Windows Analysis Report
Review Document.pdf

Overview

General Information

Sample Name:	Review Document.pdf
Analysis ID:	756144
MD5:	db3d4eea0b2f092a0e3e82d317a11548
SHA1:	9ef2e56b31af6330fc71f1582a30d5ea525b8ef6
SHA256:	96f73cb2b9fa43fbe95e3d5e659a15916114d751db674dec2c9383feea861105
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Yara detected HtmlPhish29

Phishing site detected (based on logo template match)

Phishing site detected (based on image similarity)

No HTML title found

Form action URLs do not match main URL

JA3 SSL client fingerprint seen in connection with other malware

HTML body contains low number of good links

IP address seen in connection with other malware

Classification

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://passatuhenverify.web.app/

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site detected (based on favicon image match)

Source: https://passatuhenverify.web.app/

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match

File source: 56225.0.pages.csv, type: HTML

Yara detected HtmlPhish29

Source: Yara match

File source: 56225.0.pages.csv, type: HTML

Phishing site detected (based on logo template match)

Source: https://passatuhenverify.web.app/

Matcher: Template: microsoft matched

Phishing site detected (based on image similarity)

Source: https://passatuhenverify.web.app/

Matcher: Found strong image similarity, brand: Microsoft image: 56225.0.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD

No HTML title found

Source: https://passatuhenverify.web.app/	HTTP Parser: HTML title missing
Source: https://passatuhenverify.web.app/	HTTP Parser: HTML title missing

Form action URLs do not match main URL

Source: https://passatuhenverify.web.app/	HTTP Parser: Form action: https://fp1.formmail.com/cgi-bin/fm192 web formmail
Source: https://passatuhenverify.web.app/	HTTP Parser: Form action: https://fp1.formmail.com/cgi-bin/fm192 web formmail

HTML body contains low number of good links

Source: https://passatuhenverify.web.app/	HTTP Parser: Number of links: 0
Source: https://passatuhenverify.web.app/	HTTP Parser: Number of links: 0

Source: https://passatuhenverify.web.app/	HTTP Parser: No <meta name="author".. found
Source: https://passatuhenverify.web.app/	HTTP Parser: No <meta name="author".. found

Source: https://passatuhenverify.web.app/	HTTP Parser: No <meta name="copyright".. found
Source: https://passatuhenverify.web.app/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49710 version: TLS 1.2

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 152.199.23.37 152.199.23.37

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: Review Document.pdf

String found in binary or memory: https://passatuhenverify.web.app/)

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown

DNS traffic detected: queries for: passatuhenverify.web.app

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: passatuhenverify.web.appConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://passatuhenverify.web.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://passatuhenverify.web.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://passatuhenverify.web.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net

Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49710 version: TLS 1.2

Source: Review Document.pdf

Initial sample: https://passatuhenverify.web.app/

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Review Document.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://passatuhenverify.web.app/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1784,i,7271988810475612612,8623558977825433660,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://passatuhenverify.web.app/	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1784,i,7271988810475612612,8623558977825433660,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9R15dakyo_kmukxl_3p8.tmp

Jump to behavior

Source: classification engine

Classification label: mal80.phis.winPDF@31/55@9/8

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: Review Document.pdf	Initial sample: PDF keyword /JS count = 0
Source: Review Document.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Review Document.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
199.36.158.100	passatuhenverify.web.app	United States	15169	GOOGLEUS	false
172.217.168.45	accounts.google.com	United States	15169	GOOGLEUS	false
172.217.168.36	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name	IP	Active
cs1100.wpc.omegacdn.net	152.199.23.37	true
accounts.google.com	172.217.168.45	true
www.google.com	172.217.168.36	true
clients.l.google.com	142.250.203.110	true
passatuhenverify.web.app	199.36.158.100	true
clients2.google.com	unknown	unknown
aadcdn.msftauth.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://passatuhenverify.web.app/	false	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	URL Reputation: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://passatuhenverify.web.app/	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false	URL Reputation: safe	unknown

ID:	756144
Product:	CloudBasic
Start time:	17:40:13
Start date:	29.11.2022
Sample:	Review Document.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	db3d4eea0b2f092a0e3e82d317a11548
SHA1:	9ef2e56b31af6330fc71f1582a30d5ea525b8ef6
SHA256:	96f73cb2b9fa43fbe95e3d5e659a15916114d751db674dec2c9383feea861105
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0	data	3B0A59BB2319E5BD4D49EB707E37558E	9E0782ACCA0DEE63B97973044E713D0ED4CA1027	249E2F262B9EB351AC7607FE1378FE89195E11327C45DCC00DC4D94EA8EF937D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0	data	A4292F3AF51F5A5B59069E9EEC984E8B	109961A0CCB4A96F166FAADDE7BF2BB19E1A8720	AC8C9338827A923764148AA4808D27DD4E4C7E9EE4B2506672BE105CF70E040E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0	data	76093E541A9367A9146E1B89CAA61823	0732D2062DCC16D149A7FFE2CC85D35D3F219A73	00C7B5C6CD59B9382B6F446FA9424C4997F5A626EB70731804A43784C6587BA6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0	data	9EF25E78DEE9106AAB8B37B6729C9AF6	CC4823FA53009933DAB156B806340E695B9320E6	C005302E5BABB6C5DA79393AF41FBB2F51D35A6B7CE251DF36D923B988616E40
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0	data	4A80446736B5A856CD92CAFBDB724114	D7C7D67429FB0BECFD25080E2149CCDA9FF15D82	1DCAEBD1AA8FE57B245FE0E7B9D07963E50BF86A0BF598E5B4DF3F068EC43B85
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0	data	C619B4B18CC6604EEADA8981A5389705	73631851F04D367B99DE84A1E1787DEC239B9AA3	E5E0EA6A3F994A10BE2D6AB6E031F998EB86C8EB356A91A519B5A9FB7D66F8FE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0	data	84E95D478576BE020EE6EDBE715E9DAD	3A3AEB49F6D192C181C90E5BBD3B08A0CB3B0058	DBA85D8BD4F2BB219DA843B507EDAA71B18DF449ECA7BB635FA26BF06DFDFB83
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0	data	F4023E790BF2B79A6A6979DD9E27C97A	770C604C33F8C0CFDB2E00D05AC1AACCE4ECAB48	6A94E7C60BDDC09400E46E8ED2EBC725C5FEC1FF9987F8AAB6FE6D5BD6D0BD19
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0	data	7CBA8E291527DB9ED8D5DDB76ED66BB8	EA9835EFD3298FEAC518AA99DFFE5AF978A17F8C	A96EB6833B73AD86FC7D8FF059B7967AE887E4C8A7C9E29993FA7969D0748AA4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0	data	86B2D19DC4EBA789E2F7ED43F1AB593E	B102C626182245436862682E217DEFCBF508BD61	BF84F16A5EFA6193970550C417F426E372C18BD720A5B655C5EF795918895205
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0	data	D94BC358024F969756245E18EC5E4907	875027E1E35C879174DB57CCFC26D0CC8DD98BCE	42F7A395061F165AD94401600A02FA6E9CFD8C9F4E091D6D11509F8E704340E5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0	data	255F045D3E5D8B8375E07B739FCE7C1D	2A6AF3563F3C6B8CBB8E9DE6E8FBEB95ADEC9136	172E03BA2A60C03AEE9652E064BD2752E47C6053B5DA0C253964009BDFDC3FD4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0	data	ECEC6B740576886B882DBB22EC43910D	0BD82E472298D40FDEAF4371DD16375BE0F07584	52DCE85E91D7D3905B4130F796F1A5E6E9BF2777064B83CBD1320515EEEFB287
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0	data	61C319C3CEBDAF0E6010324F0301E7C7	E85FC0161A56D146DDDAE1369967D5F65EA18EB3	267DB833D63999B403997E0B37415847D5A379174B55DF68DCCEB48C278DEF3B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0	data	05840FF0ACDCC7369B09DDD96609DEB7	B9981997C400A5D87C1B32E30060558DCBC31611	4956CDCFF8CAE77F901319035A2374DAE356048C95E95D894C8BB0D632C42A63
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0	data	EE0B21D83AC51D5CAB23668B891A3979	414C4561FB780EA36305F89D36FAA771F4D12327	F697F6C4BB27FF81D853092D0727FC48CC22E82479CBF88CF48D840E1FC4EBF9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0	data	68B00BA52980B4496D13AA8B57CD5624	768F1886C69547016681E38843A45CD6BA2EBDD4	22C23E4C7BFD5D0A0FEFDD7671F4F1556D82B8B5C8CEFED5DF03235CA3E47CAA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0	data	519926718CDE9B7D4D92C458580EBEC6	5FA7B034DCD7E1FABEF17A180557955DA2BA9D2A	E6DDC30E7AFF913BFD613AF985BD2D92226F62A772B6886D81EE8AC0E4EBF86D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0	data	7A6EF1E0889F4329413402ECFA094243	A6AA05061F7A5EFC2965E9D653543E22A373AAB3	5AED4E3A3F41C89B6DB7AAC24705AFFA3700D27C293EE74B170A433DEE662D09
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0	data	0190227310C3948FE724A09A372CCECD	F27EE6D6D8B91FF18F04A8A17348F0F333EBB71D	4D585D322529E48384308C4A41B778879E7ADB92E6F5BF8E92253F9E96ED672B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0	data	F7732E7964A89A05306F1B373577F7C1	A4002EFE3B120F8A2A1B8EDB7EBF2494F49D7922	4A15EA87F17DE0D4D22446529059AC1DBB385CAEEB8C7B60A46442050E5D63FA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0	data	A06108241E7E695892FFB954AD4B3510	C086A26C03C6AC279EB3D7C50AB6A27AA513B4CE	B8143345EC78E5A8A14E5FE58D209E57466DA861E5973CE027D99D7E5E33DA0E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0	data	38A03D3DADAB4B024CC9E3A7BA481795	5479FC09C29AC0018A3DA54D82A4BE865398F3F1	D34683E2A2C73509B0B063B105364BCD90EE1D2868254E54A8ED6A9C77A07880
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0	data	7287F80670EADF0EC5D9C0548793E712	D619E72236523E35E3BCDEBE87A35913FA729214	0DAED56A748C992C3575291A1D46B8C32E83DB37041FF9C1ECB51BEF30C321B9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0	data	E87D0CE4B224E6A5B369C19EB8BEADF3	AC51A4EEDAA67956CA58E7688E48036CDDA244D1	62BC65845E84E9535D3DA9F2EBEE687557F345245D7833E18D1C68C6E6E14063
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0	data	A3DA479DD2E8150A096A50018A0B6FDE	ABD35C1E829E1EA00187E2D3BC66392416B4BB47	A20379CC655FA4C59A2B170921B8EA6FF89614FA9DCCD0EF540BF42EF373FB04
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0	data	842D1F0B1569E92E9F9984547C0B78FB	50BDED4A8AD04E1708731FF5F21D68B7BD39E1AB	2A2171167E19CA61F55A51474930820872FED217B80C81E5A7EC0C9E70CAE344
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0	data	3624CA7DF1190E2712A90062DC977C74	AF1A56DE2F778816077A30A51DCFC56D990B1EF7	64415DA2BC33CF5F078199F8E2C533353D369483D2DDA78CBBEE61580121F6E1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0	data	497261EDD39A490E03280AB884838587	EF56A591F6AB8FEB14B0106204D34036FB20A267	6988731F68D6DC92F0FA8C46BC39EFFEF9735D41A26D688D10F4013AA2116D3D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0	data	86C20E38797BC375CA101CD3729F44B8	CA2A7F11706F63900C37FB8A7DD27227CEFAEB7E	32F021A649B20CF944170D5719E383409432EDF71D5A29A993F77B0B31C0AA6B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0	data	2B059ECF965AF171A4F8E82E85BD16E8	CE01F7F125C20ED241669386F32EDCB93507ECEC	69EE047B9E30536E35C0B271BA71BF769FC2BDC3E69A114793FCCF104382F9AA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0	data	CA6861C33202C08F3FF1096544960A8F	98C7EE4CA9DFB19DB5F70AF2BF2BE3696083406B	AA1CB1F7102132BA6FD9AA895E3B238B8014601142CE693C262847DCF1D1A18F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0	data	C3040F4749C615DBFBF4CB60409B1E9E	B4C71C7EB42857DC03CF6D4B751EB90F0224647A	DFD40D22332FB790814947DBE32FC3D7C5465BC9FFF32C5C8E6203F75B96EA98
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0	data	F00F16FA61B87F7D324E93E66C5E78DC	D4930470B7CF526868967CF00F0F82A511D334D8	7D17912075510C2A62AB7C96A4D01BE48204113AD83CAF9BE2A82B00C8B001A3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0	data	1638B01AB2332458FD0CC96A514ADD16	66AA1752A5C6770E2D735EE001ECBAEA14AFD4C7	53DD226BFCB533CEE0846D37AC80AE23AF6B4D0F9DDE91B88930C9003155DC78
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0	data	4FF146B748CD37CE0DAF0D35C6CC8F64	B082444A56D483E793AF0A5C2FE253F6731FECDB	9EBE769E5ECB3905F77D773F1357FCB09A9258A27061B5048870A6B39480EECA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0	data	B9F9FAA2764A8F8484B6A15821F2E07A	089D56901F44911FFCBC263C6E64C8CC69FDBCCF	8F0993F3A75240A17091411C864960C97D329F81482EC8E55710ECCF53244854
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0	data	84F8E44A4E05A7275BEA8C36AA1ED849	838155F4756912E0FB8AC09C44BB7F660CD2343E	F4DBE17AACDB7FF49D0C33FCC79CB6A3363E79D2338EEE38D47D8FD4908C03CC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0	data	1A25C7E6D1A64978DDE0976F6DE1540C	900B1DD884E58EED9CA29BD331EC1EEFB856F4B2	BE7288317AD4246D0E5B9173814FF3849F16C53FC55281B36401981B0BF87C53
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index	data	201E484F5BD6BEFC51902BC5B26C78D3	F85B7C13F6E9BAF140085B3E08068DBDDB869C54	ABD97E83940DADD68BBC598EFF1002535FCEF24F7E4CE666D3E1123F3FE97D97
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)	data	201E484F5BD6BEFC51902BC5B26C78D3	F85B7C13F6E9BAF140085B3E08068DBDDB869C54	ABD97E83940DADD68BBC598EFF1002535FCEF24F7E4CE666D3E1123F3FE97D97
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF5fc69d.TMP (copy)	data	201E484F5BD6BEFC51902BC5B26C78D3	F85B7C13F6E9BAF140085B3E08068DBDDB869C54	ABD97E83940DADD68BBC598EFF1002535FCEF24F7E4CE666D3E1123F3FE97D97
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	F913CB5A9C30844B96F630AA2530EF0C	0B7DA58B1A97FBDA02C67E5CD4A22F38EF0080DC	6BE27E26B4795E788F551F4174D3520661212016A3B1BAB9CE5A14015DF1D3E4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	F913CB5A9C30844B96F630AA2530EF0C	0B7DA58B1A97FBDA02C67E5CD4A22F38EF0080DC	6BE27E26B4795E788F551F4174D3520661212016A3B1BAB9CE5A14015DF1D3E4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF5f4ab6.TMP (copy)	ASCII text	F913CB5A9C30844B96F630AA2530EF0C	0B7DA58B1A97FBDA02C67E5CD4A22F38EF0080DC	6BE27E26B4795E788F551F4174D3520661212016A3B1BAB9CE5A14015DF1D3E4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	0A339004BCB425813505AE2871E61E20	9BDA040B5589E1B919A259DB212F4CE8E32AAA8F	46828E139BE167C9E36B556EB137571DE93A29930C366CE0666B1385BC106517
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-221129164109Z-201.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	5FC3BB896EF6797EBBA3A491024E35AC	1B3843AA8C0BE8EE828891DECA6904BBB1CEAC8B	A3093C4C5FCF834026B3DF3A0372E8401DC4A418DEF073B53C30A550D8131848
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3024000, file counter 16, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 16	4A1B4B63465F84CE3850CD30CB911EAB	498D9C87835370F086310B9049F26FC2E3D7763B	CA5A1B1CE59C62A34CE74ACEEA1B1ADB31F6DC0431A57CCB5F84D84680B03D45
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	6F7F5AE2331FB1E74ABBE106B2145AF4	0CC8365F650B939DB79D1B0934BEFF9ABF77C16E	7961A2147E2B1CAFFAB2B736D4CD71A4CD9E9276C720E3733115F003A4D313FB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst (copy)	PostScript document text	4D5E3CD969F14362210F0473720C5528	AFD90E9888759B809F78E87D5550B601A288A0A3	79D95D01FDE7FC7C890CD62734A7F203B12A5D44A56D6009D0E43E40D99682AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.4796	PostScript document text	4D5E3CD969F14362210F0473720C5528	AFD90E9888759B809F78E87D5550B601A288A0A3	79D95D01FDE7FC7C890CD62734A7F203B12A5D44A56D6009D0E43E40D99682AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)	PostScript document text	4D5E3CD969F14362210F0473720C5528	AFD90E9888759B809F78E87D5550B601A288A0A3	79D95D01FDE7FC7C890CD62734A7F203B12A5D44A56D6009D0E43E40D99682AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst (copy)	PostScript document text	63B24EA3A13EAC476D6309BB202EF459	89502C393549C20C933E4553F51F74F3DBE085EF	2B4BE0BED267BBD4E4FFFC912A6C7ED6A8D4735DCF9B69FF90F37CDDEF4110EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.4796	PostScript document text	63B24EA3A13EAC476D6309BB202EF459	89502C393549C20C933E4553F51F74F3DBE085EF	2B4BE0BED267BBD4E4FFFC912A6C7ED6A8D4735DCF9B69FF90F37CDDEF4110EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin	data	CA607C33342C998F309E70ACE59E08B8	AF0E7AFE863E5AEDC3ABB8337B0A6CB7F0DB468D	F02CA5FC07B559B5714400386978FFE690866575DC2973B4ADB79428DF060A92

Windows Analysis Report
Review Document.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report Review Document.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
Review Document.pdf