| File name: | pdf995s.exe |
| Full analysis: | https://app.any.run/tasks/14c22830-2581-4d08-9ae0-823c9dc53434 |
| Verdict: | Malicious activity |
| Analysis date: | September 19, 2019, 13:48:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 366966BC0C6DB4282F7810AB30B5EB0A |
| SHA1: | 095C5E808EB3AB57FC2EE03E5EDA0F8506A0AA84 |
| SHA256: | 1D0D994C1BD364912E7938105AA8AB2464EC87C23FA7EA357F7F65479B3D55E6 |
| SSDEEP: | 98304:pflB+5QuDG7f9PPAqpe28ijgVmw6JmunSpZlpjvxx7sCJvoG+jjDkfdY7VW6J02J:Zuy1PiCjA6RnSpBTxFzmgfdyWlYa5wZ |
MALICIOUS
Loads dropped or rewritten executable
- spoolsv.exe (PID: 1204)
Application was dropped or rewritten from another process
- xprights.exe (PID: 2060)
- splash.exe (PID: 3484)
- thinsetup.exe (PID: 4040)
- setup.exe (PID: 3420)
SUSPICIOUS
Creates files in the program directory
- thinsetup.exe (PID: 4040)
- setup.exe (PID: 3420)
- xprights.exe (PID: 2060)
Executable content was dropped or overwritten
- pdf995s.exe (PID: 2540)
- setup.exe (PID: 3420)
- spoolsv.exe (PID: 1204)
- thinsetup.exe (PID: 4040)
Creates files in the Windows directory
- xprights.exe (PID: 2060)
- spoolsv.exe (PID: 1204)
- setup.exe (PID: 3420)
Removes files from Windows directory
- spoolsv.exe (PID: 1204)
Creates a software uninstall entry
- setup.exe (PID: 3420)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | InstallShield setup (30.7) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (22.2) |
| .exe | | | Win64 Executable (generic) (19.7) |
| .exe | | | Winzip Win32 self-extracting archive (generic) (16.4) |
| .dll | | | Win32 Dynamic Link Library (generic) (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2009:11:02 21:24:15+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 77824 |
| InitializedDataSize: | 40960 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xaf1e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 02-Nov-2009 20:24:15 |
| Detected languages: |
|
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000F0 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 02-Nov-2009 20:24:15 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x00012775 | 0x00013000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.50172 |
.rdata | 0x00014000 | 0x00003822 | 0x00004000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.98675 |
.data | 0x00018000 | 0x0000E6E4 | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.97384 |
.rsrc | 0x00027000 | 0x00003BF0 | 0x00004000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.45282 |
_winzip_ | 0x0002B000 | 0x0056C000 | 0x0056C000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 7.99782 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.04402 | 1503 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 2.88823 | 296 | Latin 1 / Western European | English - United States | RT_ICON |
63 | 3.18826 | 764 | Latin 1 / Western European | English - United States | RT_STRING |
64 | 3.37002 | 1496 | Latin 1 / Western European | English - United States | RT_STRING |
65 | 3.39511 | 2382 | Latin 1 / Western European | English - United States | RT_STRING |
66 | 3.44643 | 2322 | Latin 1 / Western European | English - United States | RT_STRING |
67 | 3.39393 | 1278 | Latin 1 / Western European | English - United States | RT_STRING |
100 | 3.08197 | 290 | Latin 1 / Western European | English - United States | RT_DIALOG |
126 | 3.58134 | 1304 | Latin 1 / Western European | English - United States | RT_STRING |
127 | 2.47759 | 110 | Latin 1 / Western European | English - United States | RT_STRING |
Imports
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
Total processes
40
Monitored processes
7
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1204 | C:\Windows\System32\spoolsv.exe | C:\Windows\System32\spoolsv.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Spooler SubSystem App Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2060 | "C:\Program Files\pdf995\res\drivedir\xprights.exe" | C:\Program Files\pdf995\res\drivedir\xprights.exe | — | setup.exe | |||||||||||
User: admin Integrity Level: HIGH Description: xprights MFC Application Exit code: 0 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
| 2540 | "C:\Users\admin\AppData\Local\Temp\pdf995s.exe" | C:\Users\admin\AppData\Local\Temp\pdf995s.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3420 | "C:\Program Files\pdf995\setup.exe" | C:\Program Files\pdf995\setup.exe | thinsetup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: pdf995 Setup Exit code: 0 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
| 3484 | .\pdf995\splash.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\splash.exe | — | pdf995s.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3732 | "C:\Users\admin\AppData\Local\Temp\pdf995s.exe" | C:\Users\admin\AppData\Local\Temp\pdf995s.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 4040 | thinsetup.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\thinsetup.exe | splash.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
Total events
880
Read events
195
Write events
683
Delete events
2
Modification events
| (PID) Process: | (4040) thinsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\PDF995 |
| Operation: | write | Name: | Path |
Value: C:\Program Files\ | |||
| (PID) Process: | (3420) setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5934d3ef-d045-449a-b382-6c598703b039} |
| Operation: | write | Name: | AppName |
Value: pdfsave.exe | |||
| (PID) Process: | (3420) setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5934d3ef-d045-449a-b382-6c598703b039} |
| Operation: | write | Name: | AppPath |
Value: C:\Program Files\pdf995\res\drivedir | |||
| (PID) Process: | (3420) setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5934d3ef-d045-449a-b382-6c598703b039} |
| Operation: | write | Name: | Policy |
Value: 3 | |||
| (PID) Process: | (1204) spoolsv.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDF995 Monitor |
| Operation: | write | Name: | Driver |
Value: pdf995mon.dll | |||
| (PID) Process: | (1204) spoolsv.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows NT x86\Drivers\Version-3\PDF995 Printer Driver |
| Operation: | write | Name: | Dependent Files |
Value: pdf995.INI | |||
| (PID) Process: | (1204) spoolsv.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows NT x86\Drivers\Version-3\PDF995 Printer Driver |
| Operation: | write | Name: | Configuration File |
Value: pdf995ps5ui.dll | |||
| (PID) Process: | (1204) spoolsv.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows NT x86\Drivers\Version-3\PDF995 Printer Driver |
| Operation: | write | Name: | Data File |
Value: pdf995ps5.ppd | |||
| (PID) Process: | (1204) spoolsv.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows NT x86\Drivers\Version-3\PDF995 Printer Driver |
| Operation: | write | Name: | Driver |
Value: pscript5-32.dll | |||
| (PID) Process: | (1204) spoolsv.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows NT x86\Drivers\Version-3\PDF995 Printer Driver |
| Operation: | write | Name: | Help File |
Value: Pdf995Pscript.hlp | |||
Executable files
60
Suspicious files
12
Text files
113
Unknown types
35
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\readme.html | html | |
MD5:— | SHA256:— | |||
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\res\drivedir\._order_button2.gif | ad | |
MD5:965214A4C0D81987CBF423746B32A250 | SHA256:AD0099E60257D52612BC784162F004131C943E76B94DCED571490F9968AEF98A | |||
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\res\drivedir\._rates_button.gif | ad | |
MD5:965214A4C0D81987CBF423746B32A250 | SHA256:AD0099E60257D52612BC784162F004131C943E76B94DCED571490F9968AEF98A | |||
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\res\drivedir\._order_button.gif | ad | |
MD5:965214A4C0D81987CBF423746B32A250 | SHA256:AD0099E60257D52612BC784162F004131C943E76B94DCED571490F9968AEF98A | |||
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\res\drivedir\995.css | text | |
MD5:6CEFAFFF6FA9C049C9FC0BCE24AD2897 | SHA256:8F9A0FB91CB5FC4B3D9670F3AE04BD4777FA3D5C67D17C52E712C1AAFB508827 | |||
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\res\drivedir\COPYING | text | |
MD5:ECA1DE0BB44B5A08FB2A49EA070DB87A | SHA256:B15F41248F0957EDFD2D91202EE810A6EF2D92C0256D330585D806677306A706 | |||
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\res\drivedir\copy64.exe | executable | |
MD5:ED0CD2811370397028931BA6C4956A00 | SHA256:B2A8C1400A7351E1EC66D4C9AEDC0316EC1EAF23DDD7236739303EB57756C19E | |||
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\res\drivedir\._masthead_rule.gif | ad | |
MD5:965214A4C0D81987CBF423746B32A250 | SHA256:AD0099E60257D52612BC784162F004131C943E76B94DCED571490F9968AEF98A | |||
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\res\drivedir\dfdevmdsubtable.dat | dbf | |
MD5:677BAD8E6091D6A5C756AC22C71E49A0 | SHA256:AE7B2955AE80F859A44DE8FC02ACD5F5648C5EC12068CA7F570ECBCF91E00417 | |||
| 2540 | pdf995s.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\res\drivedir\dot.gif | image | |
MD5:5180EACA74B427D3777168FDF8175D25 | SHA256:6CE9D8B4BFFA12AC1295DA36A8D7B0CA2A70D75EDF68F9194564496BAC84A679 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report