analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MBS-Israel.pdf

Full analysis: https://app.any.run/tasks/7c61983f-312b-4244-ac66-af2567d2510f
Verdict: Malicious activity
Analysis date: November 29, 2020, 12:24:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/pdf
File info: PDF document, version 1.4
MD5:

4C61985A5C8C11EB516E592397343F27

SHA1:

0A2B7AC50F1467588B0E0B1B73FDFD270EAF86A0

SHA256:

553127CB586591CBFBAE54DD4E28D4CD40FDDDEBAF4E0E7E1F3F23C446A621BB

SSDEEP:

768:G/5p2k9F7m37fOVU1QdwZZE9KKgoqf3o8inTeFYXvvKWH+uSukp7XwVeqOACl5nu:MkfXkO3o8u33KAH2DYD8JE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Details of MBS meeting with the US Secretary of State.Nov.23.20.MoM.exe (PID: 1596)
      • Details crown prince held 'secret meeting' with Israeli PM.Nov.23.20.MoM.exe (PID: 3556)
      • Talking points for meeting.exe (PID: 2752)
      • Talking points for meeting.exe (PID: 2532)
    • Loads dropped or rewritten executable

      • Talking points for meeting.exe (PID: 2532)
  • SUSPICIOUS

    • Starts Internet Explorer

      • AcroRd32.exe (PID: 2484)
    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 1168)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1168)
      • Talking points for meeting.exe (PID: 2752)
    • Creates files in the program directory

      • Details crown prince held 'secret meeting' with Israeli PM.Nov.23.20.MoM.exe (PID: 3556)
      • AdobeARM.exe (PID: 496)
    • Application launched itself

      • Talking points for meeting.exe (PID: 2752)
    • Loads Python modules

      • Talking points for meeting.exe (PID: 2532)
    • Drops a file that was compiled in debug mode

      • Talking points for meeting.exe (PID: 2752)
  • INFO

    • Application launched itself

      • AcroRd32.exe (PID: 2484)
      • iexplore.exe (PID: 3280)
      • RdrCEF.exe (PID: 2888)
    • Changes internet zones settings

      • iexplore.exe (PID: 3280)
    • Changes IE settings (feature browser emulation)

      • AcroRd32.exe (PID: 2484)
    • Creates files in the user directory

      • iexplore.exe (PID: 3044)
    • Reads the hosts file

      • RdrCEF.exe (PID: 2888)
    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3280)
    • Reads settings of System Certificates

      • AcroRd32.exe (PID: 2484)
    • Dropped object may contain Bitcoin addresses

      • Talking points for meeting.exe (PID: 2752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

PDFVersion: 1.4
Linearized: No
PageCount: 1
Creator: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36
Producer: Skia/PDF m87
CreateDate: 2020:11:24 08:37:26+00:00
ModifyDate: 2020:11:24 08:37:26+00:00
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
14
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start acrord32.exe acrord32.exe no specs iexplore.exe no specs iexplore.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs winrar.exe details crown prince held 'secret meeting' with israeli pm.nov.23.20.mom.exe no specs adobearm.exe no specs reader_sl.exe no specs details of mbs meeting with the us secretary of state.nov.23.20.mom.exe talking points for meeting.exe talking points for meeting.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2484"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\MBS-Israel.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
316"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Desktop\MBS-Israel.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
3280"C:\Program Files\Internet Explorer\iexplore.exe" https://drive.google.com/uc?export=download&id=1NnMlUPwkxK4_wAJwrqxqBAfdKCPDxyehC:\Program Files\Internet Explorer\iexplore.exeAcroRd32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3044"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3280 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2888"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
1548"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2888.0.542522725\1256205102" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2452"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2888.1.150285663\144592763" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
1168"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\MOM.rar"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3556"C:\Users\admin\AppData\Local\Temp\Rar$EXb1168.5375\MOM\Details crown prince held 'secret meeting' with Israeli PM.Nov.23.20.MoM.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1168.5375\MOM\Details crown prince held 'secret meeting' with Israeli PM.Nov.23.20.MoM.exeWinRAR.exe
User:
admin
Company:
SG
Integrity Level:
MEDIUM
Description:
SG
Version:
2.0.0.0
496"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:15.0 /MODE:3C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Reader and Acrobat Manager
Version:
1.824.27.2646
Total events
1 483
Read events
1 373
Write events
0
Delete events
0

Modification events

No data
Executable files
35
Suspicious files
14
Text files
36
Unknown types
25

Dropped files

PID
Process
Filename
Type
316AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
MD5:
SHA256:
3044iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab8370.tmp
MD5:
SHA256:
3044iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar8381.tmp
MD5:
SHA256:
3044iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\MOM[1].rar
MD5:
SHA256:
316AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rzi0fcx_151wte1_8s.tmp
MD5:
SHA256:
316AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R1cr4mvf_151wte3_8s.tmp
MD5:
SHA256:
316AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rbcl59v_151wte4_8s.tmp
MD5:
SHA256:
3044iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_7C1C45A209E1552633930171FD75B297binary
MD5:13041A5B4FCD12A08C0217C6E5BCF761
SHA256:F4F768F96D5B0F1E971DEAECB0B8726B97168AF9F431D8E0D866AE47A88E8835
3044iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\0K1WB8VI.txttext
MD5:657D517E540502F06F07079FD93FF63C
SHA256:1127B4076E63A07B7231CFBF84544C9409A6294A8A083B4319C4BA09E07AA1EC
2484AcroRd32.exeC:\Users\admin\AppData\Local\Temp\CabA800.tmp
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
12
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2484
AcroRd32.exe
GET
304
92.122.188.31:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
whitelisted
2484
AcroRd32.exe
GET
304
92.122.188.31:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/278_15_23_20070.zip
unknown
whitelisted
3044
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQD76E8xQFZstgIAAAAAgFWS
US
der
472 b
whitelisted
2484
AcroRd32.exe
GET
304
92.122.188.31:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
whitelisted
3044
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAhrYrWeURCWAgAAAACAVck%3D
US
der
471 b
whitelisted
3044
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2484
AcroRd32.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
2484
AcroRd32.exe
GET
200
92.122.188.31:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
compressed
9.54 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3044
iexplore.exe
172.217.18.14:443
drive.google.com
Google Inc.
US
whitelisted
2484
AcroRd32.exe
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
whitelisted
3044
iexplore.exe
142.250.74.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3044
iexplore.exe
216.58.206.1:443
doc-0s-ac-docs.googleusercontent.com
Google Inc.
US
whitelisted
104.75.88.144:443
armmf.adobe.com
Akamai Technologies, Inc.
NL
unknown
2484
AcroRd32.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2484
AcroRd32.exe
92.122.188.31:80
acroipm2.adobe.com
NTT America, Inc.
suspicious
104.111.214.232:443
ardownload2.adobe.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
drive.google.com
  • 172.217.18.14
shared
ocsp.pki.goog
  • 142.250.74.195
whitelisted
doc-0s-ac-docs.googleusercontent.com
  • 216.58.206.1
whitelisted
acroipm2.adobe.com
  • 92.122.188.31
  • 92.122.188.30
whitelisted
armmf.adobe.com
  • 2.18.233.74
  • 104.75.88.144
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ardownload2.adobe.com
  • 104.111.214.232
whitelisted

Threats

No threats detected
Process
Message
Details of MBS meeting with the US Secretary of State.Nov.23.20.MoM.exe
Click on : x=129,y=280