analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ORDER _REQUIRMENT-pdf.7z

Full analysis: https://app.any.run/tasks/d5799419-7ce1-4690-aed3-5513721cc3f2
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: September 30, 2020, 11:40:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
agenttesla
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

FAC0600E68996B83B16BA807982C794D

SHA1:

4A36A56B212064C3F3C0F6735BADB3D63C735D44

SHA256:

1F1BBE061B7A239D1FCA44939347A10122C3A6EE2B350FC5D50F8D200AF6281D

SSDEEP:

12288:PcY4s5FjJUrq7MSrwb+Kb3mFH1VB4sTRWm4xUfkfKRY62yVdzr/N00mZ:PcY4sb9FHwb+I3mV1VB4sTRixUfkjyVA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ORDER REQUIRMENT-pdf.exe (PID: 2316)
      • ORDER REQUIRMENT-pdf.exe (PID: 2176)
    • Actions looks like stealing of personal data

      • ORDER REQUIRMENT-pdf.exe (PID: 2176)
    • AGENTTESLA was detected

      • ORDER REQUIRMENT-pdf.exe (PID: 2176)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1920)
    • Application launched itself

      • ORDER REQUIRMENT-pdf.exe (PID: 2316)
  • INFO

    • Manual execution by user

      • ORDER REQUIRMENT-pdf.exe (PID: 2316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: ORDER REQUIRMENT-pdf.exe
ZipUncompressedSize: 696320
ZipCompressedSize: 639195
ZipCRC: 0x58498a23
ZipModifyDate: 2020:09:30 10:09:01
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe order requirment-pdf.exe no specs #AGENTTESLA order requirment-pdf.exe

Process information

PID
CMD
Path
Indicators
Parent process
1920"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ORDER _REQUIRMENT-pdf.7z.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2316"C:\Users\admin\Desktop\ORDER REQUIRMENT-pdf.exe" C:\Users\admin\Desktop\ORDER REQUIRMENT-pdf.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
drawableObjects
Exit code:
0
Version:
1.0.0.0
2176"{path}"C:\Users\admin\Desktop\ORDER REQUIRMENT-pdf.exe
ORDER REQUIRMENT-pdf.exe
User:
admin
Integrity Level:
MEDIUM
Description:
drawableObjects
Version:
1.0.0.0
Total events
503
Read events
483
Write events
20
Delete events
0

Modification events

(PID) Process:(1920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1920) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ORDER _REQUIRMENT-pdf.7z.zip
(PID) Process:(1920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2176) ORDER REQUIRMENT-pdf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ORDER REQUIRMENT-pdf_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2176) ORDER REQUIRMENT-pdf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ORDER REQUIRMENT-pdf_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1920WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1920.40034\ORDER REQUIRMENT-pdf.exeexecutable
MD5:AB6B68B06433E5B246D5AE6FBDE2CCF0
SHA256:013673B59FEE90117AF775D9EDAEE5892548013B120A526EBF992B1E19FCBC1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2176
ORDER REQUIRMENT-pdf.exe
98.142.108.42:31792
ftp.ayudasaudiovisuales.com
HostDime.com, Inc.
FR
malicious
2176
ORDER REQUIRMENT-pdf.exe
98.142.108.42:21
ftp.ayudasaudiovisuales.com
HostDime.com, Inc.
FR
malicious

DNS requests

Domain
IP
Reputation
ftp.ayudasaudiovisuales.com
  • 98.142.108.42
malicious

Threats

PID
Process
Class
Message
2176
ORDER REQUIRMENT-pdf.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2176
ORDER REQUIRMENT-pdf.exe
A Network Trojan was detected
ET TROJAN AgentTesla Exfil via FTP
2176
ORDER REQUIRMENT-pdf.exe
A Network Trojan was detected
ET TROJAN AgentTesla HTML System Info Report Exfil via FTP
2176
ORDER REQUIRMENT-pdf.exe
A Network Trojan was detected
SPYWARE [PTsecurity] AgentTesla Exfiltration
2176
ORDER REQUIRMENT-pdf.exe
A Network Trojan was detected
ET TROJAN AgentTesla HTML System Info Report Exfil via FTP
2176
ORDER REQUIRMENT-pdf.exe
A Network Trojan was detected
SPYWARE [PTsecurity] AgentTesla Exfiltration
2 ETPRO signatures available at the full report
No debug info