Adobe[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Adobe.exe
Size 6.1MB
Sample260803-lagvxavyds
SHA256 2d3d9438e4885d1d6c69d620873c9933d6f2b61173689ffe91e8e3d7e890d7dd
MD5 c3e8fefbee49c36dfa66546c0b4194d9
SHA1 10658c50ba666ba5897cfcf7cac3aaf321efee62
SHA512 ac301fccd5dec13b412938b962334e8688e85f7ea7b580c3972abc1fb1830d043d467eab830f0bad11ba55eb52f28f2354089aee9c1cf8d917931cf76462508c
SSDEEP 49152:DVtADpuldfbdYfW9L4D4EVfzoZpIptf4ddaCZQBv2zqiuZkUv75mYPb6oK2yxl43:nl0fW5oV+dqNxmC/
TLSH
T1A556D41166D98FD8C09FD474CE4665B25A237C868F21AFDF0980BE293E766B05E3421F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Adobe.exe

.exe 6.1MB

Adobe.exe

IMPHASH aef4df067844f62764cdb4dfa75b7040
SHA256 2d3d9438e4885d1d6c69d620873c9933d6f2b61173689ffe91e8e3d7e890d7dd
MD5 c3e8fefbee49c36dfa66546c0b4194d9
SHA1 10658c50ba666ba5897cfcf7cac3aaf321efee62
SHA512 ac301fccd5dec13b412938b962334e8688e85f7ea7b580c3972abc1fb1830d043d467eab830f0bad11ba55eb52f28f2354089aee9c1cf8d917931cf76462508c
SSDEEP 49152:DVtADpuldfbdYfW9L4D4EVfzoZpIptf4ddaCZQBv2zqiuZkUv75mYPb6oK2yxl43:nl0fW5oV+dqNxmC/
TLSH
T1A556D41166D98FD8C09FD474CE4665B25A237C868F21AFDF0980BE293E766B05E3421F
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

08:8a:72:36:27:a6:5a:74:58:0c:57:d2:39:db:39:76:f7:ec:66:42:ba:1c:82:29:b3:d2:32:1a:b5:7d:cc:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Dec 6, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:84:8e:a3:9b:36:d7:bb:53:3c:f4:3d:96:d6:e1:3e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 6, 2025 - Oct 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2584224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\BuildResults\bin\Release_x64\AcrobatExe.pdb

kernel32

GetLongPathNameW RaiseException GetExitCodeProcess LoadLibraryExW SetDllDirectoryW GetCurrentDirectoryW GetFileAttributesW QueryDosDeviceW lstrcmpA lstrcmpW CreateEventA GetCurrentThread SetThreadPriority TerminateThread GetModuleHandleA GetSystemPowerStatus LoadLibraryA CreateFileA FindFirstFileA FindNextFileA GetFinalPathNameByHandleW SetFilePointer GetSystemInfo VirtualQueryEx CreateFileMappingW LoadLibraryExA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA SetErrorMode QueryPerformanceCounter HeapSetInformation WaitForMultipleObjects CreateSemaphoreW CreateProcessW GetSystemTime GetSystemTimeAsFileTime AddAtomW SystemTimeToFileTime QueryPerformanceFrequency IsProcessorFeaturePresent GetVersionExW GetEnvironmentVariableW RtlUnwind UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList FindFirstFileW FindClose GetTickCount OpenMutexW GetVolumeInformationW CreateThread CreateEventW CreateMutexW ResetEvent SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WaitNamedPipeW CreateNamedPipeW TransactNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe ReadFile GetFileType FindResourceW SizeofResource LockResource LoadResource FindResourceExW TerminateProcess DeleteCriticalSection InitializeCriticalSectionEx HeapSize HeapReAlloc HeapDestroy DecodePointer GetStartupInfoW lstrlenW GetCurrentProcess GetTempPathW CreateFileW CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW lstrcmpiW LocalFree LocalAlloc VerSetConditionMask MultiByteToWideChar OpenFileMappingA FormatMessageW WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetTimeZoneInformation SetCurrentDirectoryW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess SetStdHandle GetConsoleOutputCP FreeLibraryAndExitThread RtlUnwindEx InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx LCMapStringEx GetModuleHandleW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc DebugBreak IsDebuggerPresent SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode WideCharToMultiByte QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GetDynamicTimeZoneInformation LoadLibraryW GetProcAddress GetModuleHandleExW GetModuleFileNameW FreeLibrary GetSystemDirectoryW OpenProcess GetCurrentThreadId GetCurrentProcessId Sleep SetLastError GetLastError CloseHandle OutputDebugStringW OutputDebugStringA WriteFile GetFileAttributesA GetCommandLineW GetTempFileNameW EncodePointer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize RtlPcToFileHeader AreFileApisANSI GetLocaleInfoEx GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetFileInformationByHandleEx QueryFullProcessImageNameW GlobalHandle MulDiv GlobalSize GlobalUnlock GlobalLock EnumSystemLocalesW FindNextFileW OpenFileMappingW OpenEventW SetEnvironmentVariableW CreateDirectoryExW CreatePipe CompareFileTime GetFileTime GetFullPathNameW EndUpdateResourceW UpdateResourceW BeginUpdateResourceW GetStdHandle GetExitCodeThread GetComputerNameExW GlobalFree GlobalAlloc GetModuleHandleExA InitializeCriticalSectionAndSpinCount VirtualAlloc VirtualProtect VirtualQuery ExpandEnvironmentStringsW ProcessIdToSessionId GetProcessId DuplicateHandle GetProcessTimes IsWow64Process GetProductInfo GetNativeSystemInfo DeleteFileW GetFileSizeEx GetLocalTime FormatMessageA TryAcquireSRWLockExclusive ReleaseSRWLockExclusive UnregisterWaitEx RegisterWaitForSingleObject QueryThreadCycleTime GetThreadPriority GetUserDefaultLangID GetThreadId TlsGetValue AcquireSRWLockExclusive MoveFileExW GetFileAttributesExW CopyFileW TlsAlloc TlsFree TlsSetValue SetFilePointerEx SetEndOfFile GetFileInformationByHandle SetFileInformationByHandle FlushFileBuffers FindFirstFileExW GetWindowsDirectoryW lstrcmpiA GetLocaleInfoW GetDriveTypeW DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GetFileSize VirtualProtectEx WriteProcessMemory VirtualAllocEx VirtualFreeEx GetVolumeInformationByHandleW GetProfileStringW ReadProcessMemory SearchPathW CreateIoCompletionPort GetQueuedCompletionStatus UnregisterWait TerminateJobObject PostQueuedCompletionStatus SetInformationJobObject IsProcessInJob QueryInformationJobObject ResumeThread CreateRemoteThread SetHandleInformation ExitThread GetUserDefaultLCID GetUserDefaultLocaleName AssignProcessToJobObject CreateJobObjectW SignalObjectAndWait VirtualFree FlushInstructionCache

user32

MapVirtualKeyW PostMessageW GetPropA GetMessageW GetUserObjectInformationW GetProcessWindowStation SetProcessWindowStation CreateWindowStationW CreateDesktopW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW GetParent MessageBoxW RemovePropW GetPropW SetPropW GetActiveWindow GetDlgItem GetDC TranslateMessage DdeDisconnect DdeConnect DdeAddData DdeCreateDataHandle DdeQueryStringA DdeGetData EnumThreadWindows IsWindowVisible DdeFreeStringHandle DdeCreateStringHandleW DdeNameService DdeUninitialize DdeInitializeW SetWindowLongPtrW SendNotifyMessageW RegisterWindowMessageA CloseDesktop SetThreadDesktop OpenInputDesktop CreateWindowExW RegisterClassExW DefWindowProcW RegisterWindowMessageW LoadIconA LoadCursorA FindWindowA DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA PostQuitMessage DefWindowProcA DispatchMessageA GetMessageA GetThreadDesktop PostThreadMessageW IsWindowEnabled MsgWaitForMultipleObjects PeekMessageW CloseWindowStation GetFocus LoadIconW SendDlgItemMessageW MonitorFromWindow GetMonitorInfoW GetAsyncKeyState EnumChildWindows FindWindowExW EnableWindow WindowFromPoint GetShellWindow GetRawInputDeviceInfoW SetActiveWindow GetWindowLongW SetWindowLongW GetClientRect PtInRect SetCursorPos DispatchMessageW ReleaseDC CreateIconFromResourceEx GetWindowTextLengthW RegisterClassW GetWindowInfo SetDlgItemTextW GetRawInputDeviceList DdeClientTransaction CloseWindow LoadCursorW RegisterClipboardFormatW GetClipboardData IsClipboardFormatAvailable EnumClipboardFormats CountClipboardFormats SetClipboardData GetClipboardFormatNameW GetClipboardFormatNameA GetClipboardSequenceNumber GetClipboardOwner GetPriorityClipboardFormat GetOpenClipboardWindow GetClipboardViewer GetWindowDC SystemParametersInfoW BeginPaint EndPaint MoveWindow UpdateWindow AdjustWindowRectEx IsChild SetFocus SetRect MonitorFromRect IsRectEmpty GetClassInfoExW GetSysColor CallWindowProcW RedrawWindow CreateAcceleratorTableW ClientToScreen ScreenToClient SetCapture ReleaseCapture FillRect InvalidateRect InvalidateRgn DestroyAcceleratorTable MapWindowPoints SetCursor IsDialogMessageW LoadBitmapW MapDialogRect SetWindowContextHelpId CreateDialogIndirectParamW UserHandleGrantAccess GetWindow EnumWindows SetParent GetWindowLongPtrW GetWindowTextW GetAncestor GetDesktopWindow GetWindowRect SetForegroundWindow GetSystemMetrics keybd_event BringWindowToTop WaitForInputIdle SendMessageTimeoutW EnumDesktopWindows SetWindowTextW GetForegroundWindow CharNextW EndDialog DialogBoxParamW GetGUIThreadInfo IsWindow GetWindowThreadProcessId FindWindowW AllowSetForegroundWindow SwitchToThisWindow KillTimer SetTimer EmptyClipboard CloseClipboard OpenClipboard SetWindowPos ShowWindow UnregisterClassW SendMessageW

advapi32

CryptGenKey EventUnregister EventWriteTransfer EventSetInformation EventRegister RegGetValueW RegOpenKeyExA RegQueryValueA RegOpenKeyA EqualSid AllocateAndInitializeSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegCreateKeyW ReportEventW RegisterEventSourceW CloseEventLog ConvertSidToStringSidW MakeAbsoluteSD InitiateSystemShutdownW LookupPrivilegeValueW AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetSecurityInfo GetSecurityInfo SetEntriesInAclW SetTokenInformation GetSecurityDescriptorSacl GetLengthSid FreeSid DuplicateTokenEx CreateWellKnownSid CopySid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken RegQueryValueExA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey RegNotifyChangeKeyValue RegEnumValueW RegDeleteKeyExW SystemFunction036 GetNamedSecurityInfoW MapGenericMask AccessCheck OpenThreadToken InitializeSecurityDescriptor InitializeAcl SetSecurityDescriptorDacl GetAce SetKernelObjectSecurity GetKernelObjectSecurity InitializeSid GetAclInformation AddAce CreateProcessAsUserW RevertToSelf RegDisablePredefinedCache CreateRestrictedToken DuplicateToken SetThreadToken SaferiIsExecutableFileType CheckTokenMembership RegDeleteTreeW GetUserNameW CredReadW CredFree CryptAcquireContextA CryptAcquireContextW CryptReleaseContext CryptImportKey CryptDestroyKey CryptGetProvParam CryptSetProvParam CryptGenRandom CryptGetUserKey CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSignHashA CryptSignHashW CryptGetHashParam CryptSetHashParam CredWriteW CredDeleteW CryptSetKeyParam CryptContextAddRef ImpersonateAnonymousToken

shlwapi

PathFileExistsW PathIsURLW UrlEscapeW ord214 UrlIsW PathCanonicalizeW PathRemoveBackslashW PathAppendW PathRemoveFileSpecW PathFindExtensionA PathCombineW PathIsRelativeW PathFindExtensionW AssocQueryStringW UrlGetPartW PathIsDirectoryW PathCreateFromUrlW UrlCanonicalizeW PathIsUNCW PathFindFileNameW ord12 PathIsUNCServerShareW ord219 UrlUnescapeW PathAddBackslashW

winhttp

WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReadData WinHttpWriteData WinHttpCloseHandle WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetTimeouts WinHttpSetCredentials WinHttpQueryHeaders

??4PreamblePatcher@sidestep@@QEAAAEAV01@$$QEAV01@@Z ??4PreamblePatcher@sidestep@@QEAAAEAV01@AEBV01@@Z ?AcrobatIsNearAbsoluteIndirectJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?AllocPageNear@PreamblePatcher@sidestep@@CAPEAXPEAX@Z ?AllocPreambleBlockNear@PreamblePatcher@sidestep@@SAPEAEPEAX@Z ?FreePreambleBlock@PreamblePatcher@sidestep@@SAXPEAE@Z ?Initialize@PreamblePatcher@sidestep@@CAXXZ ?IsMovWithDisplacement@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearAbsoluteCall@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearConditionalJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearRelativeCall@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsNearRelativeJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsShortConditionalJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?IsShortJump@PreamblePatcher@sidestep@@CA_NPEAEI@Z ?PatchMovWithDisplacement@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?PatchNearJumpOrCall@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?PatchShortConditionalJump@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?PatchShortJump@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAEI0PEAII@Z ?RawPatch@PreamblePatcher@sidestep@@SA?AW4SideStepError@2@PEAX0PEAPEAXPEBD@Z ?RawPatchWithStub@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAX0PEAEKPEAKPEBD@Z ?RawPatchWithStubAndProtections@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PEAX0PEAEKPEAKPEBD@Z ?ResolveTargetImpl@PreamblePatcher@sidestep@@CAPEAXPEAE0_N@Z ?Unpatch@PreamblePatcher@sidestep@@SA?AW4SideStepError@2@PEAX00@Z ?granularity_@PreamblePatcher@sidestep@@0JA ?initialized_@PreamblePatcher@sidestep@@0_NA ?pagesize_@PreamblePatcher@sidestep@@0JA ?preamble_pages_@PreamblePatcher@sidestep@@0PEAUPreamblePage@12@EA AcroRd32IsBrokerProcess CreateCoreWebview2EnvironmentSandbox GetHandleVerifier GetWinstaDesktopInfo IsSandboxedProcess

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

120KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

203KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

726KB

Virtual Size

726KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Adobe.exe

kernel32

user32

advapi32

shlwapi

winhttp

generic