analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://longfiles.com/ase3919ex875/Connect_Core_Concepts_in_Health,_BIG,_Loose_Leaf_Edition_15th_Edition.pdf.html

Full analysis: https://app.any.run/tasks/1b09802a-60b2-4e13-9cde-a1ce4c43c407
Verdict: Malicious activity
Analysis date: March 30, 2020, 19:18:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

90777EAC44594E2DF4002676DF8D5254

SHA1:

36CA058E2E30CED977E65214B36CF6F0AF3E1551

SHA256:

4320AF579E8D3A42988AEFAE686B81002D2072D62EFF932418396CEE1BD6733A

SSDEEP:

3:N1KSKLnKf2cU5SfmQLjRYXJ9hXlJ6DfKHDJ6JurXEJ:CSsKf9fmQ/aXXnJQIJ6JurXEJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Creates files in the program directory

      • AdobeARM.exe (PID: 1492)
      • firefox.exe (PID: 2972)
    • Changes IE settings (feature browser emulation)

      • AcroRd32.exe (PID: 2720)
  • INFO

    • Reads Internet Cache Settings

      • AcroRd32.exe (PID: 2720)
      • AcroRd32.exe (PID: 2128)
      • firefox.exe (PID: 2972)
    • Application launched itself

      • firefox.exe (PID: 3052)
      • AcroRd32.exe (PID: 2720)
      • RdrCEF.exe (PID: 2904)
      • firefox.exe (PID: 2972)
    • Reads CPU info

      • firefox.exe (PID: 2972)
    • Reads the hosts file

      • RdrCEF.exe (PID: 2904)
    • Reads settings of System Certificates

      • AcroRd32.exe (PID: 2720)
    • Creates files in the user directory

      • firefox.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
13
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs adobearm.exe no specs reader_sl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3052"C:\Program Files\Mozilla Firefox\firefox.exe" "http://longfiles.com/ase3919ex875/Connect_Core_Concepts_in_Health,_BIG,_Loose_Leaf_Edition_15th_Edition.pdf.html"C:\Program Files\Mozilla Firefox\firefox.exeexplorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
2972"C:\Program Files\Mozilla Firefox\firefox.exe" http://longfiles.com/ase3919ex875/Connect_Core_Concepts_in_Health,_BIG,_Loose_Leaf_Edition_15th_Edition.pdf.htmlC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
68.0.1
3320"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2972.0.1341437325\876402343" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2972 "\\.\pipe\gecko-crash-server-pipe.2972" 1200 gpuC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
68.0.1
2556"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2972.3.702834255\710548357" -childID 1 -isForBrowser -prefsHandle 1732 -prefMapHandle 1728 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2972 "\\.\pipe\gecko-crash-server-pipe.2972" 1752 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
68.0.1
3328"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2972.13.1641941694\370028539" -childID 2 -isForBrowser -prefsHandle 2860 -prefMapHandle 2864 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2972 "\\.\pipe\gecko-crash-server-pipe.2972" 2876 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
68.0.1
3824"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2972.20.1653837285\1266945055" -childID 3 -isForBrowser -prefsHandle 3812 -prefMapHandle 3824 -prefsLen 7129 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2972 "\\.\pipe\gecko-crash-server-pipe.2972" 3836 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
68.0.1
2720"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Downloads\Connect Core Concepts in Health, BIG, Loose Leaf Edition 15th Edition.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
firefox.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
2128"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Downloads\Connect Core Concepts in Health, BIG, Loose Leaf Edition 15th Edition.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
2904"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
3740"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2904.0.1248763351\438362501" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
Total events
1 641
Read events
1 582
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
156
Text files
86
Unknown types
115

Dropped files

PID
Process
Filename
Type
2972firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin
MD5:
SHA256:
2972firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js
MD5:
SHA256:
2972firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp
MD5:
SHA256:
2972firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:354459382F30B8994109C88659DFA1F3
SHA256:E3E8E2B7E7EECA231620D83C70FA5A926E8B9CE74C51F595F71191DC0B50527E
2972firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:5027177F513CDAE07DB2330E1DED5934
SHA256:0C53F16051E738287A4612F68E296238087627E594CFD6DDFA1FECC2E998328B
2972firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4jsonlz4
MD5:6D378E0D40B6EACA22C8BCE899A1C5C1
SHA256:ADA2467B2477ACEFF837AC7820C435AD1EBBE844B2DA31C7AB9AE8D010C7A639
2972firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:DE9496ACA551ADE408EF6466A11833A1
SHA256:8F9C7FDB3E0BC01024E43A8E242468FC4DD4F74C725E32A883571635203DC10A
2972firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.sbstorebinary
MD5:0E8FE60CCD7E9B4C32589A5743A95302
SHA256:2B124D4026850A3CFFD28DBACB58AEC28F7DCD4D40BC14E52BBE96D60CE4E749
2972firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flashsubdoc-digest256.sbstorebinary
MD5:04824A1F92353F43EBB9E7F74B7476FD
SHA256:B48E58EBAB82E4C376F16150A3FFF850C1111FF1F5985D68819CFD6F0DB159D2
2972firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstorebinary
MD5:4A1220FC03E11726F09E9981834345DB
SHA256:6AE7FC0FDBE217104F4034BF6A580A461106B50309ABCCFF6E309124DCA5EF39
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
115
DNS requests
193
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2972
firefox.exe
GET
93.190.142.167:80
http://longfiles.com/favicon.ico
NL
unknown
2972
firefox.exe
GET
200
93.190.142.167:80
http://longfiles.com/main.css
NL
text
17.1 Kb
unknown
2972
firefox.exe
GET
200
93.190.142.167:80
http://longfiles.com/images/logo.png
NL
image
2.97 Kb
unknown
2972
firefox.exe
GET
200
104.17.173.62:80
http://velocecdn.com/script/compatibility.js
US
text
6.14 Kb
shared
2972
firefox.exe
GET
200
93.190.142.167:80
http://longfiles.com/728.js
NL
html
1.14 Kb
unknown
2972
firefox.exe
GET
200
93.190.142.167:80
http://longfiles.com/font/gotham-book-webfont.woff
NL
woff
21.0 Kb
unknown
2972
firefox.exe
GET
200
93.190.142.167:80
http://longfiles.com/images/46860.png
NL
image
15.7 Kb
unknown
2972
firefox.exe
GET
200
93.190.142.167:80
http://longfiles.com/font/gotham-light-webfont.woff
NL
woff
20.8 Kb
unknown
2972
firefox.exe
GET
200
93.190.142.167:80
http://longfiles.com/ase3919ex875/Connect_Core_Concepts_in_Health,_BIG,_Loose_Leaf_Edition_15th_Edition.pdf.html
NL
html
13.4 Kb
unknown
2972
firefox.exe
POST
200
172.217.23.131:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2972
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
whitelisted
2972
firefox.exe
52.38.153.3:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
2972
firefox.exe
172.217.23.106:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2972
firefox.exe
23.210.248.44:443
s7.addthis.com
Akamai International B.V.
NL
whitelisted
2972
firefox.exe
52.222.158.194:443
snippets.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
2972
firefox.exe
93.190.142.167:80
longfiles.com
WorldStream B.V.
NL
unknown
2972
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2972
firefox.exe
23.210.248.44:80
s7.addthis.com
Akamai International B.V.
NL
whitelisted
2972
firefox.exe
34.213.37.14:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
2972
firefox.exe
172.217.23.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
longfiles.com
  • 93.190.142.167
unknown
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
  • 2.20.189.162
  • 2.20.189.145
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
  • 2.20.189.145
  • 2.20.189.162
whitelisted
search.services.mozilla.com
  • 52.38.153.3
  • 52.11.143.45
  • 54.149.124.142
whitelisted
search.r53-2.services.mozilla.com
  • 54.149.124.142
  • 52.11.143.45
  • 52.38.153.3
whitelisted
push.services.mozilla.com
  • 34.213.37.14
whitelisted
autopush.prod.mozaws.net
  • 34.213.37.14
whitelisted
snippets.cdn.mozilla.net
  • 52.222.158.194
  • 52.222.158.54
  • 52.222.158.124
  • 52.222.158.80
whitelisted
d228z91au11ukj.cloudfront.net
  • 52.222.158.80
  • 52.222.158.124
  • 52.222.158.54
  • 52.222.158.194
whitelisted
tiles.services.mozilla.com
whitelisted

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
No debug info