I am new to malware analysis .. and I was analyzing some 'windows' apps and found functions that I thought it exist only on malware, is this possible or there is something wrong with my analysis ?
I am using Cuckoo sandbox .. the functions are:
IsDebuggerPresent .. and others as well
One of the app examples is AcroRd32.exe:
IsDebuggerPresent .. and this is its page on virustotal including all the information related to the sample in addition to the MD5.