ID: Sample Name: sentenza berwind.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 21:41:19 Date: 11/04/2018 Version: 22.0.

Size: px

Start display at page:

Download "ID: Sample Name: sentenza berwind.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 21:41:19 Date: 11/04/2018 Version: 22.0."

Felicia Pope
5 years ago
Views:

ID: 54234 Sample Name: sentenza berwind.

1 ID: Sample Name: sentenza berwind.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 21:41:19 Date: 11/04/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Software Vulnerabilities: Networking: Stealing of Sensitive Information: Persistence and Installation Behavior: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PDF Info General Keywords Statistics Network Behavior Network Port Distribution TCP Packets UDP Packets Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Code Manipulations Statistics Behavior System Behavior Analysis Process: AcroRd32.exe PID: 3508 Parent PID: 3024 General File Activities File Created Registry Activities Key Created Key Value Created Analysis Process: AcroRd32.exe PID: 3576 Parent PID: 3508 General File Activities File Created File Deleted Registry Activities Analysis Process: AdobeCollabSync.exe PID: 3676 Parent PID: 3508 General File Activities File Created File Deleted File Moved File Written File Read Registry Activities Key Created Analysis Process: AdobeCollabSync.exe PID: 3828 Parent PID: 3508 General Analysis Process: RdrCEF.exe PID: 2736 Parent PID: 3508 General File Activities File Written File Read Registry Activities Analysis Process: RdrCEF.exe PID: 2072 Parent PID: 2736 General File Activities Analysis Process: RdrCEF.exe PID: 2352 Parent PID: 2736 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 76

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 21:41:19 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 5m 19s light sentenza berwind.pdf defaultwindowspdfcookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 11 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout SUS sus23.winpdf@13/35@1/3 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Cookbook Comments: Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.pdf Found PDF document Simulate clicks Security Warning found Click Allow Close Viewer Warnings: Show All Exclude process from analysis (whitelisted): WmiPrvSE.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 76

Strategy Score Range Reporting Detection Threshold 23

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold true Classification Copyright Joe Security LLC 2018 Page 5 of 76

Ransomware Miner Spreading malicious malicious malicious Evader Phishing

Trojan / Bot Adware Analysis Advice No malicious behavior found, analyze the

Sandbox has not found any clickable buttons, likely more UI automation may

Sensitive Information Stealing and Installation Behavior Persistence Summary

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice No malicious behavior found, analyze the document also on other version of Office / Acrobat Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Signature Overview Vulnerabilities Software Networking of Sensitive Information Stealing and Installation Behavior Persistence Summary System / PFW / Operating System Protection Evasion HIPS Anti Debugging Copyright Joe Security LLC 2018 Page 6 of 76

7 Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section Software Vulnerabilities: Potential document exploit detected (unknown TCP traffic) Networking: Uses a known web browser user agent for HTTP communication Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Stealing of Sensitive Information: Steals Internet Explorer cookies Persistence and Installation Behavior: Drops files with a non-matching file extension (content does not match file extension) System Summary: Contains functionality to call native functions Reads the hosts file Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies SQL strings found in memory and binary data Sample is known by Antivirus (Virustotal or Metascan) Spawns processes Uses an in-process (OLE) Automation server Uses Rich Edit Controls Found graphical window changes (likely an installer) Binary contains paths to debug symbols PDF has a JavaScript or JS counter value indicative for goodware PDF has a Page (number of pages) counter value indicative for goodware PDF has a startxref counter value indicative for goodware Copyright Joe Security LLC 2018 Page 7 of 76

PDF has a stream counter value indicative for goodware PDF has an AcroForm (Acrobat forms) counter value indicative for goodware PDF has an EmbeddedFile counter value indicative for goodware PDF has

8 PDF has a stream counter value indicative for goodware PDF has an AcroForm (Acrobat forms) counter value indicative for goodware PDF has an EmbeddedFile counter value indicative for goodware PDF has an endobj counter value indicative for goodware PDF has an obj counter value indicative for goodware HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Queries the cryptographic machine GUID Behavior Graph Hide Legend Behavior Graph ID: Sample: sentenza berwind.pdf Startdate: 11/04/2018 Architecture: WINDOWS Score: 23 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Drops files with a non-matching file extension (content does not match file extension) Number of created Files started Visual Basic Delphi AcroRd32.exe Java 9 31.Net C# or VB.NET started started started started C, C++ or other language AdobeCollabSync.exe RdrCEF.exe AcroRd32.exe Is malicious AdobeCollabSync.exe , 53, GOOGLE-GoogleIncUS United States trustlist.adobe.com , 49164, 49165, 80 AKAMAI-LONGB European Union dropped dropped dropped dropped unknown unknown started started C:\Users\...\tl12[1].acrobatsecuritysettings, PDF C:\...\eutl12[1].acrobatsecuritysettings, PDF C:\Users\user\AppData\...\download-19, PDF C:\Users\user\AppData\...\download-18, PDF RdrCEF.exe RdrCEF.exe Copyright Joe Security LLC 2018 Page 8 of 76

9 Simulations Behavior and APIs Time Type Description 21:41:45 API Interceptor 153x Sleep call for process: AcroRd32.exe modified 21:42:34 API Interceptor 436x Sleep call for process: AdobeCollabSync.exe modified 21:43:03 API Interceptor 1x Sleep call for process: RdrCEF.exe modified Antivirus Detection Initial Sample Detection Scanner Label Link sentenza berwind.pdf 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link trustlist.adobe.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs Copyright Joe Security LLC 2018 Page 9 of 76

No context Domains Match Associated Sample Name / URL SHA 256 Detection Link Context trustlist.adobe.com 2018 Template.pdf 556202d83b4929b8597b3732db9 malicious Browse 2.19.65.

10 No context Domains Match Associated Sample Name / URL SHA 256 Detection Link Context trustlist.adobe.com 2018 Template.pdf d83b4929b8597b3732db9 malicious Browse c477630d8f45703a13dbdd2b80 e fd ASN Match AKAMAI-LONGB Associated Sample Name / URL SHA 256 Detection Link Context arationlist.com/orei dunu/alaanu/index.php malicious Browse malicious Browse Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 10 of 76

11 Startup System is w7 AcroRd32.exe (PID: 3508 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\sentenza berwind.pdf' MD5: CB6643A25A7ACF3DDEEF0B94DFE17A01) AcroRd32.exe (PID: 3576 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer 'C:\Users\user\Desktop\sentenza berwind.pdf' MD5: CB6643A25A7ACF3DDEEF0B94DFE17A01) AdobeCollabSync.exe (PID: 3676 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe' -c MD5: A12401E177E869FB3C24902E489C9A63) AdobeCollabSync.exe (PID: 3828 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe' -c MD5: A12401E177E869FB3C24902E489C9A63) RdrCEF.exe (PID: 2736 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor= MD5: 7AFD03A53C1FE02E04974C9D99B1CF67) RdrCEF.exe (PID: 2072 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --primordial-pipe-token=f3ab593cad E700171CFB7D4C5 --lang=en-us --lang=en-us --log-file='c:\program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --productversion='readerservices/ Chrome/ ' --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image -texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0, 3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3 553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,35 53;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;4,0,3553;4,1,3553;4,2,3553;4,3,355 3;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15, disable-accelerated-video-decode --disable-webrtchw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=f3ab593cad e700171cfb7d4c5 --renderer-client-id=2 --mojo-platform-channelhandle= allow-no-sandbox-job /prefetch:1 MD5: 7AFD03A53C1FE02E04974C9D99B1CF67) RdrCEF.exe (PID: 2352 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --primordial-pipe-token=e65a24799f6 26B92B943F5C4CC757F43 --lang=en-us --lang=en-us --log-file='c:\program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --productversion='readerservices/ Chrome/ ' --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image -texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0, 3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3 553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,35 53;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;4,0,3553;4,1,3553;4,2,3553;4,3,355 3;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15, disable-accelerated-video-decode --disable-webrtchw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=e65a24799f626b92b943f5c4cc757f43 --renderer-client-id=3 --mojo-platform-channel-handle= allow-no-sandbox-job /prefetch:1 MD5: 7AFD03A53C1FE02E04974C9D99B1CF67) cleanup Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\etilqs_BYYigdhvxZTpM8k Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe data Size (bytes): 2056 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: F6A722FC85C9D3DD56528A7E294DBD15 9F97CC3AA437F7A043E74C62D2E44FE3B08A4D43 F53F F00FAA6F194FACFFF3402AE3DDA95209A67BD93B0F0ACA E14C40CF62F9FA507653B1337C105A7A0AAE E52EF244BB084BF31A2B6EB2504A9BF18E9CF424E7D03 E71C14E38CE92C86D1D4CF05BD5AAE55783F3A moderate, very likely benign file C:\Users\HERBBL~1\AppData\Local\Temp\etilqs_KZ7hwxBIfKH42oI Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe data Size (bytes): 2056 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 4F17927F36361E28B5F0A9EA5A0164B4 030A24A614E5F3A27B03D A021224A DCE64775B21696CD1E8D F4A22BF19372E6900E5F98E1BCFFD036E0 D77AAA227C946B33D73EE5A D3FC98E4CB497033DF7270A5A6E663EC8A81574DDC4E4E58EE2591C88515 F60ECE31F9ABF32B3ED09895A61B2EB148EB84 low C:\Users\HERBBL~1\AppData\Local\Temp\etilqs_OoCwtgPWo76EzWO Process: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe File Type: data Size (bytes): 2056 Entropy (8bit): Encrypted: MD5: 1F8FA5B82F08652B50D12BD63F81A95A Copyright Joe Security LLC 2018 Page 11 of 76

12 C:\Users\HERBBL~1\AppData\Local\Temp\etilqs_OoCwtgPWo76EzWO SHA1: SHA-256: SHA-512: Malicious: Reputation: CCCCF121898E56BA4F4F036EC91DFDE38336D6F4 D135F11A4D7B0145A9578AAD24B35B7976C2C2A0ADBB994893B12E3EEBCD209A 24A2B62F0EA87A0F1339BC0FFF854115E69F9CDCC72732D307E1B1F59E4A6D318EAF34C6AB4ABCB9F2067A9A62 1F8198CDF64BEE98289EFB4E15D17B0D6837C7 low C:\Users\HERBBL~1\AppData\Local\Temp\etilqs_U4reNx46AEnMq2h Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe data Size (bytes): 2056 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 02F6F2AE1886B9FA73795CB6197B92D0 0CB575E0D7056BDBC054942D8AF7C2BC47CA CCBE8B71981AAB81E A7F5E5A8714F24527B8B8DCD19C50820F0DFF 2F40F A7022CE2F DD588AA59BFF1C45A27723B8A43415CE9A58DA31819A1F6161EF2A1FA5 71B3DCE5F0304A7B48D4F497C5DADA02725E low C:\Users\HERBBL~1\AppData\Local\Temp\etilqs_cOtlQw5tMFYX6EM Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe data Size (bytes): 2056 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 6C092145CFA09CF94E38CFAACEB925C3 B F42A187AF B46230E625DFEC80 95F0D835862FE2FF1FA8C71933ACB85F5B465F52316BC8C555EC7197D7689B9E 9E9E37D ECF5D418DC9FC363AD6044B4A7F5540BAEB3B2BB56E0F94170AFE967405E6ACA95D1E5BD 02894C2B8B14DAAE9C2C4E94B86B160FB9E9D33 low C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages Process: File Type: Size (bytes): C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe SQLite 3.x database Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 8B790A6119F82CC590A152F672BDE5EE A4BD31151AF99B958CAF149D5AA6882CC FE522EBE0720B BAAAFAAF15B9801ADF77FA07E17E27015B4B5F8A84B 9BB60766B78B5BF4BD6F8F5C1E79C78063A9BB EF F99EF760C980570DB1D D8AC1A B68BCC3828F471B36DC E10C3 moderate, very likely benign file C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: F887A195A0D8305D3AE2ABB9C49FFD BC701E913EDB77E5E81EA4264BC70585A6E A5CD3B9948F37CD BCF50E35C935A411CC639F48FEFBEDAC5E1F2DF 35EC9683D60C22BFEF7C7B878370C6254B5EA6A0C94EBFEDE501DCEDEF94B4A82562C949F957D9D4E444C95C7 7A7FBA312FCB961CDF6C8B4C79EC3C35C4540CC low C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\RFL\LocalMapping\RFLDB170 Process: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe File Type: SQLite 3.x database Copyright Joe Security LLC 2018 Page 12 of 76

13 C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\RFL\LocalMapping\RFLDB170 Size (bytes): 8192 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: F4E128FE3DCBC564C56FF2814B88E27E 6A70A50A1AB56176A BEA645D9F2F292 3E69BDBEEF1FB835BD BB9347F7711BE96EE4CE9E7298C2D3D5A71EB42 5FE3EE0AA1EAFFEBA A1DF3F51BCB8633DE46BDF876F72906F874AC6CAF09A200463AA787B798C E25185DB762F9360B C63CD5AA5BA6E8 moderate, very likely benign file C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\RFL\LocalMapping\RFLDB170-journal Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe data Size (bytes): 524 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: AFFCA8E76D93E363BB8A701F2C C78FBD69F055BDD6B6BD76DEA17EFEAFACE00E 5301FFA9A60E8BFC E604FC5B915B818DBC DD6654DC102 4ACE95EAB49ABA361CB5A62C A4149B A3DAE4902BBC5CC8321F5C9EBEA AFDB45 D03DD788098FAB7A154EA5510C6FAD007CAD555 low C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-18 Process: File Type: PDF document, version 1.6 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2CC565567A3F CEE990A81597 E98A5109F501D3CB50A1C C1A7DD7E19D1 67DA460C64BE37713D338B24A1347B0A14F948FB5262CEBFCD63FC91B8F1204D 683E6C74E1607BDEE5ACF9B9847C479DD2D2C01CEDBF44919AEDA925059C031EABB469ADD3C516CFC354713D 752E767C7C29AA65FA38EDB16681EA42FB97C0C7 true moderate, very likely benign file C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-19 Process: File Type: PDF document, version 1.6 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe true EC72E0762D4779B522B80519E4908BEA 796DCC3ABED7FFF8230C9E4EF896034C3D88BEDC 7005DDA2A315B2F22E6C7D815887A6A54D35C3F91BEA524FD6D5BD375FC5CA4A 6D9A87146F5DD0C690965A2968A9227F269E072879D72D9EFB B2C623A71D8E75131FBAC172410C770462F 7C0BE932142C55D5A85911AE EFF true low C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer Process: File Type: Size (bytes): C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe SQLite 3.x database Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: DA8DDCD8E8716C106B0C1D038F4EF891 EAACF972BE9383A4B2D2B CC65A94C4D7 798A5B2FDFD3C9127A508F69CC086A4E6A85FC51A804E30F0D946F59DB9EADE6 E5D93F1E8F828B45F5B031AE1A372A90D49D602C91BEDFE118738CD84DC C0EF391F8810B8A F8 9950F422A5BF3E24BC408F461AAFBE6C78E6F low Copyright Joe Security LLC 2018 Page 13 of 76

14 C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer-journal Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 53B3916CE9E3B34FBAFB D50BD 15E00466C2AA BE6ACFF88D2E158D4994 B A5CCC92F4DF736C45D7F7E6F8747CE35868DB62E5C423150EA97011 C3D1DADB8B66B9752B4483C9EEE71E456B38392CFA4DADC5881C3DB2D9328DBD EF0BB3B0103C19AA B434563DAA830A0C7B1135F0F02B97048 low C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents Process: File Type: Size (bytes): C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe SQLite 3.x database Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: FBB F987AF35FEC2AD33FBC351 DA41EB F4A371C94FF4BFB181761CD621 3D52A894A8A5E1D233F7DF47B9BECEB2053EC3319AD14EC2DB3DCCCA585AD2CF 9E2F EADFF524E61C750D734D35EDBEDBD416F09B0BE3C59968DCDB03509C8739F71AA96B1CB9B70B38 B863CE067ADA855BA97815C811D61B4B9F717AF low C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: A5336BDB A731CD9 8E12EFF3CDEAA D01E2F0C57BB33B61564 A55E0503CBA08D41B B C1C1C A116279C767336C39D3C F229F552D9D2D8E70CD967E61CAF2649DDB35973D3FC8560A3BF3BABD92408B2C07A8C194E495E5D6C8 A58E04C92EE0C6C75F5B4C751CD1B8A730CF68 low C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: AE092401F288D50216EE058BCB837B1C CFB3953F753593FB390ECFB64F FE1D3 62B0A56587AF264827DFBF8E C9E C8947C292981E02CFF571 E6B9DB7F6BB319C552DB42BF26852DA1B2C645DCA6CB0DFFA2D39DE477270FEBA3BFEEFCFE450245DEB7CF9 B036E4423F612622A4514A125FD00497AF87DC270 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\eutl12[1].acrobatsecuritysettings Process: File Type: PDF document, version 1.6 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe true EC72E0762D4779B522B80519E4908BEA 796DCC3ABED7FFF8230C9E4EF896034C3D88BEDC 7005DDA2A315B2F22E6C7D815887A6A54D35C3F91BEA524FD6D5BD375FC5CA4A 6D9A87146F5DD0C690965A2968A9227F269E072879D72D9EFB B2C623A71D8E75131FBAC172410C770462F 7C0BE932142C55D5A85911AE EFF Copyright Joe Security LLC 2018 Page 14 of 76

15 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\eutl12[1].acrobatsecuritysettings Malicious: Reputation: true low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\tl12[1].acrobatsecuritysettings Process: File Type: PDF document, version 1.6 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2CC565567A3F CEE990A81597 E98A5109F501D3CB50A1C C1A7DD7E19D1 67DA460C64BE37713D338B24A1347B0A14F948FB5262CEBFCD63FC91B8F1204D 683E6C74E1607BDEE5ACF9B9847C479DD2D2C01CEDBF44919AEDA925059C031EABB469ADD3C516CFC354713D 752E767C7C29AA65FA38EDB16681EA42FB97C0C7 true moderate, very likely benign file C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData Process: File Type: Size (bytes): 22 C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ASCII text Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 4AC65FD C840E4B8ED F F914B6F0DF85ED7B5AA059AFDBD993E F 913EF675AA4754FBB1A0B07E73B75D515B05C2058CB1144BC115E0430A90CC11 9E8913B2E71CA3C0D422A2ED1CA6E2BEE3C7C7F493A0F79573CA4E FFB1D38F B1303B4F3F6F 392E20B7694ED25A177301C93816BB8B C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings Process: File Type: Size (bytes): 24 C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ASCII text Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: DD4A3BD8B9FF EA9987E1D C122CACAAF112469FC62976BB69187AA2B 7C22C759CA BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486 FDAF3D9F8072ED7DE9B C10E3C3FDBEA A4795BECF23C6577B3582B2E89D3C04EF0523C98FE0A 46F2AF A20B848C63BA7B C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ISO-8859 text, with very long lines, with CRLF, CR line terminators 947F93FE0EED F28CFDE05 F6276D2A2B4A9D8A8E23C84019CD3961E9D60E88 06A576FC14E995C437B26C0D150B4E84CD745E7CEDFD972A84B42B51C842FC9B F97739EB0D22A99B06EF340AEFB0D5A5B45B679D28ACCFF3DE C7D2FABAA33F945696F7D456BA2EF 323F48E43EB26578F71C8B2E8ED32FB4DC69BC9 \C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\Commands Process: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe File Type: data Size (bytes): 2147 Entropy (8bit): Encrypted: MD5: 09B9C5A46879EB35240DB898DA8425EE SHA1: 4FA84321C83AFDA269CB32E7C58A29D1EB89CC5D SHA-256: E5660FC178704A92A3A0AD083F27BED9F1CD9FB9266A560BF1C661E9B52EF5C3 Copyright Joe Security LLC 2018 Page 15 of 76

16 \C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\Commands SHA-512: Malicious: F4C3F574CC948396DC49D7B939382F807B63F8DB5696BDE720CF64F19B2AE173B420F9CD6BC97E403D0BD40C06 E2524CF9644DD1CAEB019B2070BFE468C3303E \C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\Notification Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe data Size (bytes): 224 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 02B8C8F925A756CD6131C39446C8F949 96E053D2DBC9A BD293DEE595207E F97BC54B83B71DB9D990D A861C9F79EB7C2D70DB905542F85D D191DE3166F2B7DB1F0385E501FAC95BCE596B65D4795AFEDBBE5D20489E093F61E2D068DDDB12BD3C10B5666 3BB5BA8EE AF12B8643BCA795BEE6A51D \com.adobe.reader.rna.user.0 Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe data Size (bytes): 987 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 59E116DB2E1CD39094E44018F37BBA40 3FD8D3AB664EEECEEAD8827F7A8C662A C43B721C220BBF57E955C235C02FEDAF7DEAAA3B2EC09994F75E465F819464D EA94E21E8D9E396E94AE947F824BD7AD4F036AA0B71FEBA7CEB3469FEC6F589AB0A883A97BA3450E306E D08E248D73B97C7AC44DA24A212C22BAB98E6 \com.adobe.reader.rna.db4 Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe data Size (bytes): 1755 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: F6BEC2A AEFB6554A8FE46DA9F 5677A1871C6A7886C950D1B8FBFFDF715C2A0D0D 7EE21931F9B4C85F659E8E57DCED393BD9BD9CF74C720D8157F06506D6E00CC A839BEBB8D74D18AF692427B48D294290D9C3E01A13FF3AFFA59C85D649D6B094388E6AC715C6524E AAD6D47BD51A7F592EED83D00F58E40AA6C \mojo Process: File Type: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe data Size (bytes): 3032 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: 784F53B2B5CBC62A24F15B9FC81320B0 F6FF721AF6CC FDCFDD4A3F3CDB38F113D D6B B9E710582D68CE0B9B F73B9CCD06A8F64EB4D86D97B FA17B6B8ED524D6A7EECBAEE3D7F3F162DDB0E7C75EAD739F760F E8F2E746A77481A419DE5C7B0BB D2B75EFCCD2F4F8846B7170E563DF \mojo Process: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe File Type: data Size (bytes): 3088 Entropy (8bit): Encrypted: MD5: 54A8983F6EACBFFF099C8210D8B3C50C SHA1: 68419FB66D3801AAB461F0F4889D855D6B SHA-256: 10BF049811C587A3782BC580A961E12CAB7FF9FD99263B C B5 Copyright Joe Security LLC 2018 Page 16 of 76

17 \mojo SHA-512: Malicious: 2DE6CE A274FBD1C A482075D3838AE7D22D2BC3C43FE55FF2E88E4016AE5B DB402A 06302AF0EC8578C9A5EA0B83FEA67E4181C1A \mojo Process: File Type: Size (bytes): 36 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe data 652BB59DDCE5E204C D17F2 CCBDE30919B2F39AB9E6482B45C57CE7FA81D8E3 8F C9E2F560F9C5BCABB07828A8B0CDDE31F846D6559B5D7B73FF090 4C0B7973B70694C217F520A43EE87DDDCEA233234B3C B2DAEF68484BB76DCE686E ADF40136B9C A2EDE9EC48F8E5B449F7F1EFC3B3F887F7A7F \mojo Process: File Type: Size (bytes): 36 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe data 652BB59DDCE5E204C D17F2 CCBDE30919B2F39AB9E6482B45C57CE7FA81D8E3 8F C9E2F560F9C5BCABB07828A8B0CDDE31F846D6559B5D7B73FF090 4C0B7973B70694C217F520A43EE87DDDCEA233234B3C B2DAEF68484BB76DCE686E ADF40136B9C A2EDE9EC48F8E5B449F7F1EFC3B3F887F7A7F Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation trustlist.adobe.com true 0%, virustotal, Browse high Contacted IPs Copyright Joe Security LLC 2018 Page 17 of 76

18 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious United States GOOGLE-GoogleIncUS unknown unknown unknown European Union AKAMAI-LONGB Static File Info General File type: PDF document, version 1.5 Entropy (8bit): TrID: Adobe Portable Document Format (5005/1) 76.94% Java Script embedded in Visual Basic Script (1500/0) 23.06% File name: File size: MD5: SHA1: SHA256: SHA512: File Content Preview: sentenza berwind.pdf e7a9de4b0dadc2e45f6ab1a6a 712bf58b2c42e753d75b38d34bd8467c63e1c711 cd971f81d9141e1f3311db0dfbb e36cbf4d3f5a8e 6a4d906a68fc09ec 44ad4e6369f611b4a1fa88a0b ea bad055 13aaa4cd71fc8dc52893f8a fd6e4954f72947b5 b0ec3917ebd e7cea9aebe5bae %PDF-1.5.% obj.<</f 132/Type/Annot/Subtype/ Widget/Rect[ ]/FT/Sig/DR<<>>/T(Signature1)/V 1 0 R/P 4 0 R/AP<</N 2 0 R>>>>.endobj.1 0 obj.<</cont ents < b06092a864886f70d010702a082082c f300d b0 609 File Icon Static PDF Info Copyright Joe Security LLC 2018 Page 18 of 76

19 General Header: %PDF-1.5 Total Entropy: Total Bytes: Stream Entropy: Stream Bytes: Entropy outside Streams: Bytes outside Streams: Number of EOF found: 6 Bytes after EOF: Keywords Statistics Name Count obj 670 endobj 670 stream 44 endstream 44 xref 6 trailer 6 startxref 6 /Page 16 /Encrypt 0 /ObjStm 0 /URI 0 /JS 0 /JavaScript 0 /AA 0 /OpenAction 0 /AcroForm 3 /JBIG2Decode 0 /RichMedia 0 /Launch 0 /EmbeddedFile 0 Network Behavior Network Port Distribution Total Packets: (HTTP) 53 (DNS) TCP Packets Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Copyright Joe Security LLC 2018 Page 19 of 76

20 Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Copyright Joe Security LLC 2018 Page 20 of 76

21 Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Copyright Joe Security LLC 2018 Page 21 of 76

22 Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Copyright Joe Security LLC 2018 Page 22 of 76

23 Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Apr 11, :42: CEST Copyright Joe Security LLC 2018 Page 23 of 76

ID: Sample Name: Harry Potter and the Sorcerer's Stone.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 06:34:30 Date: 24/04/2018 Version:

ID: Sample Name: Harry Potter and the Sorcerer's Stone.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 06:34:30 Date: 24/04/2018 Version: ID: 56310 Sample Name: Harry Potter and the Sorcerer's Stone.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 06:34:30 Date: 24/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General