| File name: | CeraPro-Bold.otf |
| Full analysis: | https://app.any.run/tasks/407857ad-5219-4fd7-8700-782c77e5c50e |
| Verdict: | No threats detected |
| Analysis date: | March 29, 2019, 12:02:03 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/vnd.ms-opentype |
| File info: | OpenType font data |
| MD5: | C8088EA59AA9259A61322AAAE8F360C4 |
| SHA1: | 424060E9BBFDEF2D32156C621B60D573C1C0A941 |
| SHA256: | 17BE617672BFD809C624088C83936324F8568B20C12D6EBD88505FC63B9B1DF7 |
| SSDEEP: | 3072:fGry7JJlXsmSiTt77Wgoariy2aiZwSQ4cdRHdOEelW5Jm6JVR:f8ojcs77Wgoariy+ET |
MALICIOUS
No malicious indicators.SUSPICIOUS
Creates files in the Windows directory
- DllHost.exe (PID: 2412)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .otf | | | OpenType - CFF compact font format (100) |
|---|
EXIF
Font
| Copyright: | Copyright (c) 2015, 2018 by Jakob Runge, under exclusive license to TypeMates. All rights reserved. |
|---|---|
| FontFamily: | Cera Pro Bold |
| FontSubfamily: | Regular |
| FontSubfamilyID: | 6.000;MATE;CeraPro-Bold;2084;TR4-4.0.1.5095 |
| FontName: | Cera Pro Bold |
| NameTableVersion: | Version 6.0 | wf-rip DC20180515 |
| PostScriptFontName: | CeraPro-Bold |
| Manufacturer: | TypeMates, Runge Thomsen GbR |
| Designer: | Jakob Runge, with help of Lisa Fischbach, Irene Vlachou, Ilya Ruderman and Yury Ostromentsky |
| Description: | The pan-European Cera Collection is driven by pure geometry and contains the bestselling Cera plus Cera Condensed, its stenciled counterpart Cera Stencil, the hand-crafted display companion Cera Brush and soft Cera Round. This is the updated version from 2018, featuring improvements on Greek and Cyrillic script plus overall Kerning updates. |
| VendorURL: | www.typemates.com |
| DesignerURL: | www.jakob-runge.de |
| LicenseInfoURL: | https://www.typemates.com/licences/ |
| Copyright-en-US: | Copyright (c) 2015, 2018 by Jakob Runge, under exclusive license to TypeMates. All rights reserved. |
| FontFamily-en-US: | Cera Pro Bold |
| FontSubfamily-en-US: | Regular |
| FontSubfamilyID-en-US: | 6.000;MATE;CeraPro-Bold;2084;TR4-4.0.1.5095 |
| FontName-en-US: | CeraPro-Bold |
| NameTableVersion-en-US: | Version 6.0 | wf-rip DC20180515 |
| PostScriptFontName-en-US: | CeraPro-Bold |
| Manufacturer-en-US: | TypeMates, Runge Thomsen GbR |
| Designer-en-US: | Jakob Runge, with help of Lisa Fischbach, Irene Vlachou, Ilya Ruderman and Yury Ostromentsky |
| Description-en-US: | The pan-European Cera Collection is driven by pure geometry and contains the bestselling Cera plus Cera Condensed, its stenciled counterpart Cera Stencil, the hand-crafted display companion Cera Brush and soft Cera Round. This is the updated version from 2018, featuring improvements on Greek and Cyrillic script plus overall Kerning updates. |
| VendorURL-en-US: | www.typemates.com |
| DesignerURL-en-US: | www.jakob-runge.de |
| LicenseInfoURL-en-US: | https://www.typemates.com/licences/ |
| PreferredFamily-en-US: | Cera Pro |
| PreferredSubfamily-en-US: | Bold |
Total processes
35
Monitored processes
3
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1500 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\CeraPro-Bold.otf | C:\Windows\system32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2412 | C:\Windows\system32\DllHost.exe /Processid:{642EF9D6-48A5-476B-919A-A507CFD02C0F} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2812 | "C:\Windows\System32\fontview.exe" C:\Users\admin\AppData\Local\Temp\CeraPro-Bold.otf | C:\Windows\System32\fontview.exe | — | rundll32.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Font Viewer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
541
Read events
465
Write events
76
Delete events
0
Modification events
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.otf\OpenWithProgids |
| Operation: | write | Name: | otffile |
Value: | |||
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | LangID |
Value: 0904 | |||
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Windows\System32\fontview.exe |
Value: Windows Font Viewer | |||
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe |
Value: Adobe Acrobat Reader DC | |||
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Windows\eHome\ehshell.exe |
Value: Windows Media Center | |||
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\Internet Explorer\iexplore.exe |
Value: Internet Explorer | |||
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Windows\system32\mspaint.exe |
Value: Paint | |||
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Windows\system32\NOTEPAD.EXE |
Value: Notepad | |||
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\PROGRA~1\MICROS~1\Office14\OIS.EXE |
Value: Microsoft Office 2010 | |||
| (PID) Process: | (1500) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\Opera\Opera.exe |
Value: Opera Internet Browser | |||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2412 | DllHost.exe | C:\Windows\Fonts\CeraPro-Bold.otf | otf | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report