Question
Analyzing a PDF File
Hello,
I recently have been analyzing a PDF file using different tools such as peepdf, pdf-parser, Process Monitor, Procdot, and VirusTotal. During my analyzation of the behavior of the file on VirusTotal, I noticed that there are a few files written that look concerning. Can anyone help me identify them and inform me of whether or not they are potentially malicious?
A brief description of the nature of the file is it is supposed to be a document that contains nothing but text.
Peepdf informed me that there are over one hundred compressed objects.
The following files are only a few concerning looking files dropped by the PDF file.
- C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF57dc10.TMP (copy)
- C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
- C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)
The following is a few of the many concerning files opened by the PDF file:
- C:\Users\<USER>\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.dbC:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b
- C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\Comctl32.dl
- C:\Program Files\Common Files\Microsoft Shared\OFFICE16\msoshext.dll
- C:\Program Files\Common Files\System\wab32.dll
- C:\Program Files\Google\Chrome\Application
- C:\Program Files\Google\Chrome\Application\97.0.4692.99
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\C:\Program Files\Windows Defender\ShellExt.dll
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\MEIPreload\manifest.json
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\MEIPreload\preloaded_data.pb
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\WidevineCdm\manifest.json
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\chrome.dll
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\chrome_100_percent.pak
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\chrome_200_percent.pak
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\chrome_elf.dll
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\default_apps\
- C:\Program Files\Google\Chrome\Application\97.0.4692.99\default_apps\external_extensions.json
Can anyone help explain what is going on?
AdChoices