analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://download2021.pdf-suite.com/download.ashx?productcode=pdfsuite$params=uid=1016736&mkey1=pdfsuite.de%2fpdf%2ftrial&cmp=pdfs_fre_b_de_s_a_trial&key1=pdfcreator&key2=pdfcreator0x0fcrpa170614&partner=ppc_free_pdfsuite&keyb=e_pdf%20create$dwld=download2

Full analysis: https://app.any.run/tasks/d60caca9-4abc-4c55-ad85-905be16c7e53
Verdict: Malicious activity
Analysis date: January 14, 2022, 19:17:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

09A09F8BF07B4FD659DA0F61490D5EEA

SHA1:

F65B7406D9AB10BD353E62E15693CAD2F715B764

SHA256:

4015F602DB0BAE9DEAE0AAE7B5249FF42BA554A13215B8BC13641E58E215B7A2

SSDEEP:

6:2SWsiKKnnGKf0pYVdJU4JA1D+9fC9YucaQ5qE9ATLwISqon:2tsbKG7pYlUJEo98Gfon

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • PDFSuite2021Installer.exe (PID: 2836)

    • Application was dropped or rewritten from another process

      • PDFSuite2021Installer.exe (PID: 3760)
      • PDFSuite2021Installer.exe (PID: 2836)
      • PDFSuite2021Installer.exe (PID: 1956)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 344)
      • DllHost.exe (PID: 3432)
      • PDFSuite2021Installer.exe (PID: 2836)

    • Changes settings of System certificates

      • PDFSuite2021Installer.exe (PID: 2836)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2220)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3844)
      • iexplore.exe (PID: 2220)
      • PDFSuite2021Installer.exe (PID: 2836)

    • Drops a file with a compile date too recent

      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 3844)
      • PDFSuite2021Installer.exe (PID: 2836)

    • Reads the computer name

      • PDFSuite2021Installer.exe (PID: 2836)
      • PDFSuite2021Installer.exe (PID: 1956)

    • Drops a file that was compiled in debug mode

      • PDFSuite2021Installer.exe (PID: 2836)

    • Checks supported languages

      • PDFSuite2021Installer.exe (PID: 2836)
      • PDFSuite2021Installer.exe (PID: 1956)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 344)

    • Creates files in the program directory

      • PDFSuite2021Installer.exe (PID: 2836)
      • PDFSuite2021Installer.exe (PID: 1956)

    • Executed as Windows Service

      • msiexec.exe (PID: 484)
      • vssvc.exe (PID: 412)

    • Executed via COM

      • DllHost.exe (PID: 3432)

    • Adds / modifies Windows certificates

      • PDFSuite2021Installer.exe (PID: 2836)

    • Starts itself from another location

      • PDFSuite2021Installer.exe (PID: 2836)

    • Searches for installed software

      • msiexec.exe (PID: 484)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3844)
      • iexplore.exe (PID: 2220)
      • regsvr32.exe (PID: 344)
      • msiexec.exe (PID: 484)
      • DllHost.exe (PID: 3432)
      • vssvc.exe (PID: 412)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 3844)
      • PDFSuite2021Installer.exe (PID: 2836)

    • Reads the computer name

      • iexplore.exe (PID: 3844)
      • iexplore.exe (PID: 2220)
      • DllHost.exe (PID: 3432)
      • msiexec.exe (PID: 484)
      • vssvc.exe (PID: 412)

    • Application launched itself

      • iexplore.exe (PID: 3844)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 3844)
      • PDFSuite2021Installer.exe (PID: 2836)

    • Changes internet zones settings

      • iexplore.exe (PID: 3844)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3844)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3844)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3844)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3844)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3844)

    • Creates files in the user directory

      • iexplore.exe (PID: 3844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start iexplore.exe iexplore.exe pdfsuite2021installer.exe no specs pdfsuite2021installer.exe regsvr32.exe no specs server no specs msiexec.exe no specs pdfsuite2021installer.exe no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3844"C:\Program Files\Internet Explorer\iexplore.exe" "https://download2021.pdf-suite.com/download.ashx?productcode=pdfsuite$params=uid=1016736&mkey1=pdfsuite.de%2fpdf%2ftrial&cmp=pdfs_fre_b_de_s_a_trial&key1=pdfcreator&key2=pdfcreator0x0fcrpa170614&partner=ppc_free_pdfsuite&keyb=e_pdf%20create$dwld=download2"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2220"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3844 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3760"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PDFSuite2021Installer.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PDFSuite2021Installer.exe—iexplore.exe
User:
admin
Company:
Interactive Brands Malta Limited
Integrity Level:
MEDIUM
Description:
PDF Suite 2021 Installer
Exit code:
3221226540
Version:
19.0.14.1822
2836"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PDFSuite2021Installer.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PDFSuite2021Installer.exe
iexplore.exe
User:
admin
Company:
Interactive Brands Malta Limited
Integrity Level:
HIGH
Description:
PDF Suite 2021 Installer
Version:
19.0.14.1822
344regsvr32.exe /s "C:\ProgramData\PDF Suite 2021\Installation\analytics.dll"C:\Windows\system32\regsvr32.exe—PDFSuite2021Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3432C:\Windows\system32\DllHost.exe /Processid:{D1FCB007-1CBD-4583-B33C-26A50B98E80E}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
484C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1956"C:\ProgramData\PDF Suite 2021\Installation\PDFSuite2021Installer.exe" /RegServerC:\ProgramData\PDF Suite 2021\Installation\PDFSuite2021Installer.exe—PDFSuite2021Installer.exe
User:
admin
Company:
Interactive Brands Malta Limited
Integrity Level:
HIGH
Description:
PDF Suite 2021 Installer
Exit code:
0
Version:
19.0.14.1822
412C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft� Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
21 182
Read events
20 591
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
12
Text files
20
Unknown types
7

Dropped files

PID
Process
Filename
Type
2220iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cder
MD5:6585A80F51C19583EC1809994692F35E
SHA256:1BD9782B12AFD8D17713D1594314D2E6816BC84362526F0577AD6BA54E515B95
3844iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF170D6964C0E993E2.TMPgmc
MD5:0EE14593D92A481FD16AE52ADE379D78
SHA256:946186188DEF0A120FA345691DA962868DBF6404DA253BA1B9DAB6A9003B05C5
3844iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:ACE427D9E2E5197DA2F600C887DCFCB1
SHA256:9D985EC5E3675B2C7DED4535F7DE2CBE39934D67046E25C3D0466220FAFE9651
3844iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:AC68ACF50745357D4EA92B214D9E7132
SHA256:AE3F7FDE380D2D90571A61378E52B1BC284B4C4C6A1E099F6F022395EBED6154
2220iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4344B8AF97AF3A423D9EE52899963CDE_805A2C65AF6343BC740ECDC920C8458Fder
MD5:09DFE5F4A9DA4593A5200D64758A0698
SHA256:81758C42A166E1EA6E2399A458B009BE62783963196B1B958513748511FDAB56
2220iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:0A80967B07835569FE95BB8857AD92A9
SHA256:FDC4463CF972EC5C6A851A3D12AC29821E18F1EF0753C4885EAEED9E4858EAB1
3844iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:E9BF7498671A3D804E05C4B947835360
SHA256:0DF748D1366725F8A860292B9FFE622A87AD75D1B1C065628F1E5FE107322C10
2220iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PDFSuite2021Installer.exe.ejgtd8y.partialexecutable
MD5:9418A86335CBF61680F8665C436544D2
SHA256:626CB76B823F92171E346A50B85549A7E6A7B99922B8A39C0C46CCD90A05D789
2220iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\PDFSuite2021Installer[1].exeexecutable
MD5:47671188E216FAD3BDEC98D5D8411260
SHA256:2EDEB7CE11CB31DC3795A4F170202C5B70250C0053BAB459F55F5F731041C78D
3844iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{B05956A3-756E-11EC-9D0A-12A9866C77DE}.datbinary
MD5:5C189AB520DACB9F4822547904231410
SHA256:1FE89A3C6FBA615B3A4673EAB8611FE138A4BC72CFC16E502D26678D31D2285A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
39
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2836
PDFSuite2021Installer.exe
HEAD
302
198.72.111.246:80
http://download2021.pdf-suite.com/x86/module/main
CA
—
—
unknown
2836
PDFSuite2021Installer.exe
HEAD
302
198.72.111.246:80
http://download2021.pdf-suite.com/x86/module/ocr-tess
CA
—
—
unknown
2836
PDFSuite2021Installer.exe
GET
302
198.72.111.246:80
http://download2021.pdf-suite.com/x86/module/main
CA
—
—
unknown
—
—
GET
302
198.72.111.246:80
http://download2021.pdf-suite.com/x86/module/ocr-tess
CA
—
—
unknown
3844
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
der
471 b
whitelisted
2220
iexplore.exe
GET
200
93.184.220.29:80
http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEAFy93Wimy7VAhfxkcq1ll8%3D
US
der
471 b
whitelisted
2220
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
3844
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3844
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2220
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6e90717c7b6cc509
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2220
iexplore.exe
198.72.111.246:443
download2021.pdf-suite.com
iWeb Technologies Inc.
CA
unknown
2220
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3844
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3844
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2220
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3844
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2836
PDFSuite2021Installer.exe
64.15.159.239:443
api-updateservice.pdf-suite.com
iWeb Technologies Inc.
CA
suspicious
2836
PDFSuite2021Installer.exe
198.72.111.246:80
download2021.pdf-suite.com
iWeb Technologies Inc.
CA
unknown
2836
PDFSuite2021Installer.exe
198.72.111.246:443
download2021.pdf-suite.com
iWeb Technologies Inc.
CA
unknown
3844
iexplore.exe
204.79.197.203:443
www.msn.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
download2021.pdf-suite.com
  • 198.72.111.246
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
status.geotrust.com
  • 93.184.220.29
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
api-updateservice.pdf-suite.com
  • 64.15.159.239
unknown
wsgeoip.pdf-suite.com
  • 64.15.159.239
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download2021.pdf-suite.com/download.ashx?productcode=pdfsuite$params=uid=1016736&mkey1=pdfsuite.de%2fpdf%2ftrial&cmp=pdfs_fre_b_de_s_a_trial&key1=pdfcreator&key2=pdfcreator0x0fcrpa170614&partner=ppc_free_pdfsuite&keyb=e_pdf%20create$dwld=download2