analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

New Order.pdf.zip

Full analysis: https://app.any.run/tasks/f27f7b77-1439-45ab-beed-4e17cfc8bfca
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Analysis date: April 15, 2019, 13:21:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
hawkeye
evasion
trojan
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D6CDE87326D4AC8649CF08BB260D4D6B

SHA1:

51EF48F2EE3BE26C0EC4CF5BBC64067852BD8AAD

SHA256:

1E33E9A2E6FBC788D53F44F7D69D757CDC76A05F2636F4DF78348C9D9FE253DC

SSDEEP:

12288:1vcu0ysMJBMrT0CIoAc3lxYqQsJA7lxaqvM3csPbXyh:SyzrMnIojSqZqZRv0cs7yh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • New Order.pdf.bat (PID: 756)
      • New Order.pdf.bat (PID: 3048)
    • Detected Hawkeye Keylogger

      • New Order.pdf.bat (PID: 3048)
    • Stealing of credential data

      • vbc.exe (PID: 2000)
    • Actions looks like stealing of personal data

      • vbc.exe (PID: 2000)
  • SUSPICIOUS

    • Suspicious files were dropped or overwritten

      • WinRAR.exe (PID: 2668)
    • Starts application with an unusual extension

      • WinRAR.exe (PID: 2668)
      • New Order.pdf.bat (PID: 756)
    • Application launched itself

      • New Order.pdf.bat (PID: 756)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2668)
    • Checks for external IP

      • New Order.pdf.bat (PID: 3048)
    • Creates files in the user directory

      • New Order.pdf.bat (PID: 3048)
    • Executes scripts

      • New Order.pdf.bat (PID: 3048)
    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 2504)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: New Order.pdf.bat
ZipUncompressedSize: 704352
ZipCompressedSize: 500506
ZipCRC: 0x61309397
ZipModifyDate: 2019:04:15 04:43:11
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe new order.pdf.bat no specs #HAWKEYE new order.pdf.bat vbc.exe vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2668"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\New Order.pdf.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
756"C:\Users\admin\AppData\Local\Temp\Rar$DIa2668.411\New Order.pdf.bat" C:\Users\admin\AppData\Local\Temp\Rar$DIa2668.411\New Order.pdf.batWinRAR.exe
User:
admin
Company:
EVENHANDED10
Integrity Level:
MEDIUM
Description:
sententiosity9
Exit code:
0
Version:
1.09.0009
3048C:\Users\admin\AppData\Local\Temp\Rar$DIa2668.411\New Order.pdf.bat" C:\Users\admin\AppData\Local\Temp\Rar$DIa2668.411\New Order.pdf.bat
New Order.pdf.bat
User:
admin
Company:
EVENHANDED10
Integrity Level:
MEDIUM
Description:
sententiosity9
Version:
1.09.0009
2000C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
New Order.pdf.bat
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
2504C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holderwb.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeNew Order.pdf.bat
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Total events
541
Read events
514
Write events
27
Delete events
0

Modification events

(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2668) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\New Order.pdf.zip
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2668) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@C:\Windows\System32\acppage.dll,-6002
Value:
Windows Batch File
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
1
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2504vbc.exeC:\Users\admin\AppData\Local\Temp\holderwb.txt
MD5:
SHA256:
3048New Order.pdf.batC:\Users\admin\AppData\Roaming\pid.txttext
MD5:5DA713A690C067105AEB2FAE32403405
SHA256:46C1776477B5D00910AE5DF30970156C98B942253B2ABCF792E286C36DD1FE45
2668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2668.411\New Order.pdf.batexecutable
MD5:7A543F2A089B353B60C64ECB13A9D748
SHA256:CC50D6B53FE817DFD812D62A4A3CACA0B22341748D1190534031CF2AC12204E1
756New Order.pdf.batC:\Users\admin\AppData\Local\Temp\~DFA2718EB0BF84D9BC.TMPbinary
MD5:31E7AEB2B4D8254A2938034489D015DE
SHA256:4DD9CC250CCDFB0884BFB3C285DAAE66C767B7C6F106880F52CC1CDA3476CDEE
3048New Order.pdf.batC:\Users\admin\AppData\Roaming\pidloc.txttext
MD5:05198078F8EECB847734C6FE7D4BFA5B
SHA256:8499CC75D7050410FC18A3AB36B7F1879CA1C2FCB12A36256EFE6E24B479A165
2000vbc.exeC:\Users\admin\AppData\Local\Temp\holdermail.txttext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3048
New Order.pdf.bat
GET
403
104.16.154.36:80
http://whatismyipaddress.com/
US
text
100 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3048
New Order.pdf.bat
208.91.199.223:587
smtp.achievemormoney.com
PDR
US
shared
3048
New Order.pdf.bat
104.16.154.36:80
whatismyipaddress.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
whatismyipaddress.com
  • 104.16.154.36
  • 104.16.155.36
shared
smtp.achievemormoney.com
  • 208.91.199.223
  • 208.91.199.224
  • 208.91.198.143
  • 208.91.199.225
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3048
New Order.pdf.bat
A Network Trojan was detected
MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck)
3048
New Order.pdf.bat
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3048
New Order.pdf.bat
A Network Trojan was detected
ET TROJAN HawkEye Keylogger Report SMTP
2 ETPRO signatures available at the full report
No debug info