analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MBS-Israel.pdf

Full analysis: https://app.any.run/tasks/48288509-deb2-4e5b-89ae-c049863388e3
Verdict: Malicious activity
Analysis date: November 29, 2020, 12:16:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/pdf
File info: PDF document, version 1.4
MD5:

4C61985A5C8C11EB516E592397343F27

SHA1:

0A2B7AC50F1467588B0E0B1B73FDFD270EAF86A0

SHA256:

553127CB586591CBFBAE54DD4E28D4CD40FDDDEBAF4E0E7E1F3F23C446A621BB

SSDEEP:

768:G/5p2k9F7m37fOVU1QdwZZE9KKgoqf3o8inTeFYXvvKWH+uSukp7XwVeqOACl5nu:MkfXkO3o8u33KAH2DYD8JE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Details crown prince held 'secret meeting' with Israeli PM.Nov.23.20.MoM.exe (PID: 3132)
      • Details of MBS meeting with the US Secretary of State.Nov.23.20.MoM.exe (PID: 2468)
      • Talking points for meeting.exe (PID: 2544)
      • Talking points for meeting.exe (PID: 2876)

    • Loads dropped or rewritten executable

      • Talking points for meeting.exe (PID: 2544)

    • Drops executable file immediately after starts

      • Talking points for meeting.exe (PID: 2876)

  • SUSPICIOUS

    • Starts Internet Explorer

      • AcroRd32.exe (PID: 2760)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3156)

    • Creates files in the program directory

      • Details crown prince held 'secret meeting' with Israeli PM.Nov.23.20.MoM.exe (PID: 3132)
      • AdobeARM.exe (PID: 3212)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3156)
      • Talking points for meeting.exe (PID: 2876)

    • Loads Python modules

      • Talking points for meeting.exe (PID: 2544)

    • Application launched itself

      • Talking points for meeting.exe (PID: 2876)

    • Drops a file that was compiled in debug mode

      • Talking points for meeting.exe (PID: 2876)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3760)
      • AcroRd32.exe (PID: 2760)

    • Application launched itself

      • iexplore.exe (PID: 856)
      • AcroRd32.exe (PID: 2760)
      • RdrCEF.exe (PID: 2772)

    • Changes IE settings (feature browser emulation)

      • AcroRd32.exe (PID: 2760)

    • Changes internet zones settings

      • iexplore.exe (PID: 856)

    • Creates files in the user directory

      • iexplore.exe (PID: 3760)

    • Reads the hosts file

      • RdrCEF.exe (PID: 2772)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 856)

    • Manual execution by user

      • WinRAR.exe (PID: 3156)
      • Details of MBS meeting with the US Secretary of State.Nov.23.20.MoM.exe (PID: 2468)
      • Details crown prince held 'secret meeting' with Israeli PM.Nov.23.20.MoM.exe (PID: 3132)
      • Talking points for meeting.exe (PID: 2876)

    • Dropped object may contain Bitcoin addresses

      • Talking points for meeting.exe (PID: 2876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

PDFVersion: 1.4
Linearized: No
PageCount: 1
Creator: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36
Producer: Skia/PDF m87
CreateDate: 2020:11:24 08:37:26+00:00
ModifyDate: 2020:11:24 08:37:26+00:00
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
14
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start acrord32.exe acrord32.exe no specs iexplore.exe no specs iexplore.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs winrar.exe adobearm.exe no specs reader_sl.exe no specs details crown prince held 'secret meeting' with israeli pm.nov.23.20.mom.exe no specs details of mbs meeting with the us secretary of state.nov.23.20.mom.exe talking points for meeting.exe talking points for meeting.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2760"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\MBS-Israel.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
2912"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Desktop\MBS-Israel.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
856"C:\Program Files\Internet Explorer\iexplore.exe" https://drive.google.com/uc?export=download&id=1NnMlUPwkxK4_wAJwrqxqBAfdKCPDxyehC:\Program Files\Internet Explorer\iexplore.exe—AcroRd32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3760"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:856 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2772"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2460"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2772.0.39598891\623797318" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2952"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2772.1.1582301984\2051139371" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
3156"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\MOM.rar" C:\Users\admin\Desktop\MOM\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3212"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:15.0 /MODE:3C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Reader and Acrobat Manager
Version:
1.824.27.2646
2796"C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe" C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe—AdobeARM.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat SpeedLauncher
Exit code:
0
Version:
15.23.20053.211670
Total events
1 431
Read events
1 258
Write events
0
Delete events
0

Modification events

No data
Executable files
29
Suspicious files
16
Text files
29
Unknown types
27

Dropped files

PID
Process
Filename
Type
2912AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
3760iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab5751.tmp —
MD5:—
SHA256:—
3760iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar5752.tmp —
MD5:—
SHA256:—
2912AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rysuftu_1ab6xkk_28w.tmp —
MD5:—
SHA256:—
2912AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R57iwr_1ab6xkl_28w.tmp —
MD5:—
SHA256:—
2912AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rzmx9us_1ab6xkm_28w.tmp —
MD5:—
SHA256:—
2912AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Racref6_1ab6xkj_28w.tmp —
MD5:—
SHA256:—
3760iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:BEBDCAEF8B3899801E957DC78C5112A4
SHA256:D20E0ABC7671841EDF91F41B75B22D54DE49D84C99A75CF9E334E92C5FE07E15
3760iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_7C1C45A209E1552633930171FD75B297der
MD5:4DC1DBA1D6226E44150492D27AF9AC8D
SHA256:1E885776F582A630426DF47F9421C977E25E183FEA0A6F1D8728FF22CFE1CAE9
2912AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagessqlite
MD5:97F01F95C0939074C68D263AE3013F4D
SHA256:17960651BC5B728B0C9A1ED373E0D10960BD6334CC19943AA94374E1D7EF5ADD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
13
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2760
AcroRd32.exe
GET
304
92.122.188.31:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip
unknown
—
—
whitelisted
3760
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAhrYrWeURCWAgAAAACAVck%3D
US
der
471 b
whitelisted
3760
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQD76E8xQFZstgIAAAAAgFWS
US
der
472 b
whitelisted
3760
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2760
AcroRd32.exe
GET
304
92.122.188.31:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
—
—
whitelisted
3760
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAhrYrWeURCWAgAAAACAVck%3D
US
der
471 b
whitelisted
2760
AcroRd32.exe
GET
304
92.122.188.31:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
—
—
whitelisted
2760
AcroRd32.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3760
iexplore.exe
216.58.206.1:443
doc-0s-ac-docs.googleusercontent.com
Google Inc.
US
whitelisted
3760
iexplore.exe
172.217.22.78:443
drive.google.com
Google Inc.
US
whitelisted
2760
AcroRd32.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3760
iexplore.exe
172.217.21.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
—
—
104.79.88.64:443
armmf.adobe.com
Time Warner Cable Internet LLC
US
suspicious
2760
AcroRd32.exe
104.79.88.64:443
armmf.adobe.com
Time Warner Cable Internet LLC
US
suspicious
2760
AcroRd32.exe
92.122.188.31:80
acroipm2.adobe.com
NTT America, Inc.
—
suspicious
—
—
104.111.214.232:443
ardownload2.adobe.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
drive.google.com
  • 172.217.22.78
shared
ocsp.pki.goog
  • 172.217.21.195
whitelisted
doc-0s-ac-docs.googleusercontent.com
  • 216.58.206.1
whitelisted
acroipm2.adobe.com
  • 92.122.188.31
  • 92.122.188.30
whitelisted
armmf.adobe.com
  • 104.79.88.64
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ardownload2.adobe.com
  • 104.111.214.232
whitelisted

Threats

No threats detected
Process
Message
Details of MBS meeting with the US Secretary of State.Nov.23.20.MoM.exe
Click on : x=583,y=229
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MBS-Israel.pdf