analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FW Предложение за партньорство сезон 2019.msg

Full analysis: https://app.any.run/tasks/d4d27f5d-80fc-41aa-9dd5-efbbb6f573b8
Verdict: Malicious activity
Analysis date: December 14, 2018, 15:10:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

280D32D54652BB9502E37C12CAE16A3E

SHA1:

9AB49ACF80D6D2D3BE0A2E7775B62ED10D04243C

SHA256:

2B7825E5D4E690009B1D9564CA486FD2493FF2AB2353CA8EE571B8E340C64AC8

SSDEEP:

24576:L6SOMsUVuoDbBYysUNOAA/UCoM7fGBtVWTAy8nSC5mwFj1:5rDvBMUNO1UCoM70VWxobF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3000)
  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3000)
    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3000)
    • Creates files in the program directory

      • AdobeARM.exe (PID: 2832)
    • Executable content was dropped or overwritten

      • AdobeARM.exe (PID: 2832)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • OUTLOOK.EXE (PID: 3000)
    • Application launched itself

      • AcroRd32.exe (PID: 2748)
      • RdrCEF.exe (PID: 3452)
    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs adobearm.exe reader_sl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3000"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\FW Предложение за партньорство сезон 2019.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2748"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\NUV9N83G\Angel Landscape BG 2019.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
OUTLOOK.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
3996"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\NUV9N83G\Angel Landscape BG 2019.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
3452"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
3340"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3452.0.1928490094\1211236810" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2272"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3452.1.2100550012\1099524937" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2832"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:15.0 /MODE:3C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Reader and Acrobat Manager
Version:
1.824.27.2646
2540"C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe" C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exeAdobeARM.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat SpeedLauncher
Exit code:
0
Version:
15.23.20053.211670
Total events
1 801
Read events
1 357
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
3
Text files
53
Unknown types
13

Dropped files

PID
Process
Filename
Type
3000OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA1A2.tmp.cvr
MD5:
SHA256:
3000OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\NUV9N83G\Angel Landscape BG 2019 (2).pdf\:Zone.Identifier:$DATA
MD5:
SHA256:
3996AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
MD5:
SHA256:
3000OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BE6AF0EF.datimage
MD5:0757001978E464FFFBF76680D3C7339C
SHA256:673FEE1C4D689D2F1787EAF4DE269FD58325005D15BB582D3BD7626C169B5593
3000OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C4102779.datimage
MD5:654275BA194FDDA8D024544DBB79A2A4
SHA256:FB42FD53DE24D5A45CC0A8E6146D60991ABA9758C79B4B230FAE94F1627910C5
3000OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:5B7FAD7151D9F1B2B5C51F1A6A3F8220
SHA256:DCCEBA21754EEE31C827E2A05DC69A9D8AA7BEF1CECC4E12E632FE4C8CF695E8
3000OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3F5D3726.datimage
MD5:35DE4EBD686F84B66714079C3949A2BB
SHA256:755203EC11C038F3F623BD6274D4F0B88A251DD5C4A0D5458B4DCAFE9121C240
3000OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\NUV9N83G\Angel Landscape BG 2019.pdfpdf
MD5:D0BB4B4D37EB003DE5D7F5ED78C84AF7
SHA256:11554EF0BEF3E83E7ED2761139344A3AB93852112B32EFDB09E7178A8DEA0B40
3996AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R1sp715o_1get5mh_330.tmp
MD5:
SHA256:
3996AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rkybdoh_1get5mg_330.tmp
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
6
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3000
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
2748
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
whitelisted
2748
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
whitelisted
2748
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
whitelisted
2748
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip
unknown
whitelisted
2748
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/278_15_23_20070.zip
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2748
AcroRd32.exe
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
whitelisted
3000
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
whitelisted
2748
AcroRd32.exe
2.16.186.32:80
acroipm2.adobe.com
Akamai International B.V.
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
acroipm2.adobe.com
  • 2.16.186.32
  • 2.16.186.33
whitelisted
armmf.adobe.com
  • 2.18.233.74
whitelisted
ardownload2.adobe.com
  • 2.18.233.74
whitelisted

Threats

PID
Process
Class
Message
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
Generic Protocol Command Decode
SURICATA STREAM Packet with invalid ack
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
No debug info