Windows Analysis Report Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf

Overview

General Information

Sample Name:	Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf
Analysis ID:	445706
MD5:	8a4d106bd7cd93b824ec43a6a9cf9f17
SHA1:	1f3daae06de076de26185d672e25d1582aeee782
SHA256:	25b7c93267473fb47e7befc85ac810fe5b89d6f9b8c2bcfb91d3436800fdf27b
Infos:
Most interesting Screenshot:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

High memory usage for Adobe Reader (potential heap spray)

PDF has an OpenAction (likely to launch a dropper script)

Classification

Signatures

Exploits:

High memory usage for Adobe Reader (potential heap spray)

Source: Adobe Reader

Process Stats: High memory usage

Source: Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf	String found in binary or memory: http://www.tcpdf.org)

Source: classification engine

Classification label: clean1.winPDF@15/47@0/1

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R3kcn0c_1rgf1rg_2ow.tmp

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf

Initial sample: PDF keyword /JavaScript count = 0

Source: Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf

Initial sample: PDF keyword /Encrypt count = 1

Source: Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Data Obfuscation:

PDF has an OpenAction (likely to launch a dropper script)

Source: Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf

Initial sample: PDF keyword /OpenAction

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1

ID:	445706
Product:	CloudBasic
Start time:	08:54:07
Start date:	08.07.2021
Sample:	Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	8a4d106bd7cd93b824ec43a6a9cf9f17
SHA1:	1f3daae06de076de26185d672e25d1582aeee782
SHA256:	25b7c93267473fb47e7befc85ac810fe5b89d6f9b8c2bcfb91d3436800fdf27b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0	data	3BF398AE3125D2D55A79142A88E91DC7	63F8D354EEF688F4E20BCCFF14556A81E9F88E5C	3A96C9FFE6D5EB8D321032404D0812A1252CF109FABBF187A3F8DE82E1C9FD58
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0	data	66B1B8C70E8657D476656E475DF26D9E	CDDC7B3AFF01C52DBF239251FE1C46BA8F8AFA9B	A8E2F200E93485B9F21796A0906DAB070229BC297FC53FCAC55E4486AE7B7992
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0	data	0FB2D60AA075EB7AA045395178471A9F	A61CD6FA0A0CD102EAA3CDD3B37E21DBA5BC8B4A	13FBF1D237DCA578750AD52EFC480133A87611D6D206454493782D3C562F8CDC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0	data	ABE4A6FB3C50504C78D07C5664294BD3	65722DAD6BEB98B181E54A0B810161D3B6D60B81	9D6D2324C42020DD3DB2B899385B1869271D8C1F4F304613ADB6B75EDD46D35F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0	data	A931B621D1722ACD86E31CED7F7EF7D6	134F27A8F742D76096DFAF5FDA9DF76899EAC42F	23F259779B7D236067B0EF59A078848A2C06EF0A83C2719F6694B4C79FE58C7D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0	data	63286ABFE1869FA45BD8C81F493233BB	C27CF32E64D608B1C2B04150633182317CE0475E	17B202C9D9516941D59E8DAF2CF8700571D949E8338997EB9F349118D1899DCF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0	data	E4C711132196840FA6A2BA50248155F0	A2F96E1320C318CA0BC0F7652BF59FBDE90FF7F1	9200E9FC2B218528414C611221A03BD553D2A0075B708EA8237969DF60944EBC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0	data	2E00061ED70AAF021EF8E95736365469	B078F65FD4F9198DF4822D491ADE5147F083CD7B	47C9938315C904A1A8DF454313921059685C7278D0558D73F15321F3E82EC1CF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0	data	FA67071D85B39583F01AD6787B07C852	AC04683C4746C9EB2606CA4BF3F143D2A07E62F8	D827EFCC72E0436F9C2541F8B0F8C20F6F6233D76D613F10FFC6179BF0477D4F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0	data	369F15E6A0EEC87DC963B97D4462A175	A0849EBE40B0A922607B5C4A834E8AFC8389C383	C71A44A1FCE415133E1B2CBF3FDB8166DA4A0C1F450DFCA7FA885AE91CE536A6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0	data	92D3349D0118B748290648C909A36240	001F1D2FADC651B846C4C1661E610F26577B2F32	F201971FA2FEC2965A0ECC1E78FAE352418D93218897C2787579595B3CAB4CF0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0	data	8F6BFB6857796D66392110DA59C1328B	75B2BBC628F27FFF60D4D11D13E6DC87A230FCF0	C0ED4AC1C521836609138AE78CF8B2E15BB8E00DF854D872F3D0E05780BD6295
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0	data	79EA1F5BE03F05FBD73E40B6862AC539	A58A4D5DDBE1C148DA61C86ED4B40F8A35D62AB0	B089503DBBA86F8B27B6F5B864AA6723ECD497854C7BD35192B70554FC5A5F1C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0	data	2BA1F36230539F467655148BF1815472	55626D471CE194A48652AD123093B3E1A965A7BC	2369AAEB7A8EA59156CF9A1148806515843FC6AE112F86092BCCE5D7845E226D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0	data	0A9604A8E088CBAA8610FB0D8DC6F7B1	F0F1C4BFFE6091B55B11A8BF1B27A9BFF0A199F6	A93D4C6DA20CF506D663E256D4F3160862A49AEC7A9CF8AC7812C4B44B3B4EB2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0	data	A80AEB7AEE94A706616041A43EB6DD7A	5BF2E5CEBB744C45916779BF9FB41FE9015D9510	61A1E38DF701DDB8515FD2941BB73DEEA3D540AAB4CF15CADC6AB72A98AE3EA8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0	data	9766B76AF1DA8F49E9D29F9F101CD27F	8293060BFEE45D404D6347ABE00B8CA538D11C85	A3C4AAD59894CDFDECCBC2DBBF6318C07394F6141CCC50401401C76C92E9297E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0	data	6E52F4889D1912251F28A183E51153CB	846DEBD33655DBECBB3BF8D8B64E8705E7CE006B	7D1E84DF126B0B986056D879D5964D995FD166A88656A5E2BBAF847A941E0F05
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0	data	CA72E1D9D01B10545AC64795B6FC4E8C	B875641BEF6B63DB93A61A5EF9A6DB6A96262D33	6A4C9B12929B57B08E5341E2ADE5CA570F075E4B86D4A8942C016AE957790457
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0	data	D484C0AF66FB0491370C446CDADBCFDB	4C670110C7F6599704D2EBABEC0CD6CD74BEC020	E892E702052BD94A767C3B6F22A369D88B4F62BB346A4FA32CCEC42230117AD4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0	data	1D348E97279C9FAC7E5AFF2D2A050AD7	666DE6230B464C23365977F2418BCE9549FCD51D	E231F93A74344F95126ABA36FCB8C49AB875A142F4938AB7DE6FB6CDBEE88CEA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0	data	15C3C709F2860761CBEC5E2577CFDB63	9873A1971C36E94EB6211EA6E9BD653352D34386	D281D988E915E51B4687D9A9E140EE66CB8959EF21590044D55F394911FEA962
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0	data	99093B2C1E93410CC9FF1D6D5782282E	8983CF109EA938F54D47FE5BDD1DE5269B925B44	E4773C8AFF4814E603B4DC90FB458862F893715F8280363F7846993AAF98F83E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0	data	E17BB1784B59348A65B715E2DF561595	54B0D229094108101BFB22A600940FB4C3203A20	FA4D8409D44725E6432B26AE753B5150894B887E211A442D57F4B112F4EA31C8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0	data	123801E13B6D9CDE3223E0195E1D77E7	C9ABF47526BD3B75930674DA6795560232AD31F1	B51DC75A3B2788080802203610EFA144A7A978FD6A1D2039E65B41503AB0A142
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0	data	990AFA1B282B513488C2384E275F85AA	0E20E718B46DC130B66E4C5E47B9BF2B4DCB1AB0	C71743A56521021CAB77270F70F9B1D5B0FF8013782B7A9571CF98DF0D862C8A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0	data	6E69E7FAE1EF2BCC8596EF69A4B45B76	ADA56BF684288B8FF22679EB885C1FA46C744C85	9A16CA581F2DD6263C913D9BBA8D0CF837B83A3DC479573667AAD25FA9A02958
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0	data	392EA35874F97731751F31CB1860635C	59AE2A3DCE8F2DB5CB2AA148A9EB6C47BF7B7D35	54EE0CF3DB00B45A0EC39606E6FE2296B7D5F3A67A5F72EC6CA2B69A4A8DA98F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0	data	2C01CE47171FCEEAD3086B323371A6C2	E2F3D7CFBB0DDD42F75CD7A73ACCE939384109D6	DD5A1C6F2D9C5FE07C3BCA5129FDCC0645664DB94155C6717DBB9907F1511CC0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0	data	28605C46BC2D259B119F991073DA0D43	419490E1C8302DCDC5E518BFDF5161533080B91D	1B76B547CF4A2E766351D0FEA748B85A898F33422BFC825246F5267F3952F843
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0	data	DD32F5388B18A54018861B24280AC93C	51618321F76B1EE8205978295EA203229695BB20	0746DE64F91CD9EB24D68580A05735680412358B03AF38C3994C80CE43435C63
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0	data	592B1119B0B7303C0858316133F9F297	0B0B16F9954D2BC60BDCE8082287E2B98D5BF0E9	664FF014F6B72E462DED2CE32224421A5782FBF1961904192D0852EEE7308477
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0	data	5830D7F3468B8974DF999526EE0084AF	47E80D72005C5EC652EC2E2899F26B8DAE696DA3	85204D8E681581241B1E2769C19DFC1E1FC9E9EA5508E2515317E13076694A2A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0	data	0A2FC7AC64C6FE535CD4610156014AD4	62FD103AD2C74C8540128376DFF79D285AA9F00A	5BEE5820D3281C30F4B371F3A7CC1C9B1C37BB46C5007E28337A707AAA8C2DDE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0	data	4C72D213D716A19BB305ECC2EF4ADF15	772A5DDEFC9438F2F6EAC00FAF4AE09B8C1B0875	2750A2BD7693135BED30B875F63BE64E3915881E76FB79F00AD437269FC5D80B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0	data	443644A8E52E5FD6B576241C3092D5B3	7317B5DB795721CB27E7F2449C89649717A0FDBB	AAD3B7D575226B1232F8F5F671F982B99C6853E2C87E97E98840EFC50FB51EEF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0	data	A494A722FA658819FB0B3872669D813A	636245E0D687DBAE26584CE61D9DE0B8DB41A0C3	FF484119E4729D451629BCCA12661280CA654A0E25DC0E740790D826EF4790A9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0	data	E0DA4F54323274D64855720400A8C5D7	150C4BEF5DFD54A5EC462BB3C8103EFFD784ACFF	03120D5CE63C5AE92F2FE178C76FD8ACBD8A54328EF0DCC3F506C4D4A8EDA285
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0	data	4CF5B423FD2F44DA229B4B111A352F33	AF894F79498BF33F4B14BE054FF897529DE0081D	EEB69B34BC4B023DF7A7FFAE017B53E989A8E426B16C0C6830F295AC5EC5AC9C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0	data	E5F5C941F594A7E69E891F0F7C1A550A	BEC6DB993E8358B993B427034504B2DC494E4A39	8ADCA0FE8428E7CA899CF2A46C81669540349DD6D6ACE33B91AFFCB1A519076B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0	data	90013ED928FD2464F4A51D349832A115	8F26DFEE567C4E5E9948FBDB111305ADD9F9EDE0	771D92F0EB18FC81BFC6928ACB3A70F8D5A2A9FDA8A58DF62F62512442E78427
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index	data	8C41D8FAC51A3CAF1ACC407517FB25DE	F5E65C4DA33C877404CB5C38EC9DEE57E865D2C3	012EDC64F741708C9E766C8F8D55BC191293A7691CFF67454A0552B1AE6C8AEC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	D9E8833F9ABEF5898C45DD34EDD3DB8B	4B81B83EEB167F9711A56B744958FCD8CED1B352	45B201C8CED292BE1A3E77D3C08DE87D580D48A2EA12D83FB9848E75A1593752
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	21F68B1F50AA5D43174D8ED779840C7D	08E36AFE4C42D559A619CECC819124938E029F8B	97E0764C48F77E1FA0776A86491A93F132964269B56AF61948844E2F4AF12729
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-210708155504Z-269.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32	12E1B6F3ED296056272AC6C47C05D926	A87340000E55F8DA215A5B134FC06D0967076E81	708936B9E8AC0B6F5B2FFCEB980A93882D791C5038B1875684F5D441D513BF9B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3024000	3E6EDADAD757B33E8F6E474B759AC0E2	EC65342A3C924890E266ADCA7544A5868EA9EEB7	44282D2350E4B0C8AED0F1D1477BECC7BEF065F2799A5CD5E209D43886F9F973
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	data	D9DF457216F1BBE3D1B68B3DFF7FD3BC	5AE1DEF7EE2177169B04CCDCE25B738A2A1417D6	309521661931314D185301F14E6F53F212CCD60139332D6767EAD13C6A561A95

Windows Analysis Report Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Exploits:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=12362944656118107355 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12362944656118107355 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=8489781687595542147 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=17384072550564997965 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17384072550564997965 --renderer-client-id=4 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=8027345025244038801 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8027345025244038801 --renderer-client-id=5 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=17885131697990081341 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17885131697990081341 --renderer-client-id=6 --mojo-platform-channel-handle=2160 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Operating a hospitality business in a COVID-19 environment_Certificate of completion.pdf'	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=12362944656118107355 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12362944656118107355 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=8489781687595542147 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=17384072550564997965 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17384072550564997965 --renderer-client-id=4 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=8027345025244038801 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8027345025244038801 --renderer-client-id=5 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1620,5906189657434163320,668840119143517484,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=17885131697990081341 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17885131697990081341 --renderer-client-id=6 --mojo-platform-channel-handle=2160 --allow-no-sandbox-job /prefetch:1	Jump to behavior