File name:

inovoice-019338.pdf

Full analysis: https://app.any.run/tasks/ceda9915-b526-4c2a-81f8-26ab0cecc328
Verdict: Malicious activity
Threats:

FlawedAmmmyy is a RAT type malware that can be used to perform actions remotely on an infected PC. This malware is well known for being featured in especially large campaigns with wide target demographics.

Malware Trends Tracker     >>>
Analysis date: July 13, 2018, 04:45:24
OS: Windows 10 Professional (build: 16299, 64 bit)
Tags:
generated-doc
loader
ammyy
trojan
rat
flawedammyy
Indicators:
MIME: application/pdf
File info: PDF document, version 1.4
MD5:

2F7CEC0F91A5FD23D706DC53A82B2DB7

SHA1:

162E98D89F2AE3B4B469B066EBFE02AF22E9B869

SHA256:

576A373CCB9B62C3C934ABFE1573A87759A2BFE266477155E0E59F336CC28AB4

SSDEEP:

48:/KhVqyR0ZXEKYiG4Xus2EbfQIPaL7gjwmVLeG1pCZQ8VuwySPF:/KhJeXEme44IiL7gsmVLeGnCZQGujSPF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • AcroRd32.exe (PID: 5756)

    • Downloads executable files from the Internet

      • PowerShell.exe (PID: 4296)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 1904)
      • cmd.exe (PID: 5776)

    • Downloads executable files from IP

      • PowerShell.exe (PID: 4296)

    • Loads the Task Scheduler DLL interface

      • update12.exe (PID: 3172)

    • Connects to CnC server

      • wsus.exe (PID: 408)

    • Application was dropped or rewritten from another process

      • wsus.exe (PID: 408)
      • update12.exe (PID: 3172)

  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • PowerShell.exe (PID: 4296)

    • Checks supported languages

      • PowerShell.exe (PID: 4296)
      • AcroRd32.exe (PID: 5756)

    • Creates files in the user directory

      • PowerShell.exe (PID: 4296)

    • Executable content was dropped or overwritten

      • PowerShell.exe (PID: 4296)
      • update12.exe (PID: 3172)

    • Starts CMD.EXE for commands execution

      • update12.exe (PID: 3172)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1736)
      • cmd.exe (PID: 3924)

    • Creates files in the program directory

      • update12.exe (PID: 3172)

    • Creates files in the Windows directory

      • update12.exe (PID: 3172)

  • INFO

    • Reads settings of System Certificates

      • RdrCEF.exe (PID: 3820)
      • PowerShell.exe (PID: 4296)

    • Reads the software policy settings

      • RdrCEF.exe (PID: 3820)
      • PowerShell.exe (PID: 4296)

    • Reads the machine GUID from the registry

      • RdrCEF.exe (PID: 3820)
      • AcroRd32.exe (PID: 1536)
      • LogTransport2.exe (PID: 2188)
      • AcroRd32.exe (PID: 5756)

    • Application launched itself

      • RdrCEF.exe (PID: 3820)
      • AcroRd32.exe (PID: 5756)

    • Dropped object may contain URL's

      • AcroRd32.exe (PID: 1536)
      • RdrCEF.exe (PID: 3820)
      • LogTransport2.exe (PID: 2188)
      • update12.exe (PID: 3172)
      • PowerShell.exe (PID: 4296)

    • Creates files in the user directory

      • LogTransport2.exe (PID: 2188)
      • AcroRd32.exe (PID: 5756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

ModifyDate: 2018:07:12 12:17:42+03:00
CreateDate: 2018:07:12 12:17:42+03:00
Producer: iTextSharp™ 5.5.10 ©2000-2016 iText Group NV (AGPL-version)
PageCount: 1
Linearized: No
PDFVersion: 1.4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
115
Monitored processes
29
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start acrord32.exe no specs acrord32.exe no specs powershell.exe conhost.exe rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs update12.exe logtransport2.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe cmd.exe no specs cmd.exe no specs conhost.exe conhost.exe conhost.exe net.exe no specs sc.exe no specs sc.exe no specs net.exe no specs net1.exe no specs net1.exe no specs wsus.exe cmd.exe no specs conhost.exe cmd.exe no specs conhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
80\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
400net.exe stop ammyyC:\WINDOWS\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
408"C:\ProgramData\Microsoft Help\wsus.exe"C:\ProgramData\Microsoft Help\wsus.exe
update12.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\microsoft help\wsus.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
1348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe—LogTransport2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1536"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --channel=5756.0.1345717623 --type=renderer /prefetch:1 "C:\Users\admin\Desktop\inovoice-019338.pdf"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.7.20033.133275
Modules
Images
c:\program files (x86)\adobe\acrobat reader dc\reader\acrord32.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
1604"C:\WINDOWS\system32\cmd.exe" /c del C:\Users\admin\AppData\Local\Temp\update12.exe >> NULC:\WINDOWS\SysWOW64\cmd.exe—update12.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
1640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe
PowerShell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1660C:\WINDOWS\system32\net1 stop ammyyC:\WINDOWS\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
1712\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1736"C:\Windows\System32\cmd.exe" /C sc delete foundationC:\Windows\SysWOW64\cmd.exe—update12.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1060
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
Total events
1 907
Read events
1 736
Write events
171
Delete events
0

Modification events

(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter
Operation:writeName:bAlwaysUseServer
Value:
0
(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter
Operation:writeName:bAlwaysUseServerFD
Value:
0
(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter
Operation:writeName:bDefault
Value:
1
(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter
Operation:writeName:bDefaultFD
Value:
1
(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter
Operation:writeName:tDistMethod
Value:
UPLOAD
(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter\cSettings
Operation:writeName:tcSetting
Value:
https://api.share.acrobat.com
(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter
Operation:writeName:tUI
Value:
Adobe online services (Recommended)
(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter
Operation:writeName:tURL
Value:
urn://ns.adobe.com/Collaboration/SharedReview/Acrobat.com
(PID) Process:(1536) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cEmailDistribution
Operation:writeName:bAlwaysUseServerFD
Value:
0
Executable files
2
Suspicious files
21
Text files
93
Unknown types
7

Dropped files

PID
Process
Filename
Type
4296PowerShell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S51UATOCL9JAUAJ5RCI2.temp —
MD5:—
SHA256:—
3820RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3820_16652\index —
MD5:—
SHA256:—
3820RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3820_16652\data_0 —
MD5:—
SHA256:—
3820RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3820_16652\data_1 —
MD5:—
SHA256:—
3820RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3820_16652\data_2 —
MD5:—
SHA256:—
3820RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3820_16652\data_3 —
MD5:—
SHA256:—
1536AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.1536 —
MD5:—
SHA256:—
1536AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.1536 —
MD5:—
SHA256:—
1536AcroRd32.exeC:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_Acrobat12_Reader_c78b53af-8cee-4fe8-99df-aa0d3770c508_28c5e1ea-0923-44e0-bf5d-4a8f76cd2d9e_0.tmp —
MD5:—
SHA256:—
1536AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
13
DNS requests
5
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2280
svchost.exe
GET
304
104.89.34.252:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
NL
—
—
whitelisted
4468
svchost.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
4.39 Kb
whitelisted
4296
PowerShell.exe
GET
200
169.239.129.117:80
http://169.239.129.117/cal
ZA
executable
161 Kb
malicious
3172
update12.exe
GET
200
169.239.129.117:80
http://169.239.129.117/Yjdfel765Hs
ZA
binary
653 Kb
malicious
2188
LogTransport2.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
shared
2188
LogTransport2.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAnlg2ak5WARTP8yGdCgT20%3D
US
der
471 b
shared
2280
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D
US
der
471 b
shared
2280
svchost.exe
GET
200
104.89.34.252:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Secure%20Server%20CA%202.1.crl
NL
der
820 b
whitelisted
2280
svchost.exe
GET
200
95.101.72.27:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?74a0ca68aa72da10
unknown
compressed
7.61 Kb
whitelisted
2280
svchost.exe
GET
304
104.89.34.252:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
NL
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4296
PowerShell.exe
169.239.129.117:80
—
Zappie Host LLC
ZA
malicious
2188
LogTransport2.exe
93.184.220.29:80
crl3.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
131.253.61.80:443
—
Microsoft Corporation
US
whitelisted
3820
RdrCEF.exe
54.173.27.0:443
cloud.acrobat.com
Amazon.com, Inc.
US
unknown
3172
update12.exe
169.239.129.117:80
—
Zappie Host LLC
ZA
malicious
2280
svchost.exe
104.89.34.252:80
www.microsoft.com
Akamai Technologies, Inc.
NL
whitelisted
2280
svchost.exe
93.184.220.29:80
crl3.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
408
wsus.exe
185.99.132.119:443
—
Zappie Host LLC
NZ
malicious
2188
LogTransport2.exe
192.147.130.244:443
hl2rcv.adobe.com
Adobe Systems Inc.
US
whitelisted
2280
svchost.exe
95.101.72.27:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
crl3.digicert.com
  • 93.184.220.29
whitelisted
cloud.acrobat.com
  • 54.173.27.0
  • 52.6.202.91
whitelisted
hl2rcv.adobe.com
  • 192.147.130.244
whitelisted
www.microsoft.com
  • 104.89.34.252
whitelisted
ctldl.windowsupdate.com
  • 95.101.72.27
  • 95.101.72.49
whitelisted

Threats

PID
Process
Class
Message
4296
PowerShell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4296
PowerShell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4296
PowerShell.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
4296
PowerShell.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
408
wsus.exe
Misc activity
[PT SANDBOX] AMMYY RAT pkt checker #1
408
wsus.exe
A Network Trojan was detected
ET TROJAN Win32/FlawedAmmyy RAT CnC Checkin
408
wsus.exe
A Network Trojan was detected
[PT MALWARE] AMMYY.RAT Checkin
Process
Message
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
inovoice-019338.pdf