Windows Analysis Report New PO 78564.pdf

Phishing:

Phishing site detected (based on shot template match)

Source: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html

Matcher: Template: office matched

Yara detected HtmlPhish10

Source: Yara match

File source: 44581.0.pages.csv, type: HTML

Yara detected HtmlPhish7

Source: Yara match

File source: 44581.0.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: embedded	Matcher: Found strong image similarity, brand: Microsoft image: 44581.0.img.2.gfk.csv C3FC46C5799C76F9107504028F39190F
Source: embedded	Matcher: Found strong image similarity, brand: Microsoft image: 44581.0.img.3.gfk.csv FE22440D79FFA34950F512EF4A718B2A

No HTML title found

Source: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html	HTTP Parser: HTML title missing
Source: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html	HTTP Parser: HTML title missing

HTML body contains low number of good links

Source: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html	HTTP Parser: Number of links: 0
Source: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html	HTTP Parser: Number of links: 0

META author tag missing

Source: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html	HTTP Parser: No <meta name="author".. found
Source: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html	HTTP Parser: No <meta name="copyright".. found
Source: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html	HTTP Parser: No <meta name="copyright".. found

Software Vulnerabilities:

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.4:49824 -> 142.250.181.238:443

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: glitch.me

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.4:49824 -> 142.250.181.238:443

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 11:53:31 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 14 Jan 2022 11:53:32 GMTContent-Type: image/pngContent-Length: 1157Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 11:53:32 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 11:53:33 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0

URLs found in memory or binary data

Source: angular.js.21.dr	String found in binary or memory: http://angularjs.org
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: angular.js.21.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: AcroRd32.exe, 00000001.00000000.876002852.000000000AFD7000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.comYou
Source: data_2.22.dr	String found in binary or memory: http://glitch.com/help
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/m#vC
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/V
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/3
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#:
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/4n
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/n
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: AcroRd32.exe, 00000001.00000000.876002852.000000000AFD7000.00000004.00000001.sdmp	String found in binary or memory: http://www.microsoft.ct
Source: AcroRd32.exe, 00000001.00000000.863507875.000000000AF0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: AcroRd32.exe, 00000001.00000000.876338941.000000000B20E000.00000004.00000001.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: AcroRd32.exe, 00000001.00000000.864201270.000000000B04F000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/
Source: AcroRd32.exe, 00000001.00000000.864201270.000000000B04F000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/4y
Source: AcroRd32.exe, 00000001.00000000.876002852.000000000AFD7000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/
Source: AcroRd32.exe, 00000001.00000000.876002852.000000000AFD7000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/4
Source: AcroRd32.exe, 00000001.00000000.876002852.000000000AFD7000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/Jq
Source: Reporting and NEL.22.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=6zUX3j1MbdTprOP9saoPUxJO7HAkS00cUOoZeSByQ2Z9vwZlYw5mPm%2F7X
Source: Reporting and NEL.22.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=eaBVLAkni1zPwuiUvTdOCmFgQ9QfTfBNlf9pPr%2FQuS4WQ4oHbsbaikMR2
Source: manifest.json0.21.dr, c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.21.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr	String found in binary or memory: https://ajax.googleapis.com
Source: data_1.22.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: AcroRd32.exe, 00000001.00000000.868054592.000000000CC38000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.881040798.000000000CC38000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.854586976.000000000CC38000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.873430385.000000000906E000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com
Source: AcroRd32.exe, 00000001.00000000.868054592.000000000CC38000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.881040798.000000000CC38000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.854586976.000000000CC38000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.comFamilyN
Source: AcroRd32.exe, 00000001.00000000.873430385.000000000906E000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.comK
Source: AcroRd32.exe, 00000001.00000000.873430385.000000000906E000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.comW
Source: manifest.json0.21.dr, c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.21.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: mirroring_common.js.21.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: data_2.22.dr	String found in binary or memory: https://cdn.glitch.com/d7f4f279-e13b-4330-8422-00b2d9211424%2FGlitch-Error-Rainbow-Mug-hires.png?v=1
Source: data_1.22.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: data_1.22.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.21.dr, manifest.json.21.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://clients6.google.com
Source: data_2.22.dr	String found in binary or memory: https://cloud.webtype.com/css/3a8e55c6-b1f3-4659-99eb-125ae72bd084.css
Source: data_1.22.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: data_1.22.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js&
Source: data_1.22.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.22.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCSr7J0iEC-WnEgk
Source: manifest.json0.21.dr	String found in binary or memory: https://content.googleapis.com
Source: common.js.21.dr, mirroring_cast_streaming.js.21.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.22.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.22.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Opener-Policy:
Source: data_3.22.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 0c8dca69-2ac9-473d-9d4b-1b60d291aa95.tmp.22.dr, 8e953aa0-d90c-473b-ad17-0f636d0729ab.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.21.dr	String found in binary or memory: https://docs.google.com
Source: data_1.22.dr	String found in binary or memory: https://earthy-unruly-shroud.glitch.me/css/hover.css
Source: data_1.22.dr	String found in binary or memory: https://earthy-unruly-shroud.glitch.me/css/hover.css/
Source: data_1.22.dr	String found in binary or memory: https://earthy-unruly-shroud.glitch.me/favicon.ico
Source: data_1.22.dr	String found in binary or memory: https://earthy-unruly-shroud.glitch.me/favicon.icoChIKBw2DqFs9GgAKBw3OQUx6GgA=D
Source: Current Session.21.dr, History.21.dr, data_1.22.dr	String found in binary or memory: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html
Source: History Provider Cache.21.dr	String found in binary or memory: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html2
Source: data_1.22.dr	String found in binary or memory: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.htmlM
Source: History.21.dr	String found in binary or memory: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.htmlShare
Source: manifest.json0.21.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://fonts.googleapis.com
Source: data_1.22.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: manifest.json0.21.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://fonts.gstatic.com
Source: data_1.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v11/OZpGg_pnoDtINPfRIlLohlvHwQ.woff2)
Source: manifest.json0.21.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.21.dr, material_css_min.css.21.dr	String found in binary or memory: https://github.com/angular/material
Source: craw_background.js.21.dr, craw_window.js.21.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: data_2.22.dr	String found in binary or memory: https://glitch.com
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json0.21.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_1.22.dr	String found in binary or memory: https://i.ibb.co/1Rvzzk8/gmail1.png
Source: AcroRd32.exe, 00000001.00000000.885715185.0000000009095000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: data_3.22.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: data_1.22.dr	String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
Source: data_1.22.dr	String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
Source: data_3.22.dr	String found in binary or memory: https://kit.fontawesome.com
Source: data_1.22.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: data_1.22.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.jsa
Source: data_1.22.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: data_1.22.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: mirroring_common.js.21.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.21.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://ogs.google.com
Source: manifest.json.21.dr, craw_window.js.21.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.21.dr, craw_window.js.21.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://ssl.gstatic.com
Source: messages.json18.21.dr, messages.json86.21.dr, messages.json15.21.dr, messages.json26.21.dr, messages.json84.21.dr, messages.json11.21.dr, messages.json87.21.dr, messages.json22.21.dr, messages.json9.21.dr, feedback.html.21.dr, messages.json25.21.dr, messages.json16.21.dr, messages.json24.21.dr, messages.json0.21.dr, messages.json5.21.dr, messages.json76.21.dr, messages.json74.21.dr, messages.json79.21.dr, messages.json75.21.dr, messages.json21.21.dr, messages.json3.21.dr, messages.json23.21.dr, messages.json20.21.dr, messages.json12.21.dr, messages.json72.21.dr, messages.json83.21.dr, messages.json69.21.dr, messages.json8.21.dr, messages.json73.21.dr, messages.json82.21.dr, messages.json19.21.dr, messages.json14.21.dr, messages.json77.21.dr, messages.json71.21.dr, messages.json13.21.dr, messages.json80.21.dr, messages.json6.21.dr, messages.json10.21.dr, messages.json88.21.dr, messages.json.21.dr, messages.json17.21.dr, messages.json28.21.dr, messages.json81.21.dr, messages.json7.21.dr, messages.json85.21.dr, messages.json27.21.dr, messages.json4.21.dr, messages.json70.21.dr, messages.json78.21.dr, messages.json2.21.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json18.21.dr, messages.json86.21.dr, messages.json15.21.dr, messages.json26.21.dr, messages.json84.21.dr, messages.json11.21.dr, messages.json87.21.dr, messages.json22.21.dr, messages.json9.21.dr, feedback.html.21.dr, messages.json25.21.dr, messages.json16.21.dr, messages.json24.21.dr, messages.json0.21.dr, messages.json5.21.dr, messages.json76.21.dr, messages.json74.21.dr, messages.json79.21.dr, messages.json75.21.dr, messages.json21.21.dr, messages.json3.21.dr, messages.json23.21.dr, messages.json20.21.dr, messages.json12.21.dr, messages.json72.21.dr, messages.json83.21.dr, messages.json69.21.dr, messages.json8.21.dr, messages.json73.21.dr, messages.json82.21.dr, messages.json19.21.dr, messages.json14.21.dr, messages.json77.21.dr, messages.json71.21.dr, messages.json13.21.dr, messages.json80.21.dr, messages.json6.21.dr, messages.json10.21.dr, messages.json88.21.dr, messages.json.21.dr, messages.json17.21.dr, messages.json28.21.dr, messages.json81.21.dr, messages.json7.21.dr, messages.json85.21.dr, messages.json27.21.dr, messages.json4.21.dr, messages.json70.21.dr, messages.json78.21.dr, messages.json2.21.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_background.js.21.dr, craw_window.js.21.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: manifest.json0.21.dr, c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.21.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.21.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.21.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.21.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.21.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.21.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.21.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.21.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json0.21.dr	String found in binary or memory: https://www.google.com;
Source: craw_background.js.21.dr, c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, craw_window.js.21.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.21.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.21.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.21.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.21.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.21.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.21.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.21.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.21.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.21.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.21.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.21.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.21.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.21.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.21.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: c596389c-bbec-4329-a09a-f0ad144063e4.tmp.22.dr, 8a887c47-7ff1-4c66-8d44-ea5697258593.tmp.22.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.21.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json0.21.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: glitch.me

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /ikowthlodisgoods.html HTTP/1.1Host: earthy-unruly-shroud.glitch.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: earthy-unruly-shroud.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://earthy-unruly-shroud.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://earthy-unruly-shroud.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://earthy-unruly-shroud.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /1Rvzzk8/gmail1.png HTTP/1.1Host: i.ibb.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: earthy-unruly-shroud.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: earthy-unruly-shroud.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

System Summary:

Found potential malicious PDF (bad image similarity)

Source: New PO 78564.pdf

Static PDF information: Image stream: 9

Spawns processes

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\New PO 78564.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\New PO 78564.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,5061237570470507330,1302540807075552552,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=10647192645561366624 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10647192645561366624 --renderer-client-id=2 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1700,5061237570470507330,1302540807075552552,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=3375098944914061431 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,5061237570470507330,1302540807075552552,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=7153951524109278611 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7153951524109278611 --renderer-client-id=4 --mojo-platform-channel-handle=1840 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,5061237570470507330,1302540807075552552,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=13048974976482622221 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13048974976482622221 --renderer-client-id=5 --mojo-platform-channel-handle=2104 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,6196045898229528868,2002575593491885482,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\New PO 78564.pdf			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://earthy-unruly-shroud.glitch.me/ikowthlodisgoods.html			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,5061237570470507330,1302540807075552552,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=10647192645561366624 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10647192645561366624 --renderer-client-id=2 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1700,5061237570470507330,1302540807075552552,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=3375098944914061431 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,5061237570470507330,1302540807075552552,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=7153951524109278611 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7153951524109278611 --renderer-client-id=4 --mojo-platform-channel-handle=1840 --allow-no-sandbox-job /prefetch:1			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1700,5061237570470507330,1302540807075552552,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=13048974976482622221 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13048974976482622221 --renderer-client-id=5 --mojo-platform-channel-handle=2104 --allow-no-sandbox-job /prefetch:1			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,6196045898229528868,2002575593491885482,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the user directory

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Creates temporary files

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9Rmiqugx_184tvt1_4is.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal76.phis.winPDF@44/292@12/11

Reads ini files

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Users\desktop.ini

Jump to behavior

SQL strings found in memory and binary data

Source: AcroRd32.exe, 00000001.00000000.864201270.000000000B04F000.00000004.00000001.sdmp

Binary or memory string: SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND ( name = 'IPMMessage' OR name ='GlobalState' OR name ='MsgAssetMap' OR name ='MessageProperties' OR name ='ControlMessages');

Uses Rich Edit Controls

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PDF has a JavaScript or JS counter value indicative of goodware

Source: New PO 78564.pdf	Initial sample: PDF keyword /JS count = 0
Source: New PO 78564.pdf	Initial sample: PDF keyword /JavaScript count = 0

PDF has an endstream counter value indicative of goodware

Source: New PO 78564.pdf

Initial sample: PDF keyword endstream count = 439

PDF has an EmbeddedFile counter value indicative of goodware

Source: New PO 78564.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

PDF has an endobj counter value indicative of goodware

Source: New PO 78564.pdf

Initial sample: PDF keyword endobj count = 444

PDF has a stream counter value indicative of goodware

Source: New PO 78564.pdf

Initial sample: PDF keyword stream count = 439

PDF has an obj counter value indicative of goodware

Source: New PO 78564.pdf

Initial sample: PDF keyword obj count = 444

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: AcroRd32.exe, 00000001.00000000.867872530.000000000CAF5000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.880890711.000000000CAF5000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: AcroRd32.exe, 00000001.00000000.884903989.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.859148826.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.844454636.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.872269329.0000000005670000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: AcroRd32.exe, 00000001.00000000.884903989.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.859148826.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.844454636.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.872269329.0000000005670000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: AcroRd32.exe, 00000001.00000000.884903989.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.859148826.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.844454636.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.872269329.0000000005670000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: AcroRd32.exe, 00000001.00000000.884903989.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.859148826.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.844454636.0000000005670000.00000002.00020000.sdmp, AcroRd32.exe, 00000001.00000000.872269329.0000000005670000.00000002.00020000.sdmp	Binary or memory string: Progmanlock