analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Proforma Invoice.pdf.z

Full analysis: https://app.any.run/tasks/b12de299-5af5-49b2-9ba3-d1f74582f74d
Verdict: Malicious activity
Analysis date: November 08, 2019, 14:07:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

665E755A6833F8474A7AAFC26277A131

SHA1:

F940BC3D676F266EFCAAF7803E8ECA25955E5132

SHA256:

0D27C8AE06B6E72BD7E7DFADA7E2E8BA13FE3D921B243E67C8C0A0C5FCBFDE27

SSDEEP:

1536:LFEHVsct/nnMkonDBxxuAjr0mNxpNHeMK7aqJ:La+cpGDBNv/dvs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • WScript.exe (PID: 2148)
      • wscript.exe (PID: 1936)
    • Writes to a start menu file

      • WScript.exe (PID: 2148)
      • wscript.exe (PID: 1936)
  • SUSPICIOUS

    • Application launched itself

      • WScript.exe (PID: 2148)
    • Creates files in the user directory

      • WScript.exe (PID: 2148)
    • Executes scripts

      • WScript.exe (PID: 2148)
    • Checks for external IP

      • wscript.exe (PID: 1936)
    • Connects to unusual port

      • wscript.exe (PID: 1936)
  • INFO

    • Manual execution by user

      • WScript.exe (PID: 2148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe wscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
2400"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Proforma Invoice.pdf.z.rar"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2148"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\Proforma Invoice.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
1936"C:\Windows\System32\wscript.exe" "C:\Users\admin\AppData\Roaming\Proforma Invoice.js"C:\Windows\System32\wscript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
Total events
729
Read events
678
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2400.6701\Proforma Invoice.js
MD5:
SHA256:
1936wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proforma Invoice.jstext
MD5:E11C4858C73A9F7FC1E62D56997C596B
SHA256:22D987EB8983590955A24C3458DFD18F192BB1DBD91E82F99A5DA47D7248C866
1936wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\json[1]text
MD5:EDDC6D7FB711F8C575D6403158C125A7
SHA256:8B3AD9A3A2FA90BD8A76F814565B13E4EC0612F9FAB812A2CC4C3C2C731BD763
2148WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proforma Invoice.jstext
MD5:E11C4858C73A9F7FC1E62D56997C596B
SHA256:22D987EB8983590955A24C3458DFD18F192BB1DBD91E82F99A5DA47D7248C866
2148WScript.exeC:\Users\admin\AppData\Roaming\Proforma Invoice.jstext
MD5:E11C4858C73A9F7FC1E62D56997C596B
SHA256:22D987EB8983590955A24C3458DFD18F192BB1DBD91E82F99A5DA47D7248C866
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1936
wscript.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
text
296 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1936
wscript.exe
79.134.225.103:7775
Andreas Fink trading as Fink Telecom Services
CH
malicious
1936
wscript.exe
208.95.112.1:80
ip-api.com
IBURST
malicious

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared

Threats

PID
Process
Class
Message
1936
wscript.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
1936
wscript.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
No debug info