File name:

RE REQUESTED PAYMENT DETAILS_pdf.r09

Full analysis: https://app.any.run/tasks/a77491fb-8ea4-41f8-be18-db437a6a5fc0
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Malware Trends Tracker     >>>
Analysis date: December 02, 2019, 18:06:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
hawkeye
evasion
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

5F611299062543F07CAE41ED48934FA7

SHA1:

E9516430E5177AA2615D3983237FFEAAAA0CD242

SHA256:

1DEDCE8398CBFE0D6927AD4EC3DDE805F7A34FF2075FD214CE75B0D86F30DFAF

SSDEEP:

12288:wtybIrUM3qIXtIJIGGO78coPW/JxwBUNah1qWxeB1WjsmfZRUs9oKo/NVQRZnRu:icIrl3qIXtrQVo+BxYUNah1qcenQZz94

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RE REQUESTED PAYMENT DETAILS_pdf.scr (PID: 3148)
      • RE REQUESTED PAYMENT DETAILS_pdf.scr (PID: 1036)
      • Windows Update.exe (PID: 2148)
      • Windows Update.exe (PID: 3980)
      • Windows Update.exe (PID: 1944)

    • Detected Hawkeye Keylogger

      • Windows Update.exe (PID: 1944)

    • Changes the autorun value in the registry

      • Windows Update.exe (PID: 1944)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 3692)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RE REQUESTED PAYMENT DETAILS_pdf.scr (PID: 1036)
      • WinRAR.exe (PID: 2236)
      • Windows Update.exe (PID: 1944)

    • Starts application with an unusual extension

      • RE REQUESTED PAYMENT DETAILS_pdf.scr (PID: 3148)

    • Application launched itself

      • RE REQUESTED PAYMENT DETAILS_pdf.scr (PID: 3148)
      • Windows Update.exe (PID: 3980)

    • Creates files in the user directory

      • RE REQUESTED PAYMENT DETAILS_pdf.scr (PID: 1036)
      • Windows Update.exe (PID: 1944)

    • Starts itself from another location

      • RE REQUESTED PAYMENT DETAILS_pdf.scr (PID: 1036)

    • Checks for external IP

      • Windows Update.exe (PID: 1944)

    • Executes scripts

      • Windows Update.exe (PID: 1944)

    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 1928)

  • INFO

    • Manual execution by user

      • RE REQUESTED PAYMENT DETAILS_pdf.scr (PID: 3148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 582534
UncompressedSize: 18386944
OperatingSystem: Win32
ModifyDate: 2000:04:28 16:23:20
PackingMethod: Normal
ArchivedFileName: RE REQUESTED PAYMENT DETAILS_pdf.scr
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe re requested payment details_pdf.scr no specs re requested payment details_pdf.scr windows update.exe no specs windows update.exe #HAWKEYE windows update.exe vbc.exe vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1036"C:\Users\admin\Desktop\RE REQUESTED PAYMENT DETAILS_pdf.scr" /SC:\Users\admin\Desktop\RE REQUESTED PAYMENT DETAILS_pdf.scr
RE REQUESTED PAYMENT DETAILS_pdf.scr
User:
admin
Company:
aSUS
Integrity Level:
MEDIUM
Exit code:
0
Version:
5.00
Modules
Images
c:\users\admin\desktop\re requested payment details_pdf.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1928C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holderwb.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe—Windows Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1944"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
Windows Update.exe
User:
admin
Company:
aSUS
Integrity Level:
HIGH
Exit code:
0
Version:
5.00
Modules
Images
c:\users\admin\appdata\roaming\windows update.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2148"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe—RE REQUESTED PAYMENT DETAILS_pdf.scr
User:
admin
Company:
aSUS
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
5.00
Modules
Images
c:\users\admin\appdata\roaming\windows update.exe
c:\systemroot\system32\ntdll.dll
2236"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RE REQUESTED PAYMENT DETAILS_pdf.r09.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3148"C:\Users\admin\Desktop\RE REQUESTED PAYMENT DETAILS_pdf.scr" /SC:\Users\admin\Desktop\RE REQUESTED PAYMENT DETAILS_pdf.scr—explorer.exe
User:
admin
Company:
aSUS
Integrity Level:
MEDIUM
Exit code:
0
Version:
5.00
Modules
Images
c:\users\admin\desktop\re requested payment details_pdf.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3692C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Windows Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3980"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
RE REQUESTED PAYMENT DETAILS_pdf.scr
User:
admin
Company:
aSUS
Integrity Level:
HIGH
Exit code:
0
Version:
5.00
Modules
Images
c:\users\admin\appdata\roaming\windows update.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
927
Read events
886
Write events
41
Delete events
0

Modification events

(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2236) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2236) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RE REQUESTED PAYMENT DETAILS_pdf.r09.rar
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2236) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@shell32,-10162
Value:
Screen saver
Executable files
3
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3692vbc.exeC:\Users\admin\AppData\Local\Temp\holdermail.txt —
MD5:—
SHA256:—
1928vbc.exeC:\Users\admin\AppData\Local\Temp\holderwb.txt —
MD5:—
SHA256:—
1036RE REQUESTED PAYMENT DETAILS_pdf.scrC:\Users\admin\AppData\Roaming\Windows Update.exeexecutable
MD5:—
SHA256:—
2236WinRAR.exeC:\Users\admin\Desktop\RE REQUESTED PAYMENT DETAILS_pdf.screxecutable
MD5:—
SHA256:—
3148RE REQUESTED PAYMENT DETAILS_pdf.scrC:\Users\admin\AppData\Local\Temp\~DF1BD1BD5C369D3816.TMPbinary
MD5:—
SHA256:—
1036RE REQUESTED PAYMENT DETAILS_pdf.scrC:\Users\admin\AppData\Local\Temp\SysInfo.txttext
MD5:—
SHA256:—
1944Windows Update.exeC:\Users\admin\AppData\Roaming\pidloc.txttext
MD5:E9FAEE87A060C806E7234779CFF7B480
SHA256:CE744D98EF602BA5FE207C4C064DA0075A1BB9BF303E53CA86AF1025AD3AFBF3
1944Windows Update.exeC:\Users\admin\AppData\Roaming\WindowsUpdate.exeexecutable
MD5:—
SHA256:—
3980Windows Update.exeC:\Users\admin\AppData\Local\Temp\~DF356D062CE9906871.TMPbinary
MD5:—
SHA256:—
1944Windows Update.exeC:\Users\admin\AppData\Roaming\pid.txttext
MD5:6F2688A5FCE7D48C8D19762B88C32C3B
SHA256:F513A0AA4F8F39744C6FDDF2B5EB18CC1EAC55CA866A1B243D835362A023F243
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
4
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
Windows Update.exe
GET
301
104.16.154.36:80
http://whatismyipaddress.com/
US
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1944
Windows Update.exe
104.16.154.36:80
whatismyipaddress.com
Cloudflare Inc
US
shared
1944
Windows Update.exe
104.16.154.36:443
whatismyipaddress.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
whatismyipaddress.com
  • 104.16.154.36
  • 104.16.155.36
shared
mail.vensoft.com
  • —
unknown

Threats

PID
Process
Class
Message
1944
Windows Update.exe
Potential Corporate Privacy Violation
ET POLICY Known External IP Lookup Service Domain in SNI
1944
Windows Update.exe
A Network Trojan was detected
SPYWARE [PTsecurity] HawkEye / Predator Pain (IP Chck)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RE REQUESTED PAYMENT DETAILS_pdf.r09