Windows Analysis Report 404.pdf

Overview

General Information

Sample Name:	404.pdf
Analysis ID:	534014
MD5:	d838d040fd7877c106b9800d3df0c3a6
SHA1:	6f520b71773361a887a3cdbe3f8745d1ed3a57be
SHA256:	21979c27f520821587157e7dd3af9af3872998d527834f141cd7dc0535aab5b5
Infos:
Most interesting Screenshot:
Errors Sigma runtime error: Invalid condition: all of selection* Rule: Conti Backup Database Sigma runtime error: Invalid condition: all of selection* Rule: Stop Or Remove Antivirus Service Sigma runtime error: Invalid condition: all of selection* Rule: Conti Volume Shadow Listing Sigma runtime error: Invalid condition: all of selection* Rule: Compress Data and Lock With Password for Exfiltration With 7-ZIP Sigma runtime error: Invalid condition: all of selection* Rule: Disable or Delete Windows Eventlog Sigma runtime error: Invalid condition: all of selection* Rule: PowerShell SAM Copy Sigma runtime error: Invalid condition: all of selection* Rule: Compress Data and Lock With Password for Exfiltration With WINZIP

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1lwry6l_1arw8d8_3x0.tmp

Jump to behavior

Source: classification engine

Classification label: clean0.winPDF@15/54@0/1

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 404.pdf	Initial sample: PDF keyword /JS count = 0
Source: 404.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 404.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: 404.pdf

Initial sample: PDF keyword stream count = 80

Source: 404.pdf

Initial sample: PDF keyword obj count = 98

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1

ID:	534014
Product:	CloudBasic
Start time:	00:29:36
Start date:	05.12.2021
Sample:	404.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	d838d040fd7877c106b9800d3df0c3a6
SHA1:	6f520b71773361a887a3cdbe3f8745d1ed3a57be
SHA256:	21979c27f520821587157e7dd3af9af3872998d527834f141cd7dc0535aab5b5
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0	data	5197B742C579186C905045B441D8CD41	F19F4ED8CE69166241A733BE8335B70FC8DAD0B1	67A434E3E6CADFA6C1280567F5C790832DDF56B568E5A3F615891B7452D9E418
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0	data	E4DAD6CBA5A47F97426C3ED8C537362A	97C3EBA6EB89A1328F0B5FBCD6339752025303AD	13B1A9E80FCF7615F4109286CA307CC6A22E4BED4CAA064A221D8FFCD956A561
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0	data	AE4BED58C20783954FD9EF397281BC16	1BA7C6FCBB419CA8B39943F128123F1133683C10	1D6AE5B418AC40492F58E7857016FC2C171AAE9CA21C4D069B5538CF9218C178
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0	data	C8B7C338861DDA6B3979E8CDA466CFA7	123FC61D7C1B304C3DF66E75646D86DB38BB4CA9	327BFB9508753B4CAA383B5A615ADA3AA8DAF15277173665DA34071A7DABCD3E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0	data	2DE00A9F34A90A00EC8D8F7489CD4862	8031B306046DDC323058CD33793DD10D5CD63AC0	B16303124195CF6DA243440F95A4179E88F1FB7EFD28FBF888075B936F714CF0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0	data	AB62A5236C3CC2C31069BDCB39754049	8B234CCB4D7D3B7252BA4FC60E2B1BA76F1D1388	B67F0BB152FA2CCFFDFC328DD24DEE8861266B8F34D22737C72771BB650D2FD5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0	data	042C6F95B2A2622E9561DF44ED0624A3	0583CB86CA151259095005CF146BD2D04694E3B9	3CF8BEAD336F056FEAC87C1CD0DCAE215E75D1C0CC5502DD987483EFDEB2E4F7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0	data	5D8AE3A433BDE7C96AA7E8D970325AD9	7D571A327FCB3D63177D9F03F4B1D5A307B38D1A	AA89F710C56ACC31FB693E5A59EDA4B5FAED57A9508BDFC7D75FF025D80F2128
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0	data	E1DCFFDA0DCE3D9231CC2642A80E1D6F	B2A14BEA2DE9235DA9FAB70A9489FB6E8F511857	6C3F0FF66905C964E165EDB6B1EC34E9CC6973D148868299FA3C28ADB105FA2A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0	data	DB8F594B78A3F2BF31DCB5BC023FD243	542A04834D0A8CE326E71B3C388AABC741C88298	BC7F222C37C9CED8501FC027050F2C91256C003DABF449E68F6D3E543E3A56F1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0	data	A16BDAC8F238B629EB72DD7C40595F7F	60B2E9BFF07028308472A02D7E6833B41D65289A	2FC6F6AF27902240098E9ABA988188A7945BF56F042005B4E953D6D2DEDC52CA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0	data	8DE727FB2F0307D2928E920926252531	2FBDC3DEF13C1E9DD095381138543C5A4D6AC3F3	D36ED88208595255D18CC50FABAF11942667161B89E10B897F41184AF8EC12CE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0	data	F7DC0683D7CC2FC4AF1F1EBE5AB0AFE6	B34F8C273012EFC7E9B753DD7A9628372B59663A	865883754F170EEE6C0AB1B0FD0BA18F4665E39652E6C5865FE79816AA21275C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0	data	4713CD09CA7F32B2C113A73FFF822744	F2462EC4C181424D7E1062570DEF6B0536E23874	1F1D85AE72D72F8EBA971217A10AD8D434D3EB9A4FAC257370D087DA27CC9AED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0	data	9483676F78C69D07C54047629A9E86E9	45FF6767FDF14826439CF429E60ABFE08CF8B02A	97DEEA6C3CDA97BA9B400868A18A53D4F0EC3CD618AC4551D9E038AC12C085E2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0	data	8D430543936D2EE647981D91F37EA024	6C00774132406FD04B2C644C18C8C345373B7846	3C853B20A50013B77839B0DF0AC41D115A56386B1A6EBA3D6E198FC8FC50841D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0	data	28E4F9F05F6CA9803F98A3E4E98735E0	07AC46242D6C50028D311C9650057B03504765D9	5AD8C31B55B133FD265390F602097C2A5F84E201FB47226255880D413C7F485F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0	data	B300BDD6F0E7423960EBE38C34A68998	C75AC1C4F828B7D79482199BF98F4ED99C618BC2	70DDB26CF0C9234D5942C9EF4C4F95F4B5BC712BDC2A099B605B162D203EF167
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0	data	AFDAC319626A75297446AAF72517D958	29B533C581DE483DD294CBB85B21E1F3BE906958	2A2F8529E6DC8BB6CB4374EEDE8EF9BBF1594BD89742912DC648F89D058DDF03
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0	data	E0A416C0932CFA9E62F223EB627AB783	7B16DD71DE3E983DD3A53ADCB65846BF808A32E5	A3FC5F8E38C0B19A5E4F8ACC49497D51C2CA1BE99FD6024ACB0D0849502C84A8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0	data	0F5D21BA167549C5D9680851B68AC3BB	BA82E59298E35B40A145F2DA9FD4F094914D2231	F0B659BDABEFFE45B7F04F45E9AFD5BBF03E2B1E53E09BC0619BA0292F3DD5F1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0	data	7B7D41CD9542ED280F0C61D7EE1C38FE	A61E9874129A11028DAFF8D51746BAD04CBCBE51	884E721DA48A913C0427EBF3C0522E2D76A48F11986E168D7A2EE923CA5CDD4A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0	data	18104583136E708E62BC7A909FC379C3	FC222C1F8A6838BBE9861E66B2F7F2D513170EAB	86B192C9FD61B53096CA58D9409047E5829C03AC3F8A99C44F4E0183E4A71DEA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0	data	7AE32FC1290DB08160CD649E77B3282C	3B139E83BDBD559D4C506821B065D166C41B1870	FFF3898541931DA207C66D0210476A7E90EE9A55DE079D97BF21A84E57C61EC5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0	data	0093A34DA8CD4A1B40B56C98E8BCFFAF	713CA1A5EB2D6D042E2878729AA217FC441C9713	BEEBA705E22A18C6546EC5233CEE3F992E53BF5C2D51A79ABDD744AE61DCBBA1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0	data	A4ACD4F9F1FF3C63FE0B2219CE83582B	DC0D07386F597058FF968F4E4D5102FB74D32AEC	636216360CAD4E5F6E9B7F25663FD62498B99055037029607308B49F2013C233
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0	data	ED0B32F1E0D69FDA05DADCBDCD1B3B7E	FFF3E44708198BC78C6FDA2034CD6AB98BEA7F1C	E266C586F4AEB78AEFD521C066A47F0884BEE7590432576302E7E4A368395D1C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0	data	25F76B6040807109B779674BB47E9D60	97F5EB316C1D844B7561708ED9D2B58D90A2AD18	123DF10A09D97B3F994BC07046B8CB459DBB1E906A652B34E7EB191B32A78830
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0	data	BBF344DFFED62697F3F1BAA94DB8E840	2062C2CAEE73F973EF62F1E4380E727A2D5B53BE	03C2C3E621F00DE71262602EBA394AFEE3BA2A09C0F2289787243094FB273359
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0	data	C5E1928A16A6314F2BF960435C8E40DE	2CA3B5C1580AA0791DB2A03B5EF63396EB55297D	F51A4E4376141B43F1861719974E1BCBE11C469F935830252124DC36EDF4DB00
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0	data	3A737E340C098738BC676662C0C901FA	C434DB52A02F8FE5D08DB905E5A652B6716BAC10	6D4C78C0DFE47320C330F6C612F4CDA0825F95EAE914037DEEA9A248797A3FFD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0	data	A7A13CB4FA42DD8F74BAD789AAB3D335	A46D0FEB6AA8A978671FFDB953672FD309469522	87869FDA6259F77F3084061C328EC4A368073F105F4332517F4A377ABCCD9031
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0	data	FAB0F6D7A5ED5D7CCC5288C5576675E5	C98021901D3C0613D9EC5B26CD4A6CE78FD8CF2F	280CFAE115809A183AEB0263F952BE998CAF7455A9894EF87C5977C4E44590A1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0	data	C09AF002BF2AA2BA3311E6017BCF95DA	236F0E85DF26A66A7F67F7C87B114D7E46B0384C	A787EB776CA0504BBA2621247F95FF0291E7706B199B5073131C095BE553DD39
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0	data	7DF2BC99079044DFBDBC85F89F8A7A50	43FB440CCFA84A7523E1FCA981892D4E1D7BAEBA	E4B6AF4627CBECA8E3A24E40967A0721955B800B857B7B5F8043D0365E42819E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0	data	08455AA0404A59A44AB9B137BA78B75E	3F9AEB7F526092A8EECE9DF70BD06EDE73872EF2	5A2425C5812059EE2EB5D969C92D58385453F881CB76FBE10AA874DD771DE7ED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0	data	ED8A76440188D20FC6063329C24965B0	4CD89144ACA02B30641566B8E036BEAE09BAFF11	7E96A3A90A731A7306EB91A6DFECAF9AF7168D0991CDBFF0D0E2C006DE765FD7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0	data	11D88A1A3E9470684DEDB8E6376189A5	33A7412399DB5C81550BEC074B851C66A1C99849	B5DF656943F14AB1DD2FD380DF62326C589AEE1CB8EDC42EECF5FFB9ADE822F8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0	data	F1167195846582B5C9A6253BF5C7BB59	549B11FF1264E755EBFC961226DB736FB4FCDD8D	58A4AFA4AEF8F4C036CFDF508E6101C4CFF5FD55E45558F60C63394A924D9E06
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0	data	4CFBF2A8FA9212DC3EA522BF6BA628DB	B550122E573DA6C8CFC689D3C3E964B5166AC59E	579AE38FE0F0B5CC29A626E4E3B59E53A37236E7D636D333EA9D95065B11E86B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0	data	748B268FA219D127CB23DCF56D31AFB9	ED897357B29FC2D1EFA2D06C61FA961C843C1989	05DA71664947C64FF901059F210091FCB0A5E461E3DB80DC1A8812BD36C4A33E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index	data	83885128F010B8581A8B150101FE486F	57BA809A5548CDCF17E60B1C8D8D3A29168FA57C	F36781EE22ABA254A2A77E7E2334DCA6CBE71AF07C82CCF6CAE4E01CF204E7FF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)	data	83885128F010B8581A8B150101FE486F	57BA809A5548CDCF17E60B1C8D8D3A29168FA57C	F36781EE22ABA254A2A77E7E2334DCA6CBE71AF07C82CCF6CAE4E01CF204E7FF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	CD26F3152D31B2B9B5F9FD272F8BC913	5422E1641A468C59E118698E17A75A1A7A6A3581	47F8CCE93ACB02EF6ED8464F14B09BCBE16DF5997485059AC109DB46245EF2E7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	CD26F3152D31B2B9B5F9FD272F8BC913	5422E1641A468C59E118698E17A75A1A7A6A3581	47F8CCE93ACB02EF6ED8464F14B09BCBE16DF5997485059AC109DB46245EF2E7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	E36F8F81D3C03F6AAF7D768706B7673F	EECE93F9E417717892E50F6A159516DD76C255B0	C6E687FF9677244574F37AD2877726DF64E5BAADDA2ABE8C4759BDE8344E44F2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-211205100402Z-190.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32	C76EFEB122456696DEA738A2FCB8D91C	EDF5FE85CF54AE7070E7A2F437E36F3AA3BD441D	6C8CF31E089BBA8B99D94143B3552E6CCC3E0D34542DD38A91015859A77D83AA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3024000	52D0C9862F6046F2D3F67D6C7AF36CDE	0F23BE8A35D5B216A8D853FC3172C1E3C4ED2E51	6CDCBAF96DD484A8E8A22817EC7DF0EA39EC266227080C8833E2E07ECD2FD6AB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	255610EE3E6065529910EBD141F0C093	884F4E9514F1593DDD07705F1BEEDC6BC047A865	1A51554DB44C27B83A97368EA863BA18E29B33A51FEC89418E59D95417E45478
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.5076	PostScript document text	A2C6972A1A9506ACE991068D7AD37098	BF4D2684587CF034BCFC6F74CED551F9E5316440	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)	PostScript document text	A2C6972A1A9506ACE991068D7AD37098	BF4D2684587CF034BCFC6F74CED551F9E5316440	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store	data	C38DB0F968872CB3B1FBF6AE9A0EF9DC	F33A6E1368267704758D324C3170FFEC35A64886	6B804B2E7E3F3F270A809298758697B12697A26846FF9D20E0FBFDC9F64EED8A
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei	data	48B99ACAEC7BCFBDB7F0B4B96B2453B1	BE8AF0C8AF83D943747928B45EBBF44ACDCB374F	D92FEC879C4EAF4D3B887C7FDD0FC602F9C97C0BBA66024E4F280C27DDDFD0A9

Windows Analysis Report 404.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

System Summary:

Hooking and other Techniques for Hiding and Protection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\404.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\404.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=10825893705877279914 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10825893705877279914 --renderer-client-id=2 --mojo-platform-channel-handle=1712 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=2127389532984776761 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=15934386517068702169 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15934386517068702169 --renderer-client-id=4 --mojo-platform-channel-handle=1820 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=5360389963267492183 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5360389963267492183 --renderer-client-id=5 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4148878045607610064 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4148878045607610064 --renderer-client-id=6 --mojo-platform-channel-handle=2976 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\404.pdf	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=10825893705877279914 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10825893705877279914 --renderer-client-id=2 --mojo-platform-channel-handle=1712 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=2127389532984776761 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=15934386517068702169 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15934386517068702169 --renderer-client-id=4 --mojo-platform-channel-handle=1820 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=5360389963267492183 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5360389963267492183 --renderer-client-id=5 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,1793234682510036335,8651460955286290735,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4148878045607610064 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4148878045607610064 --renderer-client-id=6 --mojo-platform-channel-handle=2976 --allow-no-sandbox-job /prefetch:1	Jump to behavior