Malware analysis SumatraPDF-3.5.2-64-install.exe Malicious activity

Add for printing

File name:	SumatraPDF-3.5.2-64-install.exe
Full analysis:	https://app.any.run/tasks/4fc988c1-80b4-4dd0-98ee-338121dbd468
Verdict:	Malicious activity
Threats:	Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	August 26, 2024, 04:36:24
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	stealer
Indicators:
MIME:	application/x-dosexec
File info:	PE32+ executable (GUI) x86-64, for MS Windows
MD5:	D3269F0F422D36F24E62BD30AE722BFD
SHA1:	A700ECAB3628239A7C2831B4F74487419D9AA850
SHA256:	2BE4A27B83830EA07C6671C3557673D509544E5F70FC6B2DC8CC4388B302C1F2
SSDEEP:	98304:3mbOnSsrr4h9sHMnF3XTVj5BTwioQy2nUiCFcJzXqnMZu70ho/7qx2bxt6Vng3sz:/4h9sHo2cFpvSJWv6SNlt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Actions looks like stealing of personal data
  - SumatraPDF.exe (PID: 7032)
SUSPICIOUS
- Creates a software uninstall entry
  - SumatraPDF-3.5.2-64-install.exe (PID: 6680)
- Drops the executable file immediately after the start
  - SumatraPDF-3.5.2-64-install.exe (PID: 6680)
- Executable content was dropped or overwritten
  - SumatraPDF-3.5.2-64-install.exe (PID: 6680)
- Explorer used for Indirect Command Execution
  - explorer.exe (PID: 6956)
- Searches for installed software
  - SumatraPDF.exe (PID: 7032)
- Reads security settings of Internet Explorer
  - SumatraPDF.exe (PID: 7032)
INFO
- Checks supported languages
  - SumatraPDF-3.5.2-64-install.exe (PID: 6680)
  - SumatraPDF.exe (PID: 7032)
- Creates files or folders in the user directory
  - SumatraPDF-3.5.2-64-install.exe (PID: 6680)
  - SumatraPDF.exe (PID: 7032)
- Reads CPU info
  - SumatraPDF-3.5.2-64-install.exe (PID: 6680)
  - SumatraPDF.exe (PID: 7032)
- Reads the computer name
  - SumatraPDF-3.5.2-64-install.exe (PID: 6680)
  - SumatraPDF.exe (PID: 7032)
- Reads security settings of Internet Explorer
  - explorer.exe (PID: 6992)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (87.3)
.exe	\|	Generic Win/DOS Executable (6.3)
.exe	\|	DOS Executable Generic (6.3)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2023:10:25 08:17:48+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	14.37
CodeSize:	1192960
InitializedDataSize:	7072256
UninitializedDataSize:	-
EntryPoint:	0xeb990
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI
FileVersionNumber:	3.5.2.0
ProductVersionNumber:	3.5.2.0
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Windows, Latin1
FileDescription:	SumatraPDF
FileVersion:	3.5.2
LegalCopyright:	Copyright 2006-2022 all authors (GPLv3)
ProductName:	SumatraPDF
ProductVersion:	3.5.2
CompanyName:	Krzysztof Kowalczyk

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

134

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

6680

"C:\Users\admin\Desktop\SumatraPDF-3.5.2-64-install.exe"

C:\Users\admin\Desktop\SumatraPDF-3.5.2-64-install.exe

explorer.exe

User:

admin

Company:

Krzysztof Kowalczyk

Integrity Level:

MEDIUM

Description:

SumatraPDF

Exit code:

Version:

3.5.2

Modules

Images
c:\users\admin\desktop\sumatrapdf-3.5.2-64-install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

6956

"C:\WINDOWS\explorer.exe" "C:\Users\admin\AppData\Local\SumatraPDF\SumatraPDF.exe"

C:\Windows\explorer.exe

—

SumatraPDF-3.5.2-64-install.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Explorer

Exit code:

Version:

10.0.19041.3758 (WinBuild.160101.0800)

Modules

Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\twinapi.dll

6992

C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\explorer.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Explorer

Version:

10.0.19041.3758 (WinBuild.160101.0800)

Modules

Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll

7032

"C:\Users\admin\AppData\Local\SumatraPDF\SumatraPDF.exe"

C:\Users\admin\AppData\Local\SumatraPDF\SumatraPDF.exe

explorer.exe

User:

admin

Company:

Krzysztof Kowalczyk

Integrity Level:

MEDIUM

Description:

SumatraPDF

Version:

3.5.2

Modules

Images
c:\users\admin\appdata\local\sumatrapdf\sumatrapdf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll

Add for printing

Total events

15 962

Read events

15 623

Write events

310

Delete events

Modification events


(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:	write	Name:	GlobalAssocChangedCounter
Value: 93
(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CLASSES_ROOT\.pdf\OpenWithProgids
Operation:	delete value	Name:	SumatraPDF
Value:
(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CLASSES_ROOT\.pdf\OpenWithProgids
Operation:	delete key	Name:	(default)
Value:
(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CLASSES_ROOT\.pdf
Operation:	delete key	Name:	(default)
Value:
(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CLASSES_ROOT\.xps
Operation:	delete key	Name:	(default)
Value:
(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CLASSES_ROOT\.epub\OpenWithProgids
Operation:	delete value	Name:	SumatraPDF
Value:
(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CLASSES_ROOT\.epub\OpenWithProgids
Operation:	delete key	Name:	(default)
Value:
(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CLASSES_ROOT\.epub
Operation:	delete key	Name:	(default)
Value:
(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CLASSES_ROOT\.tif\OpenWithProgids
Operation:	delete value	Name:	SumatraPDF
Value:
(PID) Process:	(6680) SumatraPDF-3.5.2-64-install.exe	Key:	HKEY_CLASSES_ROOT\.tiff\OpenWithProgids
Operation:	delete value	Name:	SumatraPDF
Value:

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6680	SumatraPDF-3.5.2-64-install.exe	C:\Users\admin\AppData\Local\SumatraPDF\SumatraPDF.exe		executable
		MD5:D3269F0F422D36F24E62BD30AE722BFD	SHA256:2BE4A27B83830EA07C6671C3557673D509544E5F70FC6B2DC8CC4388B302C1F2
6680	SumatraPDF-3.5.2-64-install.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\SumatraPDF.lnk		lnk
		MD5:F3FB7EBE3404764BB1EF812271B81FDD	SHA256:CFBC8596C24BAAF3FF9272B29F1E459845D1F8699A469FF3C7A1DCEEAD93DBA2
6680	SumatraPDF-3.5.2-64-install.exe	C:\Users\admin\AppData\Local\SumatraPDF\PdfFilter.dll		executable
		MD5:4B0BFCA0BFE30ED332563E79A543ED01	SHA256:146A5D51283A0E6B43D6AC40C66EB9DF53C9BF9149B52D701C4F9C721123D925
6680	SumatraPDF-3.5.2-64-install.exe	C:\Users\admin\Desktop\SumatraPDF.lnk		binary
		MD5:5E7739234B60838E8063CD778363B5B5	SHA256:DFE0F8836DBA1C44F0EB3A47143A050F179F2E9A67762F45BD4B667D01DBAF73
6680	SumatraPDF-3.5.2-64-install.exe	C:\Users\admin\AppData\Local\SumatraPDF\libmupdf.dll		executable
		MD5:2989996C4C89A17B6F35474C280A24FA	SHA256:178784BD40FFC21A8E7112F68949880CFA53AD3A6DE3B5AB6888BC8F569C6A4A
6680	SumatraPDF-3.5.2-64-install.exe	C:\Users\admin\AppData\Local\SumatraPDF\PdfPreview.dll		executable
		MD5:3D10C29D30CE8F7E32D4B935E841F5F8	SHA256:DD9CECB08558949E75D3EB147777C0B58EAC8A691755293C33D6E7016F4DD173
7032	SumatraPDF.exe	C:\Users\admin\AppData\Local\SumatraPDF\SumatraPDF-settings.txt		text
		MD5:8499D8CC3C5D8ABA04F6EBE478F7A35D	SHA256:452852D898572A91D57B6FD77291F56423614EBE1209ABB36F519EF1077A6C33

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2384	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6148	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
6148	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3180	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
2120	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2180	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
3260	svchost.exe	40.113.103.199:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
2120	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2384	svchost.exe	20.190.160.22:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2384	svchost.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
2120	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 20.73.194.208 51.104.136.2	whitelisted
google.com	216.58.212.174	whitelisted
client.wns.windows.com	40.113.103.199	whitelisted
login.live.com	20.190.160.22 40.126.32.133 40.126.32.68 40.126.32.74 40.126.32.136 40.126.32.140 40.126.32.134 40.126.32.76	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
slscr.update.microsoft.com	40.68.123.157	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
fe3cr.delivery.mp.microsoft.com	20.166.126.56	whitelisted
nexusrules.officeapps.live.com	52.111.227.14	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

SumatraPDF-3.5.2-64-install.exe

D3269F0F422D36F24E62BD30AE722BFD

A700ECAB3628239A7C2831B4F74487419D9AA850

2BE4A27B83830EA07C6671C3557673D509544E5F70FC6B2DC8CC4388B302C1F2

98304:3mbOnSsrr4h9sHMnF3XTVj5BTwioQy2nUiCFcJzXqnMZu70ho/7qx2bxt6Vng3sz:/4h9sHo2cFpvSJWv6SNlt

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Actions looks like stealing of personal data

SUSPICIOUS

Creates a software uninstall entry

Drops the executable file immediately after the start

Executable content was dropped or overwritten

Explorer used for Indirect Command Execution

Searches for installed software

Reads security settings of Internet Explorer

INFO

Checks supported languages

Creates files or folders in the user directory

Reads CPU info

Reads the computer name

Reads security settings of Internet Explorer

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings