26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious EXP/KAB.Talu Sample 3163f47f0820… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 3163f47f0820…. Malware family: EXP/KAB.Talu. Threat score 70/100. 1/28 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3163f47f0820f5e4ac7a22d2fd55b19e363d529b3b8a36ea58756f6318550031","keywords":["Suspicious","EXP/KAB.Talu","malware analysis","sandbox report","threat intelligence","3163f47f0820f5e4ac7a22d2fd55b19e363d529b3b8a36ea58756f6318550031"],"about":{"@type":"SoftwareApplication","name":"2013_Book_AppliedChemistry.pdf","applicationCategory":["pdf"],"identifier":"3163f47f0820f5e4ac7a22d2fd55b19e363d529b3b8a36ea58756f6318550031","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"EXP/KAB.Talu","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7cb,"http://www.sandia.gov/expIosive/componts.htm" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.polymer-search.com" (Based on: "2013_Book_AppliedChemistry.pdf") "http://news.stanford.edu/news/2007/march14/kondo-031407.html" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.lib.uwaterloo.ca/patents.html" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.waveenergy.dk/apparater/engelsk-klassificering.html" (Based on: "2013_Book_AppliedChemistry.pdf") "www.wqa.org" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.unep.org/ozone" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.world-petroleum.org" (Based on: "2013_Book_AppliedChemistry.pdf") "www.math.mcmaster.ca" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.canev.com" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.corrosion.com" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.ASTM.org7DATABASE.CART/PAGES/0121.htm" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.eia.doe.gov" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.eccj.or.jp/databook/1998e/index.html" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.detroitdiesel.com" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.acs.org/VC2/2my/my2—143.html" (Based on: "2013_Book_AppliedChemistry.pdf") "www.jools.com" (Based on: "2013_Book_AppliedChemistry.pdf") "www.ordnance.org/classifi.htm" (Based on: "2013_Book_AppliedChemistry.pdf") "www.wef.org" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.greenfuels.org" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.ameriplas.org" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.epa.gov/cpg/products/cement.htm" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.epa.gov/ow" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.panasonic.com" (Based on: "2013_Book_AppliedChemistry.pdf") "http://www.corrosion-doctors.org" (Based on: "2013_Book_AppliedChemistry.pdf")28:Tc24,file/memory contains long string with (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html") Found string "" (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html") Found string "" (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html") Found string "" (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html") Found string "" (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html") Found string "" (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html") Found string "" (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html") Found string "" (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html") Found string "" (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html") Found string "" (Indicator: "text/javascript"; File: "urlref_httpnews.stanford.edunews2007march14kondo-031407.html")29:Ta54,"AdobeFnt14.lst.3508" has type "PostScript document text"- [targetUID: 00000000-00003508] "A9Rqhj3yf_1in7bw5_2pg.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rqhj3yf_1in7bw5_2pg.tmp]- [targetUID: 00000000-00003508] "urlref_httpnews.stanford.edunews2007march14kondo-031407.html" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: 00000000-00003508] "A9Rl52bud_1in7bw4_2pg.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rl52bud_1in7bw4_2pg.tmp]- [targetUID: 00000000-00003508] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00003508] "A9Rhayxvs_1in7bw7_2pg.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rhayxvs_1in7bw7_2pg.tmp]- [targetUID: 00000000-00003508] "A9Rkyp8ev_1in7bw6_2pg.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rkyp8ev_1in7bw6_2pg.tmp]- [targetUID: 00000000-00003508] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00003508] "A9Rr4wet8_1in7bw2_2pg.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rr4wet8_1in7bw2_2pg.tmp]- [targetUID: 00000000-00003508] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00003508] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00003508] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00003508] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00003508] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00003508] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00003508] "FAPE2B6.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAPE2B6.tmp]- [targetUID: 00000000-00003508]2a:T47c5,Pattern match: "http://www.sandia.gov/expIosive/componts.htm" Pattern match: "http://www.polymer-search.com" Pattern match: "http://news.stanford.edu/news/2007/march14/kondo-031407.html" Pattern match: "http://www.lib.uwaterloo.ca/patents.html" Pattern match: "http://www.waveenergy.dk/apparater/engelsk-klassificering.html" Pattern match: "www.wqa.org" Pattern match: "http://www.unep.org/ozone" Pattern match: "http://www.world-petroleum.org" Pattern match: "www.math.mcmaster.ca" Pattern match: "http://www.canev.com" Pattern match: "http://www.corrosion.com" Pattern match: "http://www.ASTM.org7DATABASE.CART/PAGES/0121.htm" Pattern match: "http://www.eia.doe.gov" Pattern match: "http://www.eccj.or.jp/databook/1998e/index.html" Pattern match: "http://www.detroitdiesel.com" Pattern match: "http://www.acs.org/VC2/2my/my2—143.html" Pattern match: "www.jools.com" Pattern match: "www.ordnance.org/classifi.htm" Pattern match: "www.wef.org" Pattern match: "http://www.greenfuels.org" Pattern match: "http://www.ameriplas.org" Pattern match: "http://www.epa.gov/cpg/products/cement.htm" Pattern match: "http://www.epa.gov/ow" Pattern match: "http://www.panasonic.com" Pattern match: "http://www.corrosion-doctors.org" Pattern match: "http://www.biomass.org" Pattern match: "http://www.adhesionsociety.org" Pattern match: "http://www.worldwaterforum.org" Pattern match: "http://www.eia.gov/emeu/international" Pattern match: "http://en.wikipedia.org" Pattern match: "http://www.qub.ac" Pattern match: "http://www.acs.org/VC2/2my/my2—143.html" Pattern match: "http://www.pomag.com" Pattern match: "http://www.yahoo.com/science/energy" Pattern match: "http://www.airproducts.com" Pattern match: "http://www.flyashrecycling.com" Pattern match: "http://www.viscosity.com" Pattern match: "http://www.fossilfuels.org" Pattern match: "www.wwcomposites.com" Pattern match: "www.cfa-hq.org" Pattern match: "http://www.flyash.org" Pattern match: "http://www.umist.ac.uk" Pattern match: "http://patent.womplex.ibm.com" Pattern match: "http://www.directedtechnologies.com/energy/safety.html" Pattern match: "www.wikipedia.org" Pattern match: "http://www.cheap-fuel.com" Pattern match: "http://www.polymerprocessing.com/sites.html" Pattern match: "http://www.cdnpaint.org" Pattern match: "http://www.chartoftheday.com/20000913b.htm" Pattern match: "http://www.wikipedia.org" Pattern match: "http://www.eia.gov/emeu/international/oilprice.html" Pattern match: "http://www.jools.com" Pattern match: "http://eia.doe.gov/cneaf/coal/quarterly/qcr.pdf" Pattern match: "http://www.plastics.com" Pattern match: "http://www.ilpi.com/genchem/demo/tension" Pattern match: "http://www.natfuel.com" Pattern match: "http://www.sunwize.com" Pattern match: "http://www.acers.org" Pattern match: "http://www.wqa.org" Pattern match: "http://www.cnci.org" Pattern match: "http://www.oilnergy.com/1onymex.htm" Pattern match: "http://www.wef.org" Pattern match: "http://www.llnl.gov" Pattern match: "http://www.cipo.ic.gc.ca/eic/site/cipointernet-internetopic.nsf/eng/wr00142.html" Pattern match: "http://www.adsorba.narod.ru/download/Socslet_angl.pdf" Pattern match: "http://www.winnipegfreepress.com/breakingnews/government-estimates-cesium-leak-from-japans-crippled-nuke-plant-equals-168-hiroshima-bombs-128463423.html" Pattern match: "http://www.chem.ualberta.ca/courses/plambeck/pl02/p0209x.htm" Pattern match: "http://www.polymerpIastics.com" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_BM1" Pattern match: "http://www.pra.org.uk" Pattern match: "www.opec.org" Pattern match: "http://www.hydroquebec.com/hydroelectricity/index.html" Pattern match: "http://www.cca.org.nz" Pattern match: "http://www.fuelefriciencyllc.com" Pattern match: "http://www.winnipegfreepress.com/breakingnews/government-estimates" Pattern match: "http://wikipedia.com" Pattern match: "http://www.varta.com" Pattern match: "http://www.owec.com" Pattern match: "http://www.math.mcmaster.ca" Pattern match: "http://www.awea.org" Pattern match: "www.adsorba.narod.ru" Pattern match: "http://www.chem" Pattern match: "http://www.repairrustedoutcars.com" Pattern match: "http://www.tidalelectric.com" Pattern match: "http://www.awra.org" Pattern match: "http://chemed.chem.purdue.edu/genchem/topicreview/bp/ch20/electroframe.html" Pattern match: "http://www.woodheat.org" Pattern match: "http://www.wci-coal.com" Pattern match: "http://www.euro-composites.com" Pattern match: "http://www.corrosionsource.com" Pattern match: "http://www.physics.nist.gov" Pattern match: "http://www.ecoworld.com/water/ecoworld—water—home.cfm" Pattern match: "http://www.eetd.lbl.gov/ECS/aerogels/satoc.htm" Pattern match: "http://www.ikts.fhg.de/VL.ceramics.html" Pattern match: "http://www.nanosemi.co.uk.about.html" Pattern match: "http://www.paintcoatings.net" Pattern match: "http://www.cp.umist.ac.uk" Pattern match: "http://www.waveenergy.dk/apparater/rly.htm" Pattern match: "http://www.hydrogen.org/index-e.html" Pattern match: "http://www.petroleum.co.uk" Pattern match: "www.ngwa.org" Pattern match: "http://www.pe.utexas.edu" Pattern match: "http://www.physics.bu.edu/pyl05/notes/Viscosity.htmI" Pattern match: "http://www.owenscorning.com/owens/composites/about" Pattern match: "http://www.corrosionpreventiorLorg.uk.cpu/defauiLhtm" Pattern match: "http://www.chemindustry.com" Pattern match: "http://www.fossil-fuels.com" Pattern match: "http://www.opec.org" Pattern match: "http://www.portcement.org" Pattern match: "www.ecoworld.com/water/ecoworld—water—home.cfm" Pattern match: "http://en.wikipedia.org/wiki/2008_Toronto_explosions" Pattern match: "http://www.adsorba.narod.ru/p59.htm" Pattern match: "http://www.uspto.gov/web/offices/ac/qs/ope/fee092611.htm#comp" Pattern match: "http://www.adhesivesandsealants.com" Pattern match: "http://www.evaa.org/Canadian" Pattern match: "http://www.npc.org" Pattern match: "www.nanosemi.co.uk.about.html" Pattern match: "http://www.capp.ca" Pattern match: "http://en.wikipedia.org/wiki/Graphene" Pattern match: "www.springer.com" Pattern match: "http://www.cems.umn.edu/research/crc" Pattern match: "http://www.chemconnect.com" Pattern match: "www.hnd.usace.army.mil" Pattern match: "http://water.usgs.gov" Pattern match: "http://www.cat.com" Pattern match: "http://www.awwa.org" Pattern match: "http://www.uspto.gov/patft/index.html" Pattern match: "http://www.ortechceramics.com" Pattern match: "http://www.boatingreview.com" Pattern match: "http://www.Chem.qmw.ac.uk/surfaces/scc" Pattern match: "http://www.epa.gov" Pattern match: "http://buelsolar.com" Pattern match: "http://www.api.org" Pattern match: "http://edu.cprost.sfu.ca/rhIogan/electrochem.html" Pattern match: "http://www.syncrude.ca" Pattern match: "http://en.wikipedia.org/wiki/Brent_Crude" Pattern match: "http://www.usgs.gov" Pattern match: "http://www.paint.org/index.htm" Pattern match: "http://www.fueltechnic.com" Pattern match: "http://www.explosives.com" Pattern match: "http://www.corning.com/lightingmaterials/products/macor" Pattern match: "http://patents1.ic.gc.ca/intro-e.html" Pattern match: "http://www.nrcan.gc.ca/mms/expIosif/incerle.htm" Pattern match: "http://www.wwcomposites.com" Pattern match: "www.awra.org" Pattern match: "http://www.isee.org" Pattern match: "http://www.umist.ac.uk/lecturenotes/JDS" Pattern match: "http://www.learn.chem.vt.edu/tutorials/electrochem" Pattern match: "http://members.truepath.com/gr/helium.html" Pattern match: "http://www.fe.doe.gov" Pattern match: "http://www.howstuffworks.com/battery.htm" Pattern match: "http://www.panent.com" Pattern match: "http://www.ngwa.org" Pattern match: "www.worldwaterforum.org" Pattern match: "http://www.veggievan.org" Pattern match: "http://www.compositesreg.com" Pattern match: "http://www.importexporthelp.com/electroshield.htm" Pattern match: "http://joinplastics.eng.ohio-state.edu/kkwan/main.html" Pattern match: "http://www.metalogic.be/projects" Pattern match: "http://www.netcomposites.com" Pattern match: "http://www.coal.ca" Pattern match: "http://www.ises.org" Pattern match: "http://www.gpc.peachnet.edu" Pattern match: "www.acers.org" Pattern match: "http://www.liquidpower.com/about/awhatis.htm" Pattern match: "http://www.cipo.ic.gc.ca/eic/site/cipointernet-internetopic.nsf/eng/wr01103.html" Pattern match: "http://www.pprc.org/pprc/sbap/painting.html" Pattern match: "www.isee.org" Pattern match: "http://www.ceramics.com" Pattern match: "http://www.canplastics.com" Pattern match: "http://www.hnd.usace.army.mil" Pattern match: "http://www.petroleumplace.com" Pattern match: "http://www.paint.org/history.htm" Pattern match: "http://www.chemcases.com/silicon" Pattern match: "http://www.peatsociety.fi" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_1" Pattern match: "http://www.corrosion.com/techpage.html" Pattern match: "www.awwa.org" Pattern match: "www.epa.gov/ow" Pattern match: "http://www.paintcenter.org" Pattern match: "http://www.iea-coal.org.uk" Pattern match: "www.ilpi.com/genchem/demo/tension" Pattern match: "http://www.acp-composites.com" Pattern match: "http://www.intercorr.com" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_9" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_8" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_7" Pattern match: "http://hyperphysics.phy-astr.gsu.edu/hbase/surten.html" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_6" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_5" Pattern match: "http://www.epri.com" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_4" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_13" Pattern match: "http://www.nace.org/index.asp" Pattern match: "http://www.firsttenangstroms.com" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_11" Pattern match: "http://www.cfa-hq.org" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_12" Pattern match: "www.eco-ag.us.photo.php" Pattern match: "http://www.universaldiesel.com" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_10" Pattern match: "www.qub.ac" Pattern match: "http://www.flyash.com" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_18" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_15" Pattern match: "http://dx.doi.org/10.1007/978-1-4614-4262-2_16" Pattern match: "www.acp-composites.com" Pattern match: "http://www.pprc.org/pprc" Pattern match: "http://www.uwin.siu.edu" Pattern match: "http://www.accci.org" Pattern match: "http://ca.news.yahoo.com/fire-japan-nuclear-reactor-heightens-radiation-20110315-171920-237.html" Pattern match: "http://www.ordnance.org/classifi.htm" Heuristic match: "j%.gt" Heuristic match: "&dQV.lb" Heuristic match: "SSZ.ph" Heuristic match: ">D.Fr" Pattern match: "http://www.eia.doe.gov/" Pattern match: "http://www.epa.gov./globaIwarming/index.html" Pattern match: "https://www.verisign.com/rpa" Pattern match: "www.adobe.com/misc/pki/prod_svce_cps.html0http://crl.adobe.com/cds\.crl0z0x1US1#0!Adobe" Pattern match: "https://+e};let" Pattern match: "www-media.stanford.edu/assets/favicon/apple-touch-icon-57x57.png" Pattern match: "www-media.stanford.edu/assets/favicon/apple-touch-icon-60x60.png" Pattern match: "www-media.stanford.edu/assets/favicon/apple-touch-icon-72x72.png" Pattern match: "www-media.stanford.edu/assets/favicon/apple-touch-icon-76x76.png" Pattern match: "www-media.stanford.edu/assets/favicon/apple-touch-icon-114x114.png" Pattern match: "www-media.stanford.edu/assets/favicon/apple-touch-icon-120x120.png" Pattern match: "www-media.stanford.edu/assets/favicon/apple-touch-icon-144x144.png" Pattern match: "www-media.stanford.edu/assets/favicon/apple-touch-icon-152x152.png" Pattern match: "www-media.stanford.edu/assets/favicon/apple-touch-icon-180x180.png" Pattern match: "www-media.stanford.edu/assets/favicon/favicon-196x196.png" Pattern match: "www-media.stanford.edu/assets/favicon/favicon-192x192.png" Pattern match: "www-media.stanford.edu/assets/favicon/favicon-128.png" Pattern match: "www-media.stanford.edu/assets/favicon/favicon-96x96.png" Pattern match: "www-media.stanford.edu/assets/favicon/favicon-32x32.png" Pattern match: "www-media.stanford.edu/assets/favicon/favicon-16x16.png" Pattern match: "www-media.stanford.edu/assets/favicon/safari-pinned-tab.svg" Pattern match: "www-media.stanford.edu/assets/favicon/mstile-144x144.png" Pattern match: "www-media.stanford.edu/assets/favicon/mstile-70x70.png" Pattern match: "www-media.stanford.edu/assets/favicon/mstile-150x150.png" Pattern match: "www-media.stanford.edu/assets/favicon/mstile-310x310.png" Pattern match: "https://yoast.com/wordpress/plugins/seo/" Pattern match: "https://news.stanford.edu/archived-content/" Pattern match: "https://news.stanford.edu/wp-includes/css/dist/block-library/style.min.css?ver=6.3.2" Pattern match: "https://news.stanford.edu/wp-content/plugins/awesome-weather-pro/awesome-weather.css?ver=6.3.2" Pattern match: "https://news.stanford.edu/wp-content/themes/news/css/bootstrap.css?ver=1637182433410.3" Pattern match: "https://news.stanford.edu/wp-content/themes/news/css/base.css?ver=1655216200431.6" Pattern match: "https://news.stanford.edu/wp-content/themes/news/css/panels.css?ver=1655216200660.7" Pattern match: "https://news.stanford.edu/wp-content/themes/news/style.css?ver=1637182433483.5" Pattern match: "https://news.stanford.edu/wp-content/themes/news/css/page.css?ver=1655216200590.5" Pattern match: "https://news.stanford.edu/wp-includes/js/jquery/jquery.min.js?ver=3.7.0" Pattern match: "https://news.stanford.edu/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1" Pattern match: "https://news.stanford.edu/wp-content/plugins/site-improve-snippet/snippet.js?ver=1.0" Pattern match: "https://news.stanford.edu/wp-content/plugins/stanford-fb-pixel/pixel.js?ver=1.0.1" Pattern match: "https://api.w.org/" Pattern match: "https://news.stanford.edu/?p=46342" Pattern match: "https://news.stanford.edu/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fnews.stanford.edu%2Farchived-content%2F" Pattern match: "https://news.stanford.edu/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fnews.stanford.edu%2Farchived-content%2F&format=xml" Pattern match: "www.googletagmanager.com/gtm.'+'js?id='+i+dl;f.parentNode.insertBefore(j,f)" Pattern match: "maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css" Pattern match: "html5shim.googlecode.com/svn/trunk/html5.js" Pattern match: "news.stanford.edu/wp-content/themes/news/css/ie/ie8.css" Pattern match: "news.stanford.edu/wp-content/themes/news/css/ie/ie7.css" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-5JMZJ36" Pattern match: "http://www.stanford.edu/" Pattern match: "https://news.stanford.edu/" Pattern match: "https://news.stanford.edu/find-stories/" Pattern match: "https://news.stanford.edu/for-journalists/" Pattern match: "https://news.stanford.edu/contact/" Pattern match: "https://stanford.io/contact_news_archive" Pattern match: "https://news.stanford.edu/search" Pattern match: "https://news.stanford.edu/section/spotlight/" Pattern match: "https://news.stanford.edu/section/arts-creativity/" Pattern match: "http://gostanford.com/" Pattern match: "https://news.stanford.edu/section/awards/" Pattern match: "https://gsb.stanford.edu/news/" Pattern match: "https://news.stanford.edu/section/campus-life/" Pattern match: "https://ed.stanford.edu/news" Pattern match: "https://news.stanford.edu/section/faculty-staff/" Pattern match: "https://news.stanford.edu/section/humanities/" Pattern match: "https://news.stanford.edu/section/law-policy/" Pattern match: "https://med.stanford.edu/news/" Pattern match: "https://news.stanford.edu/section/obituaries/" Pattern match: "https://news.stanford.edu/section/science-technology/" Pattern match: "https://news.stanford.edu/section/social-sciences/" Pattern match: "https://news.stanford.edu/section/teaching-students/" Pattern match: "https://news.stanford.edu/section/university-affairs/" Pattern match: "https://news.stanford.edu/topic/commencement/" Pattern match: "https://news.stanford.edu/topic/cybersecurity/" Pattern match: "https://news.stanford.edu/topic/ecology-environment/" Pattern match: "https://news.stanford.edu/topic/entrepreneurship/" Pattern match: "https://news.stanford.edu/topic/health/" Pattern match: "https://news.stanford.edu/topic/interdisciplinary/" Pattern match: "https://news.stanford.edu/topic/international/" Pattern match: "https://news.stanford.edu/topic/k-12/" Pattern match: "https://news.stanford.edu/topic/undergraduate/" Pattern match: "https://news.stanford.edu/all-stories/" Pattern match: "http://ucomm.stanford.edu/facstaff/" Pattern match: "http://events.stanford.edu/" Pattern match: "https://ucomm.stanford.edu" Pattern match: "https://www.stanford.edu" Pattern match: "https://www-media.stanford.edu/su-identity/images/footer-stanford-logo@2x.png" Pattern match: "https://visit.stanford.edu/plan/" Pattern match: "https://www.stanford.edu/search/" Pattern match: "https://emergency.stanford.edu" Pattern match: "https://www.stanford.edu/site/terms/" Pattern match: "https://www.stanford.edu/site/privacy/" Pattern match: "https://uit.stanford.edu/security/copyright-infringement" Pattern match: "https://adminguide.stanford.edu/chapter-1/subchapter-5/policy-1-5-4" Pattern match: "https://studentservices.stanford.edu/more-resources/student-policies/non-academic/non-discrimination" Pattern match: "https://www.stanford.edu/site/accessibility" Pattern match: "https://news.stanford.edu/wp-content/plugins/awesome-weather-pro/js/awesome-weather-widget-frontend.js?ver=1.1" Pattern match: "https://news.stanford.edu/wp-content/plugins/awesome-weather-pro/js/js-cookie.js?ver=1.1" Pattern match: "https://news.stanford.edu/wp-content/themes/news/js/modernizr.custom.17475.js?ver=1637182433441.8" Pattern match: "https://news.stanford.edu/wp-content/themes/news/js/bootstrap.js?ver=1637182433439.3" Pattern match: "https://news.stanford.edu/wp-content/themes/news/js/base.js?ver=1637182433439.1" Heuristic match: "al.in"2b:T524,Dropped file: "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00003508] Dropped file: "Annssi.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00003508] Dropped file: "Annss.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00003508] Dropped file: "addressbook.acrodata" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00003508] Dropped file: "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00003508] Dropped file: "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00003508] Dropped file: "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00003508] Dropped file: "Annssk.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00003508]2c:Tc0f,"RdrCEF.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70530000 "RdrCEF.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "RdrCEF.exe" loaded module "KERNEL32" at base 75ce0000 "RdrCEF.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "RdrCEF.exe" loaded module "OLE32.DLL" at base 75ac0000 "RdrCEF.exe" loaded module "ADVAPI32.DLL" at base 76100000 "RdrCEF.exe" loaded module "KERNEL32.DLL" at base 75ce0000 "RdrCEF.exe" loaded module "SHLWAPI.DLL" at base 762b0000 "RdrCEF.exe" loaded module "%PROGRAMFILES%\ADOBE\ACROBAT READER DC\READER\ACROCEF\ICUDT.DLL" at base 5ca90000 "RdrCEF.exe" loaded module "NTMARTA.DLL" at base 74260000 "RdrCEF.exe" loaded module "USER32.DLL" at base 75fe0000 "RdrCEF.exe" loaded module "KBDUS.DLL" at base 72500000 "RdrCEF.exe" loaded module "CRYPTBASE.DLL" at base 74e00000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73aa0000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73510000 "RdrCEF.exe" loaded module "RPCRT4.DLL" at base 761b0000 "RdrCEF.exe" loaded module "IPHLPAPI.DLL" at base 73260000 "RdrCEF.exe" loaded module "DHCPCSVC6.DLL" at base 73170000 "RdrCEF.exe" loaded module "DHCPCSVC.DLL" at base 730a0000 "RdrCEF.exe" loaded module "DWMAPI.DLL" at base 735f0000 "RdrCEF.exe" loaded module "SHCORE.DLL" at base 0 "RdrCEF.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75ce0000 "RdrCEF.exe" loaded module "SETUPAPI.DLL" at base 75840000 "RdrCEF.exe" loaded module "CFGMGR32.DLL" at base 75100000 "RdrCEF.exe" loaded module "WINTRUST.DLL" at base 74f80000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\AUDIOSES.DLL" at base 68520000 "RdrCEF.exe" loaded module "CLBCATQ.DLL" at base 75240000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 73bf0000 "RdrCEF.exe" loaded module "SSPICLI.DLL" at base 74d90000 "RdrCEF.exe" loaded module "MSCMS.DLL" at base 5ca10000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\WLANAPI.DLL" at base 71ee0000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74db0000 "RdrCEF.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 0 "RdrCEF.exe" loaded module "ADVAPI32" at base 76100000 "RdrCEF.exe" loaded module "NTDLL.DLL" at base 77000000 "RdrCEF.exe" loaded module "WINHTTP.DLL" at base 71090000 "RdrCEF.exe" loaded module "WS2_32.DLL" at base 77160000 "RdrCEF.exe" loaded module "CRYPTSP.DLL" at base 74910000 "RdrCEF.exe" loaded module "CREDSSP.DLL" at base 745a0000 "RdrCEF.exe" loaded module "NSI.DLL" at base 77150000 "RdrCEF.exe" loaded module "OLEAUT32.DLL" at base 76310000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 748d0000 "RdrCEF.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 748c0000 "RdrCEF.exe" loaded module "RASADHLP.DLL" at base 71550000 "RdrCEF.exe" loaded module "DNSAPI.DLL" at base 74790000 "RdrCEF.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "RdrCEF.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 02d:T4e4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADcUlEQVR4XuWVy0tUURzH569o1WMRRFGtamFg0S43RQ8syhYZLqKCQKRNFIFhCxdGtAnbVOIiephhED3Ix6STWpom49T4mIfjqPO4d+6dp/rt/o7e67ln5uqdUAj6wYfhzJxzP9/zO2dmHI5/vQKBAAi/32+gvxcMBjE1NYVQKITp6WlGOBzGzMwMZmdnGUNDQxCfWVTxcp/PZwQguRiA5HyAubk5jI6Owu12W4eIbXNgI6BAFGBiYoIF9Xq9hUNEtMny/k3rCj2TOkUB6DWRSBjHKPod4a0OiOS0tqa6OhGtubY0Dk0h/WMQkcoKNp7X2pweGoTy+lXeWh3aeSQSYdJ0Og1JklgnxsfHzSFC2mSRzJgX4RNlSH11LY3HxxAq2Q3104eVcYF1PHoAar1+h+g9j8djDhHY4oBITrtESvtnhC9VsTEJ6TX9+9fS51prU9SR+w15a3VIFo1GEYvFEI/HGdQFWZYZRoBJbbJIWuuAaawF8B8ugfqt3xiLa/KYnLSU050wAng3OyCSHPlpGme0O6AMfIevopyNU6PuvDUi9JW1kiuKshLAo03eCOjMreSmAG5t8kZAX7tCclVVGUaAtaqjowPt7e0GnZ2djK6uLjidTnR3d6Onp4fhcrnQ29uL4eFh9ouoi0V5Mpm0H4Aukwidr06h/wiS0wXkW87LU6mU/QD0IBH9chHyxzYkrpyG/Oieqd2Fdq3LiwrAy/hbrZN4UAfZMwL5fJlJbCWnX0VC9FgWL+MvlbHblmYkXjRBvnhyVbEuz2QyDNFjWXnC5V0auw0FIR3aicTDhlXFvDybzdoPYJIt75CHhNLBXVAH+m2JiVwuZz+AKOMhmTrQB+loKeTbNbbExPz8vP0AopCHZPLNaihPGqG2PofyrGlNMbGwsGA/gNhWE0E/ovu2I9nngvK4EfGqCsTOHINcXwfpzi3Id2vzxMTi4qL9AGJbddT3bxErK0X8QjnUd23Iqgrbrdr6EtKN61Can2Jmzw6TnMQEleixLL6lRDrgg3S5Eon6WkQO7EVGlkxtZjum0F+cyPomTWJdXlQA/Rx14pVnWYjo8SNIOTvyzldsNS/lS/RYFr8zIl59FbFzp5B807Kq1Eqsl+ixLF5SSFiMlC/RY1m8qJCwGClfoseyRNnfCsUSPZYlLlyvEj3/b/0BO68O7y1qJHUAAAAASUVORK5CYII=2e:T5c7,--type=renderer --primordial-pipe-token=3E8B41073D92C8C744E025A281CCE8D3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.9.20044 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=3E8B41073D92C8C744E025A281CCE8D3 --renderer-client-id=2 --mojo-platform-channel-handle=1296 --allow-no-sandbox-job /prefetch:12f:T5c7,--type=renderer --primordial-pipe-token=01870A550D5F84ACC687E8FA8914F605 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.9.20044 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=01870A550D5F84ACC687E8FA8914F605 --renderer-client-id=3 --mojo-platform-channel-handle=1464 --allow-no-sandbox-job /prefetch:11d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3163f47f0820f5e4ac7a22d2fd55b19e363d529b3b8a36ea58756f6318550031","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1790553666977,"unified_at":"2026-09-28T00:01:06.977Z","metadata":{"hashes":{"sha256":"3163f47f0820f5e4ac7a22d2fd55b19e363d529b3b8a36ea58756f6318550031","sha1":"cbd9e480cdf40dad9627f6234528e3206e6fc331","md5":"b0924ba6cb4c264d0f64fd5232c5e404","sha512":"80c643ddcb18dc1fcd747f8eae13a605b73e7cb6ed538373207883c603b449ff2b7136cfa29b28e568f0352b29574adcd68b79bbece338faebbea8ae504e87bc","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"2013_Book_AppliedChemistry.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":9553550,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1698459725000,"last_seen":1699994133000,"last_multi_scan":1699994133000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":18,"suspicious_count":1,"malicious_count":0,"total":19},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"EXP/KAB.Talu.uifbz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"EXP/KAB.Talu","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Spearphishing Link","attack_id":"T1566.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1566/002","identifiers":[{"type":"informative","value":"PDF file has an embedded URL"}],"sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"AcroRd32.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.3508\" to \"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeSysFnt11.lst\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.9084753904663865","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/60 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"\" (Indicator: \"twitter\"; File: \"urlref_httpnews.stanford.edunews2007march14kondo-031407.html\")\n Found string \"\" (Indicator: \"twitter\"; File: \"urlref_httpnews.stanford.edunews2007march14kondo-031407.html\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"2013_Book_AppliedChemistry.pdf\" was detected as \"PDF\" and name: \"Format\"\n \"2013_Book_AppliedChemistry.pdf\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"General","name":"PDF file has an embedded URL","description":"$27","origin":"File/Memory","mitre_attack_id":"T1566.002","relevance":3,"id":"string-25","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"A9Rqhj3yf_1in7bw5_2pg.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rqhj3yf_1in7bw5_2pg.tmp]\n \"A9Rl52bud_1in7bw4_2pg.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rl52bud_1in7bw4_2pg.tmp]\n \"A9Rhayxvs_1in7bw7_2pg.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rhayxvs_1in7bw7_2pg.tmp]\n \"A9Rkyp8ev_1in7bw6_2pg.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rkyp8ev_1in7bw6_2pg.tmp]\n \"A9Rr4wet8_1in7bw2_2pg.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rr4wet8_1in7bw2_2pg.tmp]\n \"FAPE2B6.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\FAPE2B6.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$2b","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"stanford-white@2x.png\"\n Pattern match: \"footer-stanford-logo@2x.png\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"\n \"Local\\Acrobat Instance Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC\"\n \"com.adobe.acrobat.rna.RdrCefBrowserLock.DC\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RdrCEF.exe\" (UID: 00000000-00005332) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00000000-00005332)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=DA07B398D0615921583D9274 ...\" (UID: 00000000-00005600)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=9545E58A816DC91924A5CAF9 ...\" (UID: 00000000-00005532)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":181,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":31,"files_deleted_count":0,"registry_keys_created_count":19,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":24,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"653c77b0ae27cf25f309b6de","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"no specific threat","submit_name":"2013_Book_AppliedChemistry.pdf","analysis_start_time":"2023-10-28T02:53:37+00:00","indicators_count":{"informative":15,"suspicious":1,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"653c7710da57f0bc7202bd57","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"2013_Book_AppliedChemistry.pdf","analysis_start_time":"2023-10-28T02:50:57+00:00","indicators_count":{"informative":14,"suspicious":1,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"653c727928d9fc7447033eb6","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"2013_Book_AppliedChemistry.pdf","analysis_start_time":"2023-10-28T02:31:22+00:00","indicators_count":{"informative":15,"suspicious":1,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"653c704b950b17c9e20c5cfb","environment_id":400,"environment_description":"Mac Catalina 64 bit (x86)","state":"ERROR","error_type":"File \"2013_Book_AppliedChemistry.pdf\" was detected as \"pdf\", this format is not supported on MACOSX","verdict":"undetected","submit_name":"2013_Book_AppliedChemistry.pdf","analysis_start_time":"2023-10-28T02:22:04+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}],"processes":[{"pid":1572,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\2013_Book_AppliedChemistry.pdf\"","sha256":"08282d73af4eb97578ae8c7a341ca926e25910520b19f5531b8fbd77206c5ed2","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","uid":"00000000-00001572","icon":"$2d"},{"pid":3728,"ppid":1572,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"dd617e1f4e2102399e96bdfed412227453b4c71d84b891cf772e212762574e3f","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00001572","uid":"00000000-00003728"},{"pid":1728,"ppid":3728,"name":"RdrCEF.exe","command_line":"$2e","sha256":"dd617e1f4e2102399e96bdfed412227453b4c71d84b891cf772e212762574e3f","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00003728","uid":"00000000-00001728"},{"pid":4520,"ppid":3728,"name":"RdrCEF.exe","command_line":"$2f","sha256":"dd617e1f4e2102399e96bdfed412227453b4c71d84b891cf772e212762574e3f","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00003728","uid":"00000000-00004520"},{"pid":960,"ppid":1572,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"dd617e1f4e2102399e96bdfed412227453b4c71d84b891cf772e212762574e3f","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00000000-00001572","uid":"00000000-00000960"}],"all_imported_dlls":["mscms.dll","rasadhlp.dll","ccme_base_non_fips.dll","TextInputFramework.dll","AcGenral.dll","dwmapi.dll","AcroRd32.dll","cryptsp.dll","SensApi.dll","avrt.dll","CoolType.dll","DataExchange.dll","rmclient.dll","CoreUIComponents.dll","CoreMessaging.dll","rpcrt4.dll","ninput.dll","dcomp.dll","netapi32.dll","mlang.dll","cldapi.dll","FWPUCLNT.DLL","ccme_ecc.dll","sspicli.dll","msvcp_win.dll","oleaut32.dll","wininet.dll","GdiPlus.dll","cryptbase.dll","cfgmgr32.dll","msvcp100.dll","ieframe.dll","wsock32.dll","ws2_32.dll","user32.dll","IPHLPAPI.DLL","fltLib.dll","imagehlp.dll","BIB.dll","twinapi.appcore.dll","dpapi.dll","ccme_ecdrbg.dll","gdi32.dll","sechost.dll","userenv.dll","AdobeXMP.dll","clbcatq.dll","aepic.dll","psapi.dll","wow64win.dll","ole32.dll","gpapi.dll","AXE8SharedExpat.dll","OnDemandConnRouteHelper.dll","wkscli.dll","kernel.appcore.dll","AGM.dll","msasn1.dll","wow64.dll","shlwapi.dll","windows.storage.dll","d3d11.dll","WinTypes.dll","bcryptprimitives.dll","bcrypt.dll","msctf.dll","NPSWF32.dll","schannel.dll","ksuser.dll","msimg32.dll","winnsi.dll","cryptocme.dll","apphelp.dll","propsys.dll","dnsapi.dll","win32u.dll","ACE.dll","ucrtbase.dll","uxtheme.dll","coml2.dll","msvcrt.dll","shell32.dll","version.dll","crypt32.dll","secur32.dll","MMDevAPI.dll","devobj.dll","mswsock.dll","gdi32full.dll","kernel32.dll","advapi32.dll","powrprof.dll","ccme_asym.dll","SHCore.dll","sqlite.dll","BIBUtils.dll","WindowsCodecs.dll","KernelBase.dll","profapi.dll","imm32.dll","AXSLE.dll","thumbcache.dll","iertutil.dll","comctl32.dll","ntdll.dll","msacm32.dll","nsi.dll","ccme_base.dll","wow64cpu.dll","winmm.dll","mpr.dll","msvcr100.dll","dsound.dll","winhttp.dll","combase.dll","samcli.dll","ntmarta.dll","dxgi.dll","rsaenh.dll","netutils.dll","comdlg32.dll","urlmon.dll","winmmbase.dll","wshqos.dll","srvcli.dll","duser.dll","d3d9.dll","msvcr120.dll","setupapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wship6.dll","wlanapi.dll","wlanutil.dll","KBDUS.DLL","RpcRtRemote.dll","Wldap32.dll","WSHTCPIP.DLL","dhcpcsvc6.dll","wtsapi32.dll","webio.dll","rpcss.dll","hid.dll","credui.dll","WSDApi.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","cryptui.dll","nlaapi.dll","ncrypt.dll","oleacc.dll","dhcpcsvc.dll","libcef.dll","AudioSes.dll","msvcp120.dll","api-ms-win-downlevel-user32-l1-1-0.dll","netprofm.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wevtapi.dll","icudt.dll","dui70.dll","chrome_elf.dll","lpk.dll","npmproxy.dll","dxva2.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","dbghelp.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","credssp.dll","ExplorerFrame.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","AcroRd32Res.dll","tzres.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","normaliz.dll","DWrite.dll","d3d8thk.dll","VxSSL32.dll","wintrust.dll","oleaccrc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Annss.dat","sha256":"04534ad0dbd138269575c5002214f0fb207cf5f858921cafe0d490bc2c3bcc42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"Annssi.dat","sha256":"35d59cf3f1211607673cf5c045cc1091ec023ca340a470eb50a2a99c560bfd50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"Annssk.dat","sha256":"60a6fd4e806035293daf59f1af4140f9c50cf1d1333c98ba119585b10e2107e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"addressbook.acrodata","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"A9Rhayxvs_1in7bw7_2pg.tmp","sha256":"0e07cc568c6a9039584d1f267d6a2eb4cce1c83e27b79b588bd6406e6eb4772b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"A9Rkyp8ev_1in7bw6_2pg.tmp","sha256":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"A9Rl52bud_1in7bw4_2pg.tmp","sha256":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"A9Rqhj3yf_1in7bw5_2pg.tmp","sha256":"fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"A9Rr4wet8_1in7bw2_2pg.tmp","sha256":"b572c39b15d22f892554f5568a1586b589876c3fcdaa84c5477724b6fd3ef8cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"FAPE2B6.tmp","sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"AdobeFnt14.lst.3508","sha256":"757fda8727d14bcb30b296989e87397fdb09fc405ac7ebd013aecafd85596442","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"name":"urlref_httpnews.stanford.edunews2007march14kondo-031407.html","sha256":"5e78fa1fc2ef9d47c3c1a487c1d47ad2dd713da1ef19ab29d0d63cbe015274c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"data_1","sha256":"e504d1743dfc391d5f52d6d4be638545caa316537aa2b8890472f6b033ec03b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"Visited Links","sha256":"9d1c9dc432b2e97f7a54b4da2724e4ff96dc719e60cb89c9f82dbec9226856c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"A9R77ptl0_1mj9wvg_3z8.tmp","sha256":"42a850147cf596396bede5dab89e19580c09b58b610ece5e525b37618b4826d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"name":"A9Rsy54eg_ak70yv_17o.tmp","sha256":"42a850147cf596396bede5dab89e19580c09b58b610ece5e525b37618b4826d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-231028095331Z-33033","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-231028095331Z-33041","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-231028095332Z-33042","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%SAMPLEDIR%\\ProgramData","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-231028095332Z-33048","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"},{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"path":"pipe\\com.adobe.reader.rna.aLObKyx.DC.0","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"pipe\\com.adobe.reader.rna.aeuhgvk.DC.0","sources":[{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{707D65CA-1044-4129-93D3-147BF2DCAA75}","sources":[{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"653c7710da57f0bc7202bd57"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKLMHKLM\\SOFTWARE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\CHROMIUM\\\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\CHROMIUM\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\ADOBE\\ACROBAT READER\\DC\\EXITSECTION\\","sources":[{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"}]},{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]},{"name":"com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"653c77b0ae27cf25f309b6de"},{"report_type":"sandbox","report_id":"653c727928d9fc7447033eb6"}]}]}},"report_ids":{"sandbox_job_ids":["653c727928d9fc7447033eb6","653c77b0ae27cf25f309b6de","653c7710da57f0bc7202bd57"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious EXP/KAB.Talu Sample 3163f47f0820… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 3163f47f0820…. Malware family: EXP/KAB.Talu. Threat score 70/100. 1/28 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3163f47f0820f5e4ac7a22d2fd55b19e363d529b3b8a36ea58756f6318550031"}],["$","meta","4",{"property":"og:title","content":"Suspicious EXP/KAB.Talu Sample 3163f47f0820… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 3163f47f0820…. Malware family: EXP/KAB.Talu. Threat score 70/100. 1/28 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3163f47f0820f5e4ac7a22d2fd55b19e363d529b3b8a36ea58756f6318550031"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious EXP/KAB.Talu Sample 3163f47f0820… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 3163f47f0820…. Malware family: EXP/KAB.Talu. Threat score 70/100. 1/28 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]