analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

invoice.pdf.zip

Full analysis: https://app.any.run/tasks/19a323ca-5ddb-4ba9-9010-551590ce5d67
Verdict: Malicious activity
Analysis date: December 06, 2019, 19:28:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
phish-microsoft
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1E8229F9D2B22ABC161C28FB0B0C214D

SHA1:

94A1319DF83278A010200E0E93862A9AD805EDB9

SHA256:

09CB4488F9636F855C229FB6AE9C34B36E7AD95CEB947222FC4913F5B1C62A3B

SSDEEP:

384:J3u58TdWyiJkVLqXc99opBJ4wL6LztB1IcP:BLhiLs9a5/L6LztXP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Microsoft phishing page detected

      • iexplore.exe (PID: 2156)

  • SUSPICIOUS

    • Starts Internet Explorer

      • AcroRd32.exe (PID: 2816)

    • Creates files in the program directory

      • AdobeARM.exe (PID: 640)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2196)
      • RdrCEF.exe (PID: 1884)

    • Changes internet zones settings

      • iexplore.exe (PID: 2196)

    • Manual execution by user

      • AcroRd32.exe (PID: 2816)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2156)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2156)

    • Reads the hosts file

      • RdrCEF.exe (PID: 1884)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2196)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2196)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:12:06 19:27:24
ZipCRC: 0x49da7f2a
ZipCompressedSize: 15414
ZipUncompressedSize: 16910
ZipFileName: invoice.pdf
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs acrord32.exe acrord32.exe no specs iexplore.exe iexplore.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs adobearm.exe no specs reader_sl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
504"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\invoice.pdf.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2816"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\invoice.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
720"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Desktop\invoice.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
2196"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
AcroRd32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2156"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2196 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1884"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2728"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="1884.0.1239970185\1548855391" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
3828"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="1884.1.2033873953\1485360610" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
640"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:15.0 /MODE:3C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Reader and Acrobat Manager
Version:
1.824.27.2646
2724"C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe" C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe—AdobeARM.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat SpeedLauncher
Exit code:
0
Version:
15.23.20053.211670
Total events
1 071
Read events
912
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
72
Unknown types
20

Dropped files

PID
Process
Filename
Type
504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa504.4302\invoice.pdf —
MD5:—
SHA256:—
720AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
2196iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2196iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2156iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7B2E11HQ\login[1].php —
MD5:—
SHA256:—
720AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rmkt8ds_i96i7a_k0.tmp —
MD5:—
SHA256:—
720AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagessqlite
MD5:71289F8F8D3000638A846F994C51E52B
SHA256:A67239B25EF289BB16B95FEB12A1D0A77FEF6772CD26901970BCE3116D81FCB9
720AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R11he1kd_i96i7b_k0.tmp —
MD5:—
SHA256:—
720AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\UserCache.binbinary
MD5:D7DB5F25754551168468AF2961FEB572
SHA256:72B9A4B20D3EAD1F94262B733C1BE38D7B204C7A0A316F4EEFCF8ECD0DEFA58A
720AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rt3dhl0_i96i7d_k0.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
42
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2816
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
—
—
whitelisted
2816
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip
unknown
—
—
whitelisted
2816
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/278_15_23_20070.zip
unknown
—
—
whitelisted
2816
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
—
—
whitelisted
2156
iexplore.exe
GET
200
143.95.72.225:80
http://phoebesisson.com/files/converged.css
US
text
21.4 Kb
suspicious
2816
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
—
—
whitelisted
2156
iexplore.exe
GET
200
143.95.72.225:80
http://phoebesisson.com/files/prefetch_data/staticStylesFluent.css
US
text
20.6 Kb
suspicious
2156
iexplore.exe
GET
200
143.95.72.225:80
http://phoebesisson.com/files/convergedlogin_pcore.js
US
text
146 Kb
suspicious
2156
iexplore.exe
GET
200
143.95.72.225:80
http://phoebesisson.com/files/prefetch_data/prefetch.htm
US
html
1.16 Kb
suspicious
2156
iexplore.exe
GET
200
143.95.72.225:80
http://phoebesisson.com/files/convergedloginpaginatedstrings-en.js
US
text
9.63 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2196
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2816
AcroRd32.exe
23.210.248.251:443
armmf.adobe.com
Akamai International B.V.
NL
whitelisted
2156
iexplore.exe
143.95.72.225:443
phoebesisson.com
Colo4, LLC
US
suspicious
—
—
23.210.248.251:443
armmf.adobe.com
Akamai International B.V.
NL
whitelisted
2816
AcroRd32.exe
2.16.186.97:80
acroipm2.adobe.com
Akamai International B.V.
—
whitelisted
2156
iexplore.exe
104.108.58.87:443
secure.aadcdn.microsoftonline-p.com
Akamai Technologies, Inc.
NL
unknown
2156
iexplore.exe
23.210.248.93:443
r4.res.office365.com
Akamai International B.V.
NL
whitelisted
2156
iexplore.exe
143.95.72.225:80
phoebesisson.com
Colo4, LLC
US
suspicious
2196
iexplore.exe
104.108.58.87:443
secure.aadcdn.microsoftonline-p.com
Akamai Technologies, Inc.
NL
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
phoebesisson.com
  • 143.95.72.225
suspicious
secure.aadcdn.microsoftonline-p.com
  • 104.108.58.87
whitelisted
acroipm2.adobe.com
  • 2.16.186.97
  • 2.16.186.57
whitelisted
armmf.adobe.com
  • 23.210.248.251
whitelisted
r4.res.office365.com
  • 23.210.248.93
whitelisted
ardownload2.adobe.com
  • 23.210.248.251
whitelisted

Threats

PID
Process
Class
Message
2156
iexplore.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Microsoft Phishing Landing 2018-08-07
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
invoice.pdf.zip