Windows Analysis Report
FFL 01 EXP 09-01-23.pdf

Overview

General Information

Sample Name:	FFL 01 EXP 09-01-23.pdf
Analysis ID:	612099
MD5:	1ab270f7ac3a8d224acbced342aaa036
SHA1:	892d8a649e2766e828d5d199154742c470feb695
SHA256:	1452bc811a129bacb51f0161c982506f61b71ffb1880256ce32d43ee40af052b
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R1ai6iao_1terioa_4zg.tmp

Jump to behavior

Source: classification engine

Classification label: clean0.winPDF@15/50@0/1

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: FFL 01 EXP 09-01-23.pdf

Joe Sandbox Cloud Basic: Detection: clean Score: 2

Perma Link

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: FFL 01 EXP 09-01-23.pdf	Initial sample: PDF keyword /JS count = 0
Source: FFL 01 EXP 09-01-23.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: FFL 01 EXP 09-01-23.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1

ID:	612099
Product:	CloudBasic
Start time:	15:12:33
Start date:	20.04.2022
Sample:	FFL 01 EXP 09-01-23.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	1ab270f7ac3a8d224acbced342aaa036
SHA1:	892d8a649e2766e828d5d199154742c470feb695
SHA256:	1452bc811a129bacb51f0161c982506f61b71ffb1880256ce32d43ee40af052b
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0	data	E7B713E118C37EB8B535A24B313232FA	FDFBE199FB0D8AD32DB8182BAFCCB86151FBD48C	983570D5221E2A86D308926B401B2744131B6FFC156C4672B7D1848AAD7EBA4A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0	data	92FDBFF85FCBC1F9A51D0F566CE4D395	CBA01C28C87947BD66840A68811CC5211004E9EB	F0D3394506D5AD149FEFB34DF4EFC718FAAF29E445EDFE12F5851F4E043ACA8E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0	data	F7D61A0E4E7D4DA14399DCB2948B48B6	E17C7DB9BF80BF787FF1D8CEB750BD7693267E62	81CEC40B3506CDD0B82698D3CB97F729DC2CE676567EABAAF0A39DD364632F7D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0	data	833E0A3A82D70D85E490E1967DD9522B	F66652F7D39C3197E50A2C6671DCA78CA810C5E6	80CD515F6F83E1F4D9530256EB62F862A1F5FA85D09F5D8D9035FB29BF4A6680
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0	data	AD5D5B460DC5E98DEB0135A0B7854F4C	9EE687A21F84FB50BCF6F4E675F9B113B4551736	480485968452B00B6392CBFE526D69A81E75D6C38D23F1BCAD24B8C085084A32
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0	data	60A16133E8495523ACB38AA511DFACC5	0EA505E4009461B3F0860D82D29DA6C9012CF17A	55434050B86EC693D237803F5C93F63D45555A3559CCEEE82C9FE94A789A9CE1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0	data	53DF756972A42983ECB9C119FAF1D43E	38F126E1A5FB5DA738E7275D51727EA391F5F0B4	DEE17A272ACD6DBCEBB36DAF6981A4013E2CC01D61C4341A83062C2C55B4D43F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0	data	AAA7789F22456CC1188E3231DABDDCA1	13BAA5B6A98E24420F7FC06B02C941C9E22FCC66	4CB47B3995248EB5FE72B3E611693DD1DFD44E27245AA19B1FFFCCE339E69EEC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0	data	14D0FC581B48397E508E62B15F2D059D	CB2B39D4353B8ED77FF7435FF212CC774E248E68	F52A36B10C467997ECAD632B4A06E5F71B6AF7AFA7D79492833C80C2DAA6A8CC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0	data	B1B223DDF2521C143A174F6B384009CA	61230D1A5CAA4161F459FD4951AB4191E1F76DBE	3ED6F6C00A6F5D5A8E2AA099758FFA76A4524E770D9F2A01D232ABC9A454832B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0	data	1D7769221087AC3D4C4A11DA9748C1B3	FF799EA716A1A8770A94D00C99711B2DC286C27C	313EC4E18B860F6B3394EDAE6C61994CC7D12FE3A6FA7C8273CA0A8251126722
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0	data	9F12FD941D9B035A28BF7FFCBA463C33	71440FB30442BA380E3294F29B5C2F5A9A7D6C67	1CFB46412F07990D68D3E43F3C4FA122583D5297990CD273C0264ED449780B50
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0	data	8E024E6D13D74A33745D979B21F825AD	7BBAEDEF7E59EE2A605A0423EC766400D7D24C57	B18303F99B605FC64FC63B01CCF66AA8F28552D6DB22DFFDB8B81BD5E10A6F0D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0	data	2BFC8DFA0684D4F688703FFD3B15FA3C	E625C8415686DE9682F0F02541D6B3BBD0F9065F	BDC594E8B2837AD06EF3315336D796D27CF5F782046E790F7298B4B3FB33E37D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0	data	8247E8767DD86DBB28AE4C35D32EC23E	29D736EDC5C18ECF331FF96B804225D3595BFDF4	2673A96AA2EB42376FB86D347298B8E5A7DB71CD0BF1CF42F2851017B1D6ACEB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0	data	7A1E6E6BB8DAE88546285075F710B435	55680E878A2B894D42A27AA7652E6006D1F00625	8A0FAAC4F19E5082ED41DB41CE051B8E69471FB6C0C0AC995D0E14EA78C480EB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0	data	D2A51127F813915F83EC490E7F3AAF9A	53B6F4D0975C7ECB266771DB4B272CCD7517F9E3	B1597631B29D837C5EB934CD98B98D07089D9C9F998325D3EE42C67BC1F91E17
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0	data	A924F101CC67E2C523440C698EFB9EBE	C643022B3FCFC0EC0DFA1899C4929E6B82B74372	B1FCCE3EFC5657DECE4DDBFB7EB68409A34E5FCA05B74DEECA10BE3E40433E5C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0	data	38034640001517C06E0200A6320C0660	C2F8A18BCBB1EDDC7168E4982629B28838257DC8	0357FDA69E390FA43872088BFAA3D465A8F27A2F6C0EB3B365F2B76CE368C5D7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0	data	08ADDDAD86A0DE9329C459123476DDC1	19A04DA3A7EB074B6E1497693CA3E24A2CF71846	7A683C3D7807B951AD968800CB4E36EDB01CB68C01B1F12D7905C6C8936CDCF1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0	data	4B615F95B3280764FD65DB23FA8332FB	BDA895FBC269B4160CA7111FAEA21D14825F1D5F	9E228912FF209DAB352806F483092407702834AEA940AF006AC8C6F0E2FD0E3C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0	data	26BFE8B502990E8D6434685342955B43	70538E5E05753CF8F9024702F16BE42ACC5E6A93	8DE766971557FF4B2CDAA24A86E28F8C3394AF78D69EC891933089A90E1687E7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0	data	CEB3941283A55F09EF3FBC354AB05559	580709D6CED19AE9E7B295E2E58E08F2A9A0140D	9F45FC3E9E6A860522BB886C9D1DF10BF9B5B4C3E45130C5CBCC20715057F937
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0	data	D4EBE1814C32F4C4EEE2895D33764AE9	24CF1A84B78A5BA88B36144052FE9478BC84AC4F	17D42486E9186BD835D06600086C163E184DD4D2093659B4E37A199EAC2899A9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0	data	15578233663F668625157B329E6EA2DD	ABB4304DA409C172B6AB8B2EE6FF1E792D907C7F	2F615774B4D0C66FAEC5F194D0D5B5ECB5C681D9723D618331703A87219CD423
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0	data	B3E6AABD3EF08E2961FC001A7AEE3D9D	F358253DCD71AC9B78070F36FD6CC003582D3919	BC54986DABCCE48FBC7FCAFD5336D1F462D30DF7CD65A73521F13572E312B871
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0	data	75C0B090F108D18C199BA0AE51C4C5CC	422CD096876906220BF2603249754D30A14147D5	F6D4A3DDFCFA0A62587EF8CDBB1E6FBD75BC4455D162A7E8E296E16ECE88C5D4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0	data	B1E5846A137696F9ACBD4327ECBBD136	045091258D27967BEA9F82915B9A8370BF009342	DC21E2D14989F3090CF7A56FE700AA7D743C2EEE9EE52D9C4CD70EAEE296BDE0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0	data	13CB3B34C865F9880600972F6F5FEF43	BB6E5BF88A27AFAE4B11ABDF2FA3036BEDA6F2F1	3F04C59B6B3DC94321E0156CCB0D3E5D38231CCAC80046542E06BF274B4622DD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0	data	20647C6995457871B6A466A333BB44E8	8DB187A0AB9DD386CA16A52A3D57AAD1B264765B	CE944901058C34E1EE3C716FFFA2C926E5F140A2681B44B6E3B4C9B1ACE9FD54
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0	data	BC6E6B833F8CCCEC19835FA5DC05FA02	DAFC73F35F1D7C55416564AEDA8BFAC8D5C45632	D21CC7670C5A92B6D756AE535B898305058FED9A98C54269C4B2FA72AD13B515
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0	data	E88CEF281EA20B166BDD1A5B6DE38CA5	5D327F8049F87029591C26D580E1D71226B8C94C	7AD25155D39AFA5DD6CBF58CB101E39199845A5F350CB1A30C8DC62DAF813554
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0	data	7612800B28CA985FE92DCE777CED49C5	720F033F1C9066992360D04B4598119E66518075	41A28FE82AD85F46C49D4F9943B3EF94847249CED7EE5149026FD0B714E26873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0	data	C78DB27DB2030FC685324638CC149A0D	9E561E86444985273B414694722FB53E99250C8D	CDF48906318449915070327557EAF5B5884CA4B7EB53BBA52CE0F31E3C64D182
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0	data	20BA1175E0C49F013D37B9A75F9BE97D	75784CB0BF3CA56BE745AAE39854276550E06334	39132D3D86FF02329DDB291B53445410B3765AFAF4B729E86C3FAAA2B9D635FB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0	data	797486BD5CF8492F0FB8D9C347BF9669	34494BFF44BA8AB4E4376D8B8892C594076A12A1	14E06A47BCE78C20A8BE9FB547283306FEE474AD3A823420797A595721CE0A1A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0	data	A8E2764CB88EC98295B94DD59C83BC16	B6FD0A19D8C60134016F886EE8B61F1F14E89B45	E5135695F6EC30D41DDC765D4AA2B3F5162582F13B479EEFBCE85100F1FD959B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0	data	F4649F52F8DF4C16531F7AF2D6D5BD26	6D54658D27D573D889EE5C9BB5A873775B8D2916	DDF603CBE76806ACEE2E6FCE34E6191F9C94754E07EACCDE6F45504E9FFAF018
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0	data	F89B2CC4EFE00EC714C94B29211E8518	8331D386217EEE9B7ABF6FD692CB0FE7DD57C032	5DA9B06CE1BC23795190C789EDB9610FE30BD4A0F4AFF77BB64227AECAD9B2FE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index	data	9B90244F9985CBA4985897217DD7C7AB	9BC5919E96D2A3CE20322AADC162056A6B6FE7EC	E44D4707C1D938DE3374B96940F3B6AB183AEEDDFC92C1B25617C57337E95941
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)	data	9B90244F9985CBA4985897217DD7C7AB	9BC5919E96D2A3CE20322AADC162056A6B6FE7EC	E44D4707C1D938DE3374B96940F3B6AB183AEEDDFC92C1B25617C57337E95941
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	0EFA5FD57DCE06939345B459EADB80A3	C15C7FACFC2BE05DCE14B6C51F9622F62FF6BD65	1C439D7D00DD1E33BD6C40550224B34E32F56534C5DB864290898F872DD65867
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	0EFA5FD57DCE06939345B459EADB80A3	C15C7FACFC2BE05DCE14B6C51F9622F62FF6BD65	1C439D7D00DD1E33BD6C40550224B34E32F56534C5DB864290898F872DD65867
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	6ABF41DD4C73D60E4EE0BC302380FF61	98728D541712597763CBF6095060D35B40458E6C	FA8AFA872E00F6E06A1ACE8A9B23124370BED970A87E4F97C78791A96D36FE32
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-220420233817Z-213.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32	B1800B3207FD260F85FB2C0F7DBD9AAC	B90FD8EF217FFFE79D0B74C2FA8D6E382FA8DE3F	30787C8915BE24FCC466BA18BB713962BAB4A6A1FB73468C2D5B5F441E9141D2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3024000	911BB650E47850AADEF326826011CB88	D4727CA3F0D76295B1E3AB1E807EBF0301E11DAA	D9726D6BE56F4F34CF3E404A37E2FB3B501EE0136CDE6B7DAA8530C079C3CFB2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	FBEDE9693928B18FF80CA0DE1F45EF5C	15F257A390000B7DCF0F9FAC20AF8CF5AB0B08DB	B1AD402F7020886D44634D6A06FAB5CDE3D4AB399256303266523FCF673D80AB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.6460	PostScript document text	A2C6972A1A9506ACE991068D7AD37098	BF4D2684587CF034BCFC6F74CED551F9E5316440	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)	PostScript document text	A2C6972A1A9506ACE991068D7AD37098	BF4D2684587CF034BCFC6F74CED551F9E5316440	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65

Windows Analysis Report
FFL 01 EXP 09-01-23.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\FFL 01 EXP 09-01-23.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\FFL 01 EXP 09-01-23.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=7054524493282448139 --mojo-platform-channel-handle=1704 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=3437087714133067519 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3437087714133067519 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=3988524340413199970 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3988524340413199970 --renderer-client-id=4 --mojo-platform-channel-handle=1820 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=10726486129092804403 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10726486129092804403 --renderer-client-id=5 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4353246954609320378 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4353246954609320378 --renderer-client-id=6 --mojo-platform-channel-handle=1964 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 "C:\Users\user\Desktop\FFL 01 EXP 09-01-23.pdf	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=7054524493282448139 --mojo-platform-channel-handle=1704 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=3437087714133067519 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3437087714133067519 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=3988524340413199970 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3988524340413199970 --renderer-client-id=4 --mojo-platform-channel-handle=1820 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=10726486129092804403 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10726486129092804403 --renderer-client-id=5 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1692,15095255467343264,15953424090873945641,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4353246954609320378 --lang=en-US --disable-pack-loading --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.12.20035 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4353246954609320378 --renderer-client-id=6 --mojo-platform-channel-handle=1964 --allow-no-sandbox-job /prefetch:1	Jump to behavior

Windows Analysis Report FFL 01 EXP 09-01-23.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Windows Analysis Report
FFL 01 EXP 09-01-23.pdf