BFF4D61080C2C472ED0799CCCB9020D12FE94B0995EF0972E9FFD2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3024000	F4679DEF0BD47C27490C92F732EAF49E	A6B3394592B39E588316F10ACA00AD171966AF5F	5A72E4A382251F35124D3FF1EE0D6C5C967DEA211BA9468ADDA6DD96A1E051CE
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	data	AF42F42C35AB7B5716FB0F1F37405BA6	6D5267939271F64B3FEBB5A7C2AE3365D57007C4	4DDF99BAAC60DF73219E98C71DBE6921035C50D49A1AE2682D1354C2339310A4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.6476	PostScript document text	A2C6972A1A9506ACE991068D7AD37098	BF4D2684587CF034BCFC6F74CED551F9E5316440	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 80.0.0.0 80.0.0.0

Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/.0/
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/I
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#j)
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#))Mr
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/F
Source: AcroRd32.exe, 00000001.00000002.387423846.000000000B786000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/Q;cb
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/drm/default
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/anchor
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs
Source: AcroRd32.exe, 00000001.00000002.375393966.0000000007EC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/subclip/1.0
Source: AcroRd32.exe, 00000001.00000002.388312297.000000000C9D9000.00000004.00000001.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/
Source: AcroRd32.exe, 00000001.00000002.380046642.0000000009977000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/
Source: AcroRd32.exe, 00000001.00000002.380046642.0000000009977000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/C
Source: AcroRd32.exe, 00000001.00000002.380046642.0000000009977000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/U
Source: AcroRd32.exe, 00000001.00000002.380046642.0000000009977000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/o
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/esbO
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/iO
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/s
Source: AcroRd32.exe, 00000001.00000002.387449717.000000000B79B000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y
Source: AcroRd32.exe, 00000001.00000002.387687035.000000000B92F000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com
Source: AcroRd32.exe, 00000001.00000002.387981455.000000000BB51000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com6
Source: AcroRd32.exe, 00000001.00000002.387687035.000000000B92F000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.comgs
Source: AcroRd32.exe, 00000001.00000002.379828238.00000000097A0000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: AcroRd32.exe, 00000001.00000002.379497652.0000000008D7D000.00000002.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: classification engine

Classification label: clean1.winPDF@15/48@0/2

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1g3xyeu_1fzh943_4zw.tmp

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: doc13798320210419100501.pdf	Initial sample: PDF keyword /JS count = 0
Source: doc13798320210419100501.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: doc13798320210419100501.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: AcroRd32.exe, 00000001.00000002.387660948.000000000B902000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Code function: 1_2_00DE81D0 LdrInitializeThunk,

1_2_00DE81D0

Source: AcroRd32.exe, 00000001.00000002.374688128.0000000005D70000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: AcroRd32.exe, 00000001.00000002.374688128.0000000005D70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: AcroRd32.exe, 00000001.00000002.374688128.0000000005D70000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: AcroRd32.exe, 00000001.00000002.374688128.0000000005D70000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

ID:	392872
Product:	CloudBasic
Start time:	23:12:18
Start date:	19.04.2021
Sample:	doc13798320210419100501.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	3290102a424ad87067467fc04458312b
SHA1:	906ed1cf70e333e1820c6daf461dc244e309e7a0
SHA256:	f3cef618295d205d3f9339da45491c2711c92add67e3839bf819c02579b4d087
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Analysis Report doc13798320210419100501.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\doc13798320210419100501.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\doc13798320210419100501.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=12742373955121677917 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12742373955121677917 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=8293892013758276365 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14988028654324180745 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14988028654324180745 --renderer-client-id=4 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=1643063119428019652 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1643063119428019652 --renderer-client-id=5 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=16149447064209592232 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16149447064209592232 --renderer-client-id=6 --mojo-platform-channel-handle=2176 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\doc13798320210419100501.pdf'	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=12742373955121677917 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12742373955121677917 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=8293892013758276365 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=14988028654324180745 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14988028654324180745 --renderer-client-id=4 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=1643063119428019652 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1643063119428019652 --renderer-client-id=5 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1720,1001149262048530690,16326826708203091992,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=16149447064209592232 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16149447064209592232 --renderer-client-id=6 --mojo-platform-channel-handle=2176 --allow-no-sandbox-job /prefetch:1	Jump to behavior