analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

IT.zip

Full analysis: https://app.any.run/tasks/6b6baaec-24ad-48e4-a90e-b6ac372e05f7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 11, 2019, 09:58:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

3330854888ED2FEBDD38250E53E40525

SHA1:

489905BBFCEF618C3F06E40B3B6068013ED8449A

SHA256:

3799B9A63325FEE561F0B97595B34A74F29E7DCEDDE63F5006E241D348BF533E

SSDEEP:

1536:G214aSf+hwVrIpUfB7KepoU8yZBc/j1MJ/z1PPV2m9:P14a6+iVrye1urqL13/9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses BITADMIN.EXE for downloading application

      • WScript.exe (PID: 2712)

  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • WinRAR.exe (PID: 1020)
      • explorer.exe (PID: 2124)
      • WScript.exe (PID: 2712)
      • explorer.exe (PID: 2992)
      • printfilterpipelinesvc.exe (PID: 1328)

    • Executed via COM

      • explorer.exe (PID: 2992)
      • printfilterpipelinesvc.exe (PID: 1328)

    • Creates files in the Windows directory

      • NOTEPAD.EXE (PID: 1620)
      • NOTEPAD.EXE (PID: 1268)
      • printfilterpipelinesvc.exe (PID: 1328)

    • Removes files from Windows directory

      • printfilterpipelinesvc.exe (PID: 1328)

    • Starts Microsoft Office Application

      • printfilterpipelinesvc.exe (PID: 1328)

  • INFO

    • Manual execution by user

      • AcroRd32.exe (PID: 2096)
      • WScript.exe (PID: 2712)
      • NOTEPAD.EXE (PID: 1268)
      • NOTEPAD.EXE (PID: 1620)
      • NOTEPAD.EXE (PID: 1464)

    • Reads the hosts file

      • RdrCEF.exe (PID: 2180)

    • Creates files in the user directory

      • LogTransport2.exe (PID: 2032)
      • AcroRd32.exe (PID: 2096)

    • Reads Microsoft Office registry keys

      • ONENOTE.EXE (PID: 2280)
      • ONENOTE.EXE (PID: 692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: IT93292902512.vbs
ZipUncompressedSize: 6181
ZipCompressedSize: 4420
ZipCRC: 0xb249ad74
ZipModifyDate: 2019:09:09 07:31:01
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
18
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe no specs acrord32.exe no specs acrord32.exe no specs explorer.exe no specs explorer.exe no specs acrord32.exe no specs acrord32.exe no specs rdrcef.exe rdrcef.exe no specs logtransport2.exe bitsadmin.exe no specs notepad.exe no specs notepad.exe no specs printfilterpipelinesvc.exe no specs onenote.exe no specs onenote.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1020"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\IT.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2712"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\IT93292902512.vbs" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
2096"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\IT93292902512.pdf"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.7.20033.133275
2152"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --channel=2096.0.22224275 --type=renderer "C:\Users\admin\Desktop\IT93292902512.pdf"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.7.20033.133275
2124"C:\Windows\explorer.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\IT93292902512.pdf.lnkC:\Windows\explorer.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2992C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
992"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\IT93292902512.pdf"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.7.20033.133275
2072"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --channel=992.0.929116161 --type=renderer "C:\Users\admin\Desktop\IT93292902512.pdf"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.7.20033.133275
2180"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.7.20033.133275
1844"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-delegated-renderer --disable-desktop-notifications --disable-file-system --disable-shared-workers --disable-speech-input --disable-threaded-compositing --disable-webaudio --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.7.20033 Chrome/35.0.1916.138" --disable-accelerated-compositing --disable-accelerated-video-decode --enable-software-compositing --disable-gpu-compositing --channel="2180.0.755252806\355204481" --allow-no-sandbox-job /prefetch:673131151C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.7.20033.133275
Total events
1 382
Read events
1 284
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
2
Unknown types
9

Dropped files

PID
Process
Filename
Type
1020WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1020.42038\IT93292902512.vbs —
MD5:—
SHA256:—
1020WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1020.42038\IT93292902512.pdf —
MD5:—
SHA256:—
2152AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
2152AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.2152 —
MD5:—
SHA256:—
2152AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.2152 —
MD5:—
SHA256:—
2152AcroRd32.exeC:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_Acrobat12_Reader_2bc9e3df-59d0-4d42-9501-bd39944d5674_558128eb-4de3-4252-a23d-d98dfed992f9_0.tmp —
MD5:—
SHA256:—
1328printfilterpipelinesvc.exeC:\Windows\System32\spool\PRINTERS\PPn6q1ua4bh0209z9o0f06p5abe.TMP —
MD5:—
SHA256:—
1328printfilterpipelinesvc.exeC:\Windows\System32\spool\PRINTERS\PPpbsbmz6ykxt1orhl_a8pdn8f.TMP —
MD5:—
SHA256:—
1328printfilterpipelinesvc.exeC:\Windows\System32\spool\PRINTERS\PP1migr6kau64lytdcjzpre5ao.TMP —
MD5:—
SHA256:—
2280ONENOTE.EXEC:\Users\admin\AppData\Local\Temp\CVRB589.tmp.cvr —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2032
LogTransport2.exe
POST
200
192.147.130.244:443
https://hl2rcv.adobe.com/headlights/GetConfig/
US
text
3.99 Kb
whitelisted
—
—
HEAD
—
185.185.24.95:443
https://blacktechmecca.com/sucMYT4h2dyBF/ad1PY8DAyGpHe.jpg
DE
—
—
unknown
2032
LogTransport2.exe
POST
200
192.147.130.244:443
https://hl2rcv.adobe.com/headlights/GetSonar.aspx
US
xml
16.8 Kb
whitelisted
2180
RdrCEF.exe
GET
200
52.202.173.173:443
https://cloud.acrobat.com/appmeasurement.js
US
text
64.7 Kb
whitelisted
2032
LogTransport2.exe
POST
200
192.147.130.244:443
https://hl2rcv.adobe.com/headlights/UploadFile/
US
text
2 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2180
RdrCEF.exe
52.202.173.173:443
cloud.acrobat.com
Amazon.com, Inc.
US
unknown
2032
LogTransport2.exe
192.147.130.244:443
hl2rcv.adobe.com
Adobe Systems Inc.
US
whitelisted
—
—
185.185.24.95:443
blacktechmecca.com
First Colo GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
cloud.acrobat.com
  • 52.202.173.173
  • 52.3.124.32
  • 52.6.11.155
  • 3.215.200.71
whitelisted
hl2rcv.adobe.com
  • 192.147.130.244
whitelisted
blacktechmecca.com
  • 185.185.24.95
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
IT.zip