Malware analysis http://search.hdocumentconverters.com/?uc=20190716&ad=appfocus78&source=%7Bsource%7D_v3-bb9_v3-bb9&uid=395778cb-2882-4fc9-8308-1c6808d678f8&i_id=converter_100.62&page=newtab& Malicious activity

Add for printing

URL:	http://search.hdocumentconverters.com/?uc=20190716&ad=appfocus78&source=%7Bsource%7D_v3-bb9_v3-bb9&uid=395778cb-2882-4fc9-8308-1c6808d678f8&i_id=converter_100.62&page=newtab&
Full analysis:	https://app.any.run/tasks/8316360c-0aca-407b-a1e8-8a0642758076
Verdict:	Malicious activity
Analysis date:	July 17, 2019, 03:09:07
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:	8B54DFC07DBD8511E0463C9D15C3518D
SHA1:	9203CC69011D5EA28BB20C62E8C01F069C2E89B6
SHA256:	567002B3043EBDDDDBAD1AEB432822A680BD5F431FB25D75F256247DD83EA6FB
SSDEEP:	3:N1KNAEXCduRCjyGqcxKXrgNQOnPHHyQGKLId0GTXDCDdUJQTAPwVECdRuD:CSEXEuj1coXkCwBKdHCB/TAJ/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 67.0.4 (x86 en-US) (67.0.4)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executed via COM
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2448)
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2536)
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 880)
  - WINWORD.EXE (PID: 1680)
INFO
- Changes internet zones settings
  - iexplore.exe (PID: 2924)
- Reads internet explorer settings
  - iexplore.exe (PID: 3368)
  - iexplore.exe (PID: 2520)
  - iexplore.exe (PID: 3344)
- Creates files in the user directory
  - iexplore.exe (PID: 3368)
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2448)
  - iexplore.exe (PID: 2520)
  - iexplore.exe (PID: 2924)
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2536)
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 880)
  - WINWORD.EXE (PID: 1680)
  - iexplore.exe (PID: 3344)
- Application launched itself
  - iexplore.exe (PID: 2924)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3368)
  - iexplore.exe (PID: 2520)
- Reads settings of System Certificates
  - iexplore.exe (PID: 3368)
  - iexplore.exe (PID: 2520)
  - iexplore.exe (PID: 2924)
- Changes settings of System certificates
  - iexplore.exe (PID: 2924)
- Adds / modifies Windows certificates
  - iexplore.exe (PID: 2924)
- Reads Microsoft Office registry keys
  - WINWORD.EXE (PID: 1680)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2924	"C:\Program Files\Internet Explorer\iexplore.exe" "http://search.hdocumentconverters.com/?uc=20190716&ad=appfocus78&source=%7Bsource%7D_v3-bb9_v3-bb9&uid=395778cb-2882-4fc9-8308-1c6808d678f8&i_id=converter_100.62&page=newtab&"	C:\Program Files\Internet Explorer\iexplore.exe		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3368	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2924 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
2520	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2924 CREDAT:203009	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
2448	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe	—	svchost.exe
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131
2536	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe	—	svchost.exe
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131
880	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe	—	svchost.exe
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131
3344	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2924 CREDAT:14337	C:\Program Files\Internet Explorer\iexplore.exe	—	iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
1680	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	—	svchost.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000

Add for printing

Total events

2 099

Read events

1 541

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

171

Unknown types

Dropped files

PID	Process	Filename		Type
3368	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ABJ5HRR\search_hdocumentconverters_com[1].txt		—
		MD5:—	SHA256:—
2924	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico		—
		MD5:—	SHA256:—
2924	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
3368	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat		dat
		MD5:0ED3016FEEC82A0F726B78FDC67E44CC	SHA256:E1951E7DA6B5F52B3452E16A295D2686FF17342DDF4F8EF5F6A56FF402BCBFE5
3368	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat		dat
		MD5:D1A45DE0A792A746EFF60424AB838D95	SHA256:C757C6B02553239BE65A4ACDAA6D5CFDE32D01962A4C55F9F75AFFB7F4B15F70
3368	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat		dat
		MD5:04C419A90D0EAC07717834343BFCD58D	SHA256:23CDEBC7285804F2095B849C07BAC4E24017583D785A22B25E001B7705FC572D
3368	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ABJ5HRR\impression[1]		text
		MD5:34CE88376FFC8971D3FE47803A69DCB0	SHA256:F3C948087393D56F410CDEB9513112B5364F59898FD1FD93BA50A6820D560799
3368	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ABJ5HRR\search_hdocumentconverters_com[1].htm		html
		MD5:D69354EBA493D917D0194E347340BF3C	SHA256:705DF87DC555B6D10817B66D4F2884BFE81903E6161019808B806423B77F3C4F
3368	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\779WWDIX\desktop.ini		ini
		MD5:4A3DEB274BB5F0212C2419D3D8D08612	SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3368	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\L8U41UBS\setting[1].txt		text
		MD5:EF9323D5935A425C7EBE28DA6BC79FE3	SHA256:1D8169EA23EB16843CE5C60A4A07191776C668BB3EB88C8695394316970C15E4

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

110

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3368	iexplore.exe	GET	200	52.55.209.5:80	http://search.hdocumentconverters.com/styles/home/setting?v=ryUN9ROxMocKoOuvctYLZZeK4BqnEgMfzTl9evNnkcM1	US	text	886 b	unknown
3368	iexplore.exe	GET	200	52.55.209.5:80	http://search.hdocumentconverters.com/styles/home/fileconverter_v6?v=YOKGHM9tVdd3E07OzRHLdQjDuIhoQgw8sqJJAl9RkkM1	US	text	8.28 Kb	unknown
3368	iexplore.exe	GET	200	52.55.209.5:80	http://search.hdocumentconverters.com/get/js/impression?uc=20190716&ap=appfocus78&source={source}_v3-bb9_v3-bb9&uid=395778cb-2882-4fc9-8308-1c6808d678f8&i_id=converter_100.62&cid=	US	text	613 b	unknown
2924	iexplore.exe	GET	200	204.79.197.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted
3368	iexplore.exe	GET	200	52.55.209.5:80	http://search.hdocumentconverters.com/styles/home/monetizedquicklinks?v=7k8hk-yR5id6wOSQl1euPcOZ3nnSekr-sH14AFOpC581	US	text	1.77 Kb	unknown
3368	iexplore.exe	GET	200	52.55.209.5:80	http://search.hdocumentconverters.com/?uc=20190716&ad=appfocus78&source=%7Bsource%7D_v3-bb9_v3-bb9&uid=395778cb-2882-4fc9-8308-1c6808d678f8&i_id=converter_100.62&page=newtab&	US	html	6.94 Kb	unknown
3368	iexplore.exe	GET	200	52.55.209.5:80	http://search.hdocumentconverters.com/Content/Home/FileConverter/Images/fc5.png	US	image	35.5 Kb	unknown
3368	iexplore.exe	GET	200	52.85.188.46:80	http://dap2y8k6nefku.cloudfront.net/quicklinkicons/news-1.png	US	image	14.1 Kb	whitelisted
3368	iexplore.exe	GET	200	52.55.209.5:80	http://search.hdocumentconverters.com/scripts/home/fileconverter_common?v=lUFdPVP8apV-othDWTYR_R_aKw1lCV__OoiE6zM-X7I1	US	text	157 Kb	unknown
3368	iexplore.exe	GET	200	52.85.188.46:80	http://dap2y8k6nefku.cloudfront.net/quicklinkicons/accuweather.png	US	image	13.1 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2924	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3368	iexplore.exe	52.55.209.5:80	search.hdocumentconverters.com	Amazon.com, Inc.	US	unknown
3368	iexplore.exe	52.85.188.4:443	d3ff8olul1r3ot.cloudfront.net	Amazon.com, Inc.	US	whitelisted
3368	iexplore.exe	52.85.188.163:80	x.ss2.us	Amazon.com, Inc.	US	unknown
3368	iexplore.exe	23.8.4.219:443	imp.mt48.net	Akamai International B.V.	NL	whitelisted
3368	iexplore.exe	54.174.5.12:443	imp.onesearch.org	Amazon.com, Inc.	US	unknown
3368	iexplore.exe	52.85.188.46:80	dap2y8k6nefku.cloudfront.net	Amazon.com, Inc.	US	unknown
2924	iexplore.exe	52.55.209.5:80	search.hdocumentconverters.com	Amazon.com, Inc.	US	unknown
2520	iexplore.exe	54.174.5.12:443	imp.onesearch.org	Amazon.com, Inc.	US	unknown
2520	iexplore.exe	172.217.16.170:443	fonts.googleapis.com	Google Inc.	US	whitelisted

DNS requests

Domain	IP	Reputation
search.hdocumentconverters.com	52.55.209.5 52.204.35.33	unknown
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
d3ff8olul1r3ot.cloudfront.net	52.85.188.4 52.85.188.22 52.85.188.61 52.85.188.153	shared
imp.mt48.net	23.8.4.219	whitelisted
imp.onesearch.org	54.174.5.12 52.22.227.196	whitelisted
dap2y8k6nefku.cloudfront.net	52.85.188.46 52.85.188.159 52.85.188.87 52.85.188.70	whitelisted
x.ss2.us	52.85.188.163 52.85.188.132 52.85.188.91 52.85.188.124	whitelisted
www.download.windowsupdate.com	2.16.186.56 2.16.186.81 8.241.9.254 8.248.119.254 8.241.9.126 8.248.127.254 67.27.233.126	whitelisted
allfilesconverter.com	34.224.176.71 52.71.211.126	suspicious
fonts.googleapis.com	172.217.16.170	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

http://search.hdocumentconverters.com/?uc=20190716&ad=appfocus78&source=%7Bsource%7D_v3-bb9_v3-bb9&uid=395778cb-2882-4fc9-8308-1c6808d678f8&i_id=converter_100.62&page=newtab&

8B54DFC07DBD8511E0463C9D15C3518D

9203CC69011D5EA28BB20C62E8C01F069C2E89B6

567002B3043EBDDDDBAD1AEB432822A680BD5F431FB25D75F256247DD83EA6FB

3:N1KNAEXCduRCjyGqcxKXrgNQOnPHHyQGKLId0GTXDCDdUJQTAPwVECdRuD:CSEXEuj1coXkCwBKdHCB/TAJ/

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Executed via COM

INFO

Changes internet zones settings

Reads internet explorer settings

Creates files in the user directory

Application launched itself

Reads Internet Cache Settings

Reads settings of System Certificates

Changes settings of System certificates

Adds / modifies Windows certificates

Reads Microsoft Office registry keys

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings