analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

cbae92f47ef31b8347dbc965764397fc.zip

Full analysis: https://app.any.run/tasks/489ddd33-3206-4158-a02e-af7ac019127b
Verdict: Malicious activity
Analysis date: June 27, 2022, 09:08:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

34F25C0D4CCED0216098DF6D0271C5B0

SHA1:

01D1196D99884BF5ACC2235D4EB2B53C7538D8B1

SHA256:

246B1467221ED13830AAFA8A167620CC055F8D7E1D274814AF59F72F444ED235

SSDEEP:

768:aPw3Uflz54K1/HtVy123EiPhCD2J0nlivjYOS/HxqE/1n2TjSMrj7E:AfjBy1XYJ0nw7Y//J2ZA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • RdrCEF.exe (PID: 3168)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2836)

    • Checks supported languages

      • WinRAR.exe (PID: 2836)

    • Drops a file with a compile date too recent

      • RdrCEF.exe (PID: 3168)

    • Reads default file associations for system extensions

      • AcroRd32.exe (PID: 3376)

    • Executed via COM

      • DllHost.exe (PID: 2604)

  • INFO

    • Checks supported languages

      • AcroRd32.exe (PID: 2328)
      • AcroRd32.exe (PID: 3376)
      • RdrCEF.exe (PID: 4008)
      • RdrCEF.exe (PID: 1972)
      • RdrCEF.exe (PID: 2172)
      • RdrCEF.exe (PID: 3168)
      • RdrCEF.exe (PID: 2784)
      • RdrCEF.exe (PID: 2612)
      • DllHost.exe (PID: 2604)
      • RdrCEF.exe (PID: 2996)

    • Reads the computer name

      • AcroRd32.exe (PID: 3376)
      • AcroRd32.exe (PID: 2328)
      • RdrCEF.exe (PID: 3168)
      • DllHost.exe (PID: 2604)

    • Reads CPU info

      • AcroRd32.exe (PID: 2328)

    • Searches for installed software

      • AcroRd32.exe (PID: 3376)
      • AcroRd32.exe (PID: 2328)

    • Manual execution by user

      • AcroRd32.exe (PID: 3376)

    • Application launched itself

      • AcroRd32.exe (PID: 3376)
      • RdrCEF.exe (PID: 3168)

    • Reads the hosts file

      • RdrCEF.exe (PID: 3168)

    • Reads settings of System Certificates

      • AcroRd32.exe (PID: 3376)
      • RdrCEF.exe (PID: 3168)

    • Checks Windows Trust Settings

      • AcroRd32.exe (PID: 3376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: crash-81154a65438ba5aaeca73fd502fa4850fbde60f8.tif
ZipUncompressedSize: 42224
ZipCompressedSize: 38008
ZipCRC: 0xf17b5ce8
ZipModifyDate: 2022:02:20 02:11:09
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
11
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs acrord32.exe acrord32.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs PhotoViewer.dll no specs

Process information

PID
CMD
Path
Indicators
Parent process
2836"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\cbae92f47ef31b8347dbc965764397fc.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
3376"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Explorer.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
20.13.20064.405839
2328"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=rendererC:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
20.13.20064.405839
3168"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
3221225547
Version:
20.13.20064.405839
2784"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1176,3745731671552507276,13818964381929950695,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5116789611713404080 --renderer-client-id=2 --mojo-platform-channel-handle=1184 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
2172"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1176,3745731671552507276,13818964381929950695,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=3147957792802413281 --mojo-platform-channel-handle=1212 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
4008"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1176,3745731671552507276,13818964381929950695,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=9465044304835843557 --mojo-platform-channel-handle=1448 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
1972"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1176,3745731671552507276,13818964381929950695,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=690738302295747521 --mojo-platform-channel-handle=1260 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
2612"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1176,3745731671552507276,13818964381929950695,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7421792312292348048 --renderer-client-id=6 --mojo-platform-channel-handle=1456 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
2996"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1176,3745731671552507276,13818964381929950695,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13260308477373662127 --renderer-client-id=7 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Total events
13 369
Read events
13 169
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
124
Text files
6
Unknown types
2

Dropped files

PID
Process
Filename
Type
3168RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0binary
MD5:F34432107C46AC7BADB92DC2EE578813
SHA256:8347A0C0B52C7532663BAC3683D44E1F751F70A17E4765287D0DBF56B5D9E75F
3168RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0binary
MD5:2A9F7B7D939102114D327688E4EFB99B
SHA256:701EB43FC74B7DFF1A2A66C34A70C615A6BFCB78224F0A45EC12C01FE60674D5
2836WinRAR.exeC:\Users\admin\Pictures\crash-81154a65438ba5aaeca73fd502fa4850fbde60f8.tifimage
MD5:CBAE92F47EF31B8347DBC965764397FC
SHA256:13B76234BB194C93A9A94653B4DD850BA5498F66F5F64E48E4109E7120CEDC71
3168RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0binary
MD5:39A7538348ABCFC6092A647FE164DAEF
SHA256:1E619FB01886CBB3D3302C8264FF442F6CC28B51CBEBEB4277394C3279E04E5B
3168RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0binary
MD5:749FEA0C25F578D6DFE5CE5967E1A4D3
SHA256:22C3954321E19CD6EB133C1AB08F1FD5F35F234903FED256DF7953E3BC2E47ED
3168RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0binary
MD5:F4E2D862E3843134710690A3A39D074B
SHA256:351D0EDC934BCBD4A14415B0AB76FF7C9315E6010FAE4A47FF549E00BA0CA060
3168RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0binary
MD5:A596267D8A5DC29502C28D88558575B2
SHA256:591B3F8A160D22EF9880E6EB3A66D5228E8FB101433DCC401BCC71903B56808C
3168RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0binary
MD5:B8D4355309952C28945C0901006AA334
SHA256:7564ECD86446674D2843D3CF3FE92BD12E79D5CF4C8749297519142098FACD16
3168RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0binary
MD5:2A5CDF3D50733DFA21513AAFB0D3C461
SHA256:EE94E848D37D402BECC847089DB2BCCFA743FB3D9240D27EAE9CFB17E1DF7024
3168RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0binary
MD5:B25290FAE470F72FC2DACC9A3BD7C742
SHA256:38AC87C1807E30BF95A4089C02AB108157E72EFFC6B009D4D20A5EF9AE741DD3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
13
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3168
RdrCEF.exe
23.35.236.137:443
geo2.adobe.com
Zayo Bandwidth Inc
US
suspicious
3376
AcroRd32.exe
23.48.23.34:443
acroipm2.adobe.com
TRUE INTERNET Co.,Ltd.
US
suspicious
3168
RdrCEF.exe
184.30.20.134:443
armmf.adobe.com
GTT Communications Inc.
US
suspicious
3168
RdrCEF.exe
54.144.73.197:443
p13n.adobe.io
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
acroipm2.adobe.com
  • 23.48.23.34
  • 23.48.23.54
whitelisted
armmf.adobe.com
  • 184.30.20.134
whitelisted
geo2.adobe.com
  • 23.35.236.137
whitelisted
p13n.adobe.io
  • 54.144.73.197
  • 18.207.85.246
  • 34.193.227.236
  • 107.22.247.231
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
cbae92f47ef31b8347dbc965764397fc.zip