analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | doc proceso judicial 324234235768463.pdf |
| Full analysis: | https://app.any.run/tasks/d3649688-2b62-4cbd-9290-5e3aa615ac6f |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | January 17, 2019, 20:42:16 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/pdf |
| File info: | PDF document, version 1.5 |
| MD5: | 432533CDBCFE56B8BF0E70995139D8F7 |
| SHA1: | 97353368210048F2559BE437E4E79B39BD6C2084 |
| SHA256: | 319CA82D9D0EC2FB686FE0DEC9905238476E362868BBEF29B3531B528D8A0B30 |
| SSDEEP: | 1536:CRGwD4SocqQur+EAwWIIIMgDNzOCo2etIVtYNG6xt5DxxoT9Xc9TSOOV6ryufD:CY04p+wWIIIT0CHbYNG6pI8SOpTb |
MALICIOUS
Application was dropped or rewritten from another process
- Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe (PID: 3664)
- Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe (PID: 3100)
Loads dropped or rewritten executable
- Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe (PID: 3664)
- Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe (PID: 3100)
Connects to CnC server
- Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe (PID: 3664)
- RegAsm.exe (PID: 3576)
- Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe (PID: 3100)
Changes the autorun value in the registry
- RegAsm.exe (PID: 3576)
NJRAT was detected
- RegAsm.exe (PID: 3576)
SUSPICIOUS
Starts Internet Explorer
- AcroRd32.exe (PID: 2988)
Executable content was dropped or overwritten
- Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe (PID: 3664)
- WinRAR.exe (PID: 2912)
- Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe (PID: 3100)
Changes tracing settings of the file or console
- Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe (PID: 3664)
Creates files in the program directory
- AdobeARM.exe (PID: 3340)
Uses NETSH.EXE for network configuration
- RegAsm.exe (PID: 3576)
Connects to unusual port
- RegAsm.exe (PID: 3576)
INFO
Application launched itself
- AcroRd32.exe (PID: 2988)
- RdrCEF.exe (PID: 4048)
Reads Internet Cache Settings
- iexplore.exe (PID: 3036)
- iexplore.exe (PID: 2400)
Changes internet zones settings
- iexplore.exe (PID: 2400)
Reads settings of System Certificates
- iexplore.exe (PID: 2400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| | | Adobe Portable Document Format (100) |
EXIF
| PDFVersion: | 1.5 |
|---|---|
| Linearized: | No |
| PageCount: | 1 |
| Language: | es-CO |
| TaggedPDF: | Yes |
| Title: | Presentación de PowerPoint |
| Author: | USUARIO |
| CreateDate: | 2019:01:17 11:00:31-05:00 |
| ModifyDate: | 2019:01:17 11:00:31-05:00 |
| Producer: | Microsoft® PowerPoint® 2013 |
| Creator: | Microsoft® PowerPoint® 2013 |
Total processes
47
Monitored processes
15
Malicious processes
5
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2988 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Temp\doc proceso judicial 324234235768463.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | explorer.exe | |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Version: 15.23.20070.215641 | ||||
| 2332 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Temp\doc proceso judicial 324234235768463.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Version: 15.23.20070.215641 | ||||
| 4048 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe RdrCEF Version: 15.23.20053.211670 | ||||
| 3408 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4048.0.1086833937\1484432619" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Version: 15.23.20053.211670 | ||||
| 3800 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4048.1.1632766238\390976379" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Version: 15.23.20053.211670 | ||||
| 2400 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | AcroRd32.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3036 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2400 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2912 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Pdf 464575686488699Pdf 464575686488699.UUE" | C:\Program Files\WinRAR\WinRAR.exe | iexplore.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
| 3664 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2912.28343\Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2912.28343\Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe | WinRAR.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 3340 | "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:15.0 /MODE:3 | C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Reader and Acrobat Manager Version: 1.824.27.2646 | ||||
Total events
1 740
Read events
1 491
Write events
0
Delete events
0
Modification events
Executable files
5
Suspicious files
3
Text files
23
Unknown types
13
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2332 | AcroRd32.exe | C:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal | — | |
MD5:— | SHA256:— | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF2A8603D2B075F283.TMP | — | |
MD5:— | SHA256:— | |||
| 2332 | AcroRd32.exe | C:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R571f1w_7108dx_1ss.tmp | — | |
MD5:— | SHA256:— | |||
| 2332 | AcroRd32.exe | C:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rniekwp_7108dw_1ss.tmp | — | |
MD5:— | SHA256:— | |||
| 2332 | AcroRd32.exe | C:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rrqxdgq_7108dv_1ss.tmp | — | |
MD5:— | SHA256:— | |||
| 2332 | AcroRd32.exe | C:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R1js1n6u_7108du_1ss.tmp | — | |
MD5:— | SHA256:— | |||
| 2332 | AcroRd32.exe | C:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rgeo2j0_7108dy_1ss.tmp | — | |
MD5:— | SHA256:— | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF9D6012F888CA9F53.TMP | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
13
DNS requests
10
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2988 | AcroRd32.exe | GET | 304 | 2.16.186.33:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip | unknown | — | — | whitelisted |
2988 | AcroRd32.exe | GET | 304 | 2.16.186.33:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip | unknown | — | — | whitelisted |
2988 | AcroRd32.exe | GET | 304 | 2.16.186.33:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/278_15_23_20070.zip | unknown | — | — | whitelisted |
2988 | AcroRd32.exe | GET | 304 | 2.16.186.33:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip | unknown | — | — | whitelisted |
3664 | Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe | GET | — | 104.200.23.95:80 | http://www.aieov.com/logo.gif | US | — | — | malicious |
2988 | AcroRd32.exe | GET | 304 | 2.16.186.33:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip | unknown | — | — | whitelisted |
3664 | Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe | GET | — | 104.200.23.95:80 | http://www.aieov.com/logo.gif | US | — | — | malicious |
3100 | Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe | GET | — | 104.200.23.95:80 | http://www.aieov.com/logo.gif | US | — | — | malicious |
2400 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2988 | AcroRd32.exe | 23.210.248.251:443 | armmf.adobe.com | Akamai International B.V. | NL | whitelisted |
2400 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3036 | iexplore.exe | 162.125.66.6:443 | dl.dropbox.com | Dropbox, Inc. | DE | shared |
— | — | 23.210.248.251:443 | armmf.adobe.com | Akamai International B.V. | NL | whitelisted |
3664 | Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe | 104.200.23.95:80 | www.aieov.com | Linode, LLC | US | malicious |
2988 | AcroRd32.exe | 2.16.186.33:80 | acroipm2.adobe.com | Akamai International B.V. | — | whitelisted |
3100 | Pdf 464575686488699Pdf 464575686488699 Pdf 464575686488699.exe | 104.200.23.95:80 | www.aieov.com | Linode, LLC | US | malicious |
3576 | RegAsm.exe | 186.146.240.24:1992 | futbolazul.duckdns.org | Telmex Colombia S.A. | CO | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
dl.dropbox.com |
| shared |
dl.dropboxusercontent.com |
| shared |
acroipm2.adobe.com |
| whitelisted |
armmf.adobe.com |
| whitelisted |
5isohu.com |
| whitelisted |
www.aieov.com |
| malicious |
ardownload2.adobe.com |
| whitelisted |
futbolazul.duckdns.org |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3036 | iexplore.exe | Misc activity | SUSPICIOUS [PTsecurity] Dropbox SSL Payload Request |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
3576 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT.Gen RAT outbound connection |
3576 | RegAsm.exe | A Network Trojan was detected | ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop) |
3576 | RegAsm.exe | A Network Trojan was detected | ET TROJAN njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) |
7 ETPRO signatures available at the full report