File name:

03324224_pdf.jar

Full analysis: https://app.any.run/tasks/2968960e-42c3-4c96-a16c-f6c284f3b407
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: August 18, 2019, 07:53:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

6227D9B52C9BAF41AD82C7FF292EE4D4

SHA1:

1D67029261F2D72A1E7EE7330C38B4483A827723

SHA256:

4D9EF12C61B761397D00F8BBF43E30C3AE7A697C13A1467C0789EE4FD3CD27AD

SSDEEP:

3072:y6pw+dc2RXkocUzx0rXXtryf7VnZtHZDrEsLR2mMDRQgmIz9GngopXJ8RRWnQq0S:1pddcyFcRtryTj/VcmGXmw8PQq0342FK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • worker7172458875624574903.exe (PID: 4024)

    • Application was dropped or rewritten from another process

      • worker7172458875624574903.exe (PID: 3344)
      • worker7172458875624574903.exe (PID: 4024)

    • Loads dropped or rewritten executable

      • worker7172458875624574903.exe (PID: 4024)
      • javaw.exe (PID: 2884)

  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 2884)
      • worker7172458875624574903.exe (PID: 4024)
      • powershell.exe (PID: 2652)

    • Loads Python modules

      • worker7172458875624574903.exe (PID: 4024)

    • Executable content was dropped or overwritten

      • worker7172458875624574903.exe (PID: 3344)
      • javaw.exe (PID: 2884)

    • Executes PowerShell scripts

      • worker7172458875624574903.exe (PID: 4024)

    • Reads the cookies of Google Chrome

      • javaw.exe (PID: 2884)

    • Reads the cookies of Mozilla Firefox

      • javaw.exe (PID: 2884)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2019:08:11 20:43:14
ZipCRC: 0x98459746
ZipCompressedSize: 61
ZipUncompressedSize: 59
ZipFileName: META-INF/MANIFEST.MF
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start javaw.exe worker7172458875624574903.exe worker7172458875624574903.exe powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2652powershell.exe /c " function get-iehistory { [CmdletBinding()] param () $shell = New-Object -ComObject Shell.Application $hist = $shell.NameSpace(34) $folder = $hist.Self $hist.Items() | foreach { if ($_.IsFolder) { $siteFolder = $_.GetFolder $siteFolder.Items() | foreach { $site = $_ if ($site.IsFolder) { $pageFolder = $site.GetFolder $pageFolder.Items() | foreach { $visit = New-Object -TypeName PSObject -Property @{ URL = $($pageFolder.GetDetailsOf($_,0)) } $visit } } } } } } get-iehistory "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—worker7172458875624574903.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2884"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\03324224_pdf.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3344C:\Users\admin\AppData\Local\Temp\tmp1487208727164\worker7172458875624574903.exeC:\Users\admin\AppData\Local\Temp\tmp1487208727164\worker7172458875624574903.exe
javaw.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\tmp1487208727164\worker7172458875624574903.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\apphelp.dll
4024C:\Users\admin\AppData\Local\Temp\tmp1487208727164\worker7172458875624574903.exeC:\Users\admin\AppData\Local\Temp\tmp1487208727164\worker7172458875624574903.exe
worker7172458875624574903.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\tmp1487208727164\worker7172458875624574903.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\users\admin\appdata\local\temp\_mei33442\python27.dll
Total events
226
Read events
164
Write events
61
Delete events
1

Modification events

(PID) Process:(2652) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2652) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019081820190819
Operation:writeName:CachePath
Value:
%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019081820190819
(PID) Process:(2652) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019081820190819
Operation:writeName:CachePrefix
Value:
:2019081820190819:
(PID) Process:(2652) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019081820190819
Operation:writeName:CacheLimit
Value:
8192
(PID) Process:(2652) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019081820190819
Operation:writeName:CacheOptions
Value:
11
(PID) Process:(2652) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019081820190819
Operation:writeName:CacheRepair
Value:
0
(PID) Process:(2652) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019032320190324
Operation:delete keyName:
Value:
Executable files
21
Suspicious files
3
Text files
3
Unknown types
4

Dropped files

PID
Process
Filename
Type
2884javaw.exeC:\Users\admin\AppData\Local\Temp\tmp1487208727164\worker7172458875624574903.exeexecutable
MD5:—
SHA256:—
2884javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:—
SHA256:—
3344worker7172458875624574903.exeC:\Users\admin\AppData\Local\Temp\_MEI33442\mein.exe.manifestxml
MD5:—
SHA256:—
4024worker7172458875624574903.exeC:\users\admin\appdata\local\temp\4exsn3 —
MD5:—
SHA256:—
4024worker7172458875624574903.exeC:\users\admin\appdata\local\temp\ehnoqsspn —
MD5:—
SHA256:—
2652powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J5DB2EHSMQQDGF6CUTXT.temp —
MD5:—
SHA256:—
3344worker7172458875624574903.exeC:\Users\admin\AppData\Local\Temp\_MEI33442\Microsoft.VC90.CRT.manifestxml
MD5:0BCAE6094FDA15852A9D5C1E1F03BB24
SHA256:454E12BC0DED5A81B52F38D73942E9F0A1BD2073AC2E976F63A8AF115C7EA296
3344worker7172458875624574903.exeC:\Users\admin\AppData\Local\Temp\_MEI33442\_ctypes.pydexecutable
MD5:7896F2B2B44A6DC7F8021C142339CE07
SHA256:DA6F2A24EE007F2BA49B120F6253E2030563093B6ABD4514BF81F7F2326AC96A
2884javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
3344worker7172458875624574903.exeC:\Users\admin\AppData\Local\Temp\_MEI33442\pyexpat.pydexecutable
MD5:E7D033F40F44D497D6DDC5CC020CA40B
SHA256:3285C94AE4C801147F564E92F1DD8DC00D630E041F80B33DD37300CE597004A6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
1
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2884
javaw.exe
GET
200
66.171.248.178:80
http://bot.whatismyipaddress.com/
US
text
12 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2884
javaw.exe
206.81.27.160:80
—
—
US
malicious
2884
javaw.exe
66.171.248.178:80
bot.whatismyipaddress.com
Alchemy Communications, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
bot.whatismyipaddress.com
  • 66.171.248.178
shared

Threats

PID
Process
Class
Message
2884
javaw.exe
A Network Trojan was detected
MALWARE [PTsecurity] JavaPython.Stealer.Pyrogenic
2884
javaw.exe
A Network Trojan was detected
MALWARE [PTsecurity] JavaPython.Stealer.Pyrogenic
2884
javaw.exe
A Network Trojan was detected
MALWARE [PTsecurity] JavaPython.Stealer.Pyrogenic
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
03324224_pdf.jar