File name:

information.pif

Full analysis: https://app.any.run/tasks/2c739f60-90d4-4e06-9464-009da0b3308c
Verdict: Malicious activity
Analysis date: May 19, 2025, 09:31:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
api-base64
upx
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

69404FFF5A9D858CA72A02F714D6E720

SHA1:

3B64115D232C6F9F24C9853C4C7A23950D9DB2DD

SHA256:

40D86A2823C058CE71763BE61F4CF3B3ABB9205CF8443803FBD47195EC5B0BD4

SSDEEP:

768:v+yc/ZakvKFrAqrI94IUgAeq3fh1LBfDnXTGAZQERx3qFU06Yl0:v+y76mrAqc9ZU773fhXX/ZQEmex

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • information.pif.exe (PID: 1628)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • information.pif.exe (PID: 1628)

    • Reads security settings of Internet Explorer

      • information.pif.exe (PID: 1628)

    • Connects to SMTP port

      • information.pif.exe (PID: 1628)

  • INFO

    • Checks supported languages

      • information.pif.exe (PID: 1628)

    • Create files in a temporary directory

      • information.pif.exe (PID: 1628)

    • Failed to create an executable file in Windows directory

      • information.pif.exe (PID: 1628)

    • Auto-launch of the file from Registry key

      • information.pif.exe (PID: 1628)

    • Reads the computer name

      • information.pif.exe (PID: 1628)

    • Checks proxy server information

      • information.pif.exe (PID: 1628)

    • Creates files or folders in the user directory

      • information.pif.exe (PID: 1628)

    • UPX packer has been detected

      • information.pif.exe (PID: 1628)

    • Potential library load (Base64 Encoded 'LoadLibrary')

      • information.pif.exe (PID: 1628)

    • Reads the software policy settings

      • slui.exe (PID: 7476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (38.2)
.exe | Win32 EXE Yoda's Crypter (37.5)
.dll | Win32 Dynamic Link Library (generic) (9.2)
.exe | Win32 Executable (generic) (6.3)
.exe | Clipper DOS Executable (2.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7
CodeSize: 28672
InitializedDataSize: 4096
UninitializedDataSize: 24576
EntryPoint: 0xd0b0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start information.pif.exe sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
744C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1628"C:\Users\admin\AppData\Local\Temp\information.pif.exe" C:\Users\admin\AppData\Local\Temp\information.pif.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\information.pif.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7440C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7476"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
973
Read events
972
Write events
1
Delete events
0

Modification events

(PID) Process:(1628) information.pif.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:zawnq
Value:
C:\Users\admin\AppData\Local\Temp\ezewoswvbdp.exe
Executable files
2
Suspicious files
42
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1628information.pif.exeC:\Users\admin\AppData\Local\Temp\ezewoswvbdp.exeexecutable
MD5:69404FFF5A9D858CA72A02F714D6E720
SHA256:40D86A2823C058CE71763BE61F4CF3B3ABB9205CF8443803FBD47195EC5B0BD4
1628information.pif.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\yllusvmgjhbtb.zipcompressed
MD5:194346DCFEAA9D23EB6768201BF18197
SHA256:53927A684BEABFCCD81A74930A1387215561662D7475C0CBF514B76BF3FF6FD1
1628information.pif.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\core\dev\nls\hu-hu\htxabwzdd.zipcompressed
MD5:9261E5C6F90AB36608F1EA8E7BC6CCB6
SHA256:DBBA46F830C3C9A3BB0D7C86A6830639208281FF7A972D1FDEBC565B07A1B3CD
1628information.pif.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\uoudijopiibi.zipcompressed
MD5:A015CE8BD3673B6FA080473D163D9199
SHA256:237F145670B7B4CEB4B95EBD324A75DBF803BB6AD274CCDC1DE1284822396AE6
1628information.pif.exeC:\Users\admin\AppData\Local\Temp\fglliy.dllexecutable
MD5:C381A0C33B84DA7A79501E2AA059A035
SHA256:7C338926BBEAA162A3D31157813A92D05A6BC03E016B20B44B4B4E124722B9D0
1628information.pif.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-sl\fxziivqzqhqqa.zipcompressed
MD5:3893AC5944413C845A3DAE708B457C1D
SHA256:B1E91823DBD6E6E5EFF5B8DEB5AB362CB1ED23DB3A00A270D2F5A1BF296DD3E7
1628information.pif.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\clpnainnk.zipcompressed
MD5:6C2F3CF612145C7D659F7A2958B3562D
SHA256:35B8B36FB5E845752ACD209E1F09E3A8BE3E2976ACEA59EC6625DEFF1C5C737A
1628information.pif.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\xunswyvtel.zipcompressed
MD5:E0EFC6804185C430ECAF01026B47C5B7
SHA256:84ABC54CF76CEE8F8BBC62AB90F1189B0D7EF763A28DF955A41F9FFD9A75E297
1628information.pif.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\mltcdqhxv.zipcompressed
MD5:F9EAD0E4B7474B317B5CE56D3DE5C35C
SHA256:4C3CFD1A090EB02014C542CCF972ED85E3761AE221DFC8EE11486D666D355381
1628information.pif.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\lmxrvgu.zipcompressed
MD5:718C90855DEB8C363D4AE1C669A73AD0
SHA256:CAC5397C0A4D5144A6FC216401875CF4D8C669A3DE2C50A00A0BD4F3690E21AD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7 333
TCP/UDP connections
8 251
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1628
information.pif.exe
GET
—
184.29.240.94:80
http://www.microsoft.com:80/
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1628
information.pif.exe
GET
200
184.29.240.94:80
http://www.microsoft.com:80/
unknown
—
—
whitelisted
1628
information.pif.exe
GET
—
184.29.240.94:80
http://www.microsoft.com:80/
unknown
—
—
whitelisted
1628
information.pif.exe
GET
200
184.29.240.94:80
http://www.microsoft.com:80/
unknown
—
—
whitelisted
1628
information.pif.exe
GET
—
184.29.240.94:80
http://www.microsoft.com:80/
unknown
—
—
whitelisted
1628
information.pif.exe
GET
200
184.29.240.94:80
http://www.microsoft.com:80/
unknown
—
—
whitelisted
1628
information.pif.exe
GET
—
184.29.240.94:80
http://www.microsoft.com:80/
unknown
—
—
whitelisted
1628
information.pif.exe
GET
200
184.29.240.94:80
http://www.microsoft.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1628
information.pif.exe
184.29.240.94:80
www.microsoft.com
Emirates Integrated Telecommunications Company PJSC
AE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1628
information.pif.exe
52.101.41.24:25
adobe.mail.protection.outlook.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.29.240.94
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
adobe.com
  • —
whitelisted
adobe.mail.protection.outlook.com
  • 52.101.41.24
  • 52.101.11.3
  • 52.101.41.180
  • 52.101.9.11
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.67
  • 40.126.32.72
  • 20.190.160.2
  • 20.190.160.5
  • 20.190.160.130
  • 40.126.32.140
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
adobe-com.mail.protection.outlook.com
  • 52.101.8.46
  • 52.101.41.28
  • 52.101.10.18
  • 52.101.194.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
information.pif