download:

pdfeditor.exe

Full analysis: https://app.any.run/tasks/4ae04e92-fee0-4682-8727-082401cbb44d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 24, 2019, 12:23:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3CED7A81834AB36A91F66F5CD7B0CB7C

SHA1:

CBC4D046424F1922986A3493D034D30A25D5778D

SHA256:

603048E6C9ED98BD46B7184A4F7477B8986D1D5E1296D0F8671F2C7AC31730E2

SSDEEP:

24576:Pk7GUr9WcQMg9eb/yyPT0jkVdXkI718PEdZy/SoYu5f:87GE9WTeGUVd0I718PfSoYu5f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Setup_pdfeditor.exe (PID: 2900)
      • lunach.exe (PID: 3332)
      • pdfconverter.exe (PID: 772)
      • regsvr32.exe (PID: 3504)
      • RegAsm.exe (PID: 3400)
      • gacutil.exe (PID: 2748)
      • RegAsm.exe (PID: 1864)
      • RegAsm.exe (PID: 2720)
      • RegAsm.exe (PID: 1888)
      • RegAsm.exe (PID: 836)
      • RegAsm.exe (PID: 2164)
      • gacutil.exe (PID: 2372)
      • gacutil.exe (PID: 2456)

    • Registers / Runs the DLL via REGSVR32.EXE

      • Setup_pdfeditor.exe (PID: 2900)

    • Application was dropped or rewritten from another process

      • Setup_pdfeditor.exe (PID: 2900)
      • pdfconverter.exe (PID: 772)
      • lunach.exe (PID: 3332)
      • RegAsm.exe (PID: 3400)
      • RegAsm.exe (PID: 1864)
      • RegAsm.exe (PID: 2164)
      • RegAsm.exe (PID: 1888)
      • RegAsm.exe (PID: 836)
      • RegAsm.exe (PID: 2720)
      • gacutil.exe (PID: 2372)
      • gacutil.exe (PID: 3408)
      • gacutil.exe (PID: 2440)
      • gacutil.exe (PID: 3512)
      • gacutil.exe (PID: 2456)
      • gacutil.exe (PID: 2748)

    • Changes settings of System certificates

      • VSTOInstaller.exe (PID: 3084)

    • Downloads executable files from the Internet

      • pdfeditor.exe (PID: 4072)

  • SUSPICIOUS

    • Creates files in the program directory

      • pdfeditor.exe (PID: 4072)
      • Setup_pdfeditor.exe (PID: 2900)
      • lunach.exe (PID: 3332)
      • pdfconverter.exe (PID: 772)

    • Executable content was dropped or overwritten

      • Setup_pdfeditor.exe (PID: 2900)
      • pdfconverter.exe (PID: 772)

    • Starts Internet Explorer

      • Setup_pdfeditor.exe (PID: 2900)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 3504)
      • RegAsm.exe (PID: 1864)
      • RegAsm.exe (PID: 2720)
      • RegAsm.exe (PID: 836)
      • regedit.exe (PID: 1288)

    • Removes files from Windows directory

      • gacutil.exe (PID: 3408)
      • gacutil.exe (PID: 3512)
      • gacutil.exe (PID: 2440)

    • Creates files in the Windows directory

      • gacutil.exe (PID: 2440)
      • gacutil.exe (PID: 3408)
      • gacutil.exe (PID: 3512)
      • gacutil.exe (PID: 2456)
      • gacutil.exe (PID: 2372)
      • gacutil.exe (PID: 2748)

    • Creates files in the user directory

      • Setup_pdfeditor.exe (PID: 2900)

    • Adds / modifies Windows certificates

      • VSTOInstaller.exe (PID: 3084)

    • Creates a software uninstall entry

      • Setup_pdfeditor.exe (PID: 2900)
      • regedit.exe (PID: 1288)

    • Creates or modifies windows services

      • regedit.exe (PID: 1288)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 1660)

    • Application launched itself

      • iexplore.exe (PID: 1660)

    • Creates files in the user directory

      • iexplore.exe (PID: 2628)
      • iexplore.exe (PID: 1660)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2628)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2628)

    • Dropped object may contain Bitcoin addresses

      • pdfconverter.exe (PID: 772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:10:21 08:33:16+02:00
PEType: PE32
LinkerVersion: 9
CodeSize: 456192
InitializedDataSize: 734208
UninitializedDataSize: -
EntryPoint: 0x23305
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: Private build, Special build
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
Comments: 迅捷PDF编辑器
CompanyName: 上海互盾信息科技有限公司
FileDescription: 迅捷PDF编辑器
FileVersion: 1
InternalName: 迅捷PDF编辑器
LegalCopyright: 上海互盾信息科技有限公司
LegalTrademarks: 互盾科技
OriginalFileName: 互盾科技
PrivateBuild: 迅捷PDF编辑器
ProductName: 迅捷PDF编辑器
ProductVersion: 1
SpecialBuild: 迅捷PDF编辑器

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 21-Oct-2016 06:33:16
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • C:\Users\Administrator\Documents\GitLab\Installer\src\Release\HuifudashiInstaller.pdb
Comments: 迅捷PDF编辑器
CompanyName: 上海互盾信息科技有限公司
FileDescription: 迅捷PDF编辑器
FileVersion: 1.0
InternalName: 迅捷PDF编辑器
LegalCopyright: 上海互盾信息科技有限公司
LegalTrademarks: 互盾科技
OriginalFilename: 互盾科技
PrivateBuild: 迅捷PDF编辑器
ProductName: 迅捷PDF编辑器
ProductVersion: 1.0
SpecialBuild: 迅捷PDF编辑器

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 21-Oct-2016 06:33:16
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0006F444
0x0006F600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.57094
.rdata
0x00071000
0x000175DA
0x00017600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.1049
.data
0x00089000
0x000074C0
0x00003600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.44961
.rsrc
0x00091000
0x0008BC4C
0x0008BE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.91516
.reloc
0x0011D000
0x0000C9EA
0x0000CA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.64893

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.01229
633
Latin 1 / Western European
English - United States
RT_MANIFEST
2
4.83446
67624
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
4.99743
38056
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
5.14346
21640
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
5.28681
16936
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
5.31229
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
7
3.35564
382
Latin 1 / Western European
Chinese - PRC
RT_STRING
8
4.98665
2440
Latin 1 / Western European
Chinese - PRC
RT_ICON
9
5.24631
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
102
2.56906
76
Latin 1 / Western European
Chinese - PRC
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.dll
OLEACC.dll (delay-loaded)
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
24
Malicious processes
17
Suspicious processes
1

Behavior graph

Click at the process to see the details
download and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start pdfeditor.exe setup_pdfeditor.exe iexplore.exe iexplore.exe regsvr32.exe no specs regsvr32.exe no specs vstoinstaller.exe no specs vstoinstaller.exe no specs gacutil.exe no specs gacutil.exe no specs gacutil.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs gacutil.exe no specs gacutil.exe no specs gacutil.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs lunach.exe pdfconverter.exe regedit.exe no specs pdfeditor.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
772"C:\ProgramData\pdfconverter\pdfconverter.exe" C:\ProgramData\pdfconverter\pdfconverter.exe
lunach.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\pdfconverter\pdfconverter.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\programdata\pdfconverter\qt5core.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\programdata\pdfconverter\libgcc_s_dw2-1.dll
836"C:\ProgramData\pdfconverter\OfficeCom\Word\32\RegAsm.exe" "C:\ProgramData\pdfconverter\OfficeCom\Word\32\ComWordPDF.dll"C:\ProgramData\pdfconverter\OfficeCom\Word\32\RegAsm.exe—Setup_pdfeditor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.8922 (WinRelRS4.050727-8900)
Modules
Images
c:\programdata\pdfconverter\officecom\word\32\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
908"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe" /s /u "C:\ProgramData\pdfconverter\tools\VstoWordPDF.vsto"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe—Setup_pdfeditor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Studio Tools for Office Solution Installer
Exit code:
4294966895
Version:
10.0.31007.0 built by: VSTO_Rel
Modules
Images
c:\program files\common files\microsoft shared\vsto\10.0\vstoinstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
1288"C:\Windows\regedit.exe" /s "C:/ProgramData/pdfconverter\reg\bcl.reg"C:\Windows\regedit.exe—pdfconverter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1660"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
Setup_pdfeditor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1864"C:\ProgramData\pdfconverter\OfficeCom\Excel\32\RegAsm.exe" "C:\ProgramData\pdfconverter\OfficeCom\Excel\32\ComExcelPDF.dll"C:\ProgramData\pdfconverter\OfficeCom\Excel\32\RegAsm.exe—Setup_pdfeditor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.8922 (WinRelRS4.050727-8900)
Modules
Images
c:\programdata\pdfconverter\officecom\excel\32\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1888"C:\ProgramData\pdfconverter\OfficeCom\PowerPoint\32\RegAsm.exe" "C:\ProgramData\pdfconverter\OfficeCom\PowerPoint\32\ComPptPDF.dll" /uC:\ProgramData\pdfconverter\OfficeCom\PowerPoint\32\RegAsm.exe—Setup_pdfeditor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.8922 (WinRelRS4.050727-8900)
Modules
Images
c:\programdata\pdfconverter\officecom\powerpoint\32\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2164"C:\ProgramData\pdfconverter\OfficeCom\Word\32\RegAsm.exe" "C:\ProgramData\pdfconverter\OfficeCom\Word\32\ComWordPDF.dll" /uC:\ProgramData\pdfconverter\OfficeCom\Word\32\RegAsm.exe—Setup_pdfeditor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.8922 (WinRelRS4.050727-8900)
Modules
Images
c:\programdata\pdfconverter\officecom\word\32\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2372"C:\ProgramData\pdfconverter\OfficeCom\PowerPoint\32\gacutil.exe" /i "C:\ProgramData\pdfconverter\OfficeCom\PowerPoint\32\ComPptPDF.dll"C:\ProgramData\pdfconverter\OfficeCom\PowerPoint\32\gacutil.exe—Setup_pdfeditor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) .NET Framework 全局程序集缓存实用工具
Exit code:
0
Version:
3.5.21022.8 (RTM.021022-0800)
Modules
Images
c:\programdata\pdfconverter\officecom\powerpoint\32\gacutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2440"C:\ProgramData\pdfconverter\OfficeCom\Excel\64\gacutil.exe" /i "C:\ProgramData\pdfconverter\OfficeCom\Excel\64\ComExcelPDF.dll"C:\ProgramData\pdfconverter\OfficeCom\Excel\64\gacutil.exe—Setup_pdfeditor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) .NET Framework 全局程序集缓存实用工具
Exit code:
1
Version:
3.5.21022.8 (RTM.021022-0800)
Modules
Images
c:\programdata\pdfconverter\officecom\excel\64\gacutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
Total events
1 459
Read events
832
Write events
626
Delete events
1

Modification events

(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(4072) pdfeditor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfeditor_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
92
Suspicious files
26
Text files
256
Unknown types
112

Dropped files

PID
Process
Filename
Type
4072pdfeditor.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\pdfconverter[1].exe —
MD5:—
SHA256:—
4072pdfeditor.exeC:\Program Files\XunjiePdfEditor\Setup_pdfeditor.exe —
MD5:—
SHA256:—
2900Setup_pdfeditor.exeC:\ProgramData\pdfconverter\PdfPage.dll —
MD5:—
SHA256:—
4072pdfeditor.exeC:\Users\admin\AppData\Local\Temp\res.zipcompressed
MD5:—
SHA256:—
4072pdfeditor.exeC:\Program Files\XunjiePdfEditor\set.initext
MD5:—
SHA256:—
2900Setup_pdfeditor.exeC:\ProgramData\pdfconverter\QLib7z.dllexecutable
MD5:—
SHA256:—
2900Setup_pdfeditor.exeC:\ProgramData\pdfconverter\PubOperate.dllexecutable
MD5:—
SHA256:—
2900Setup_pdfeditor.exeC:\ProgramData\pdfconverter\PubMethod.dllexecutable
MD5:—
SHA256:—
2900Setup_pdfeditor.exeC:\ProgramData\pdfconverter\Aspose.Total.lictext
MD5:—
SHA256:—
2900Setup_pdfeditor.exeC:\ProgramData\pdfconverter\PDFConsole.exe.configxml
MD5:357B302903F3FD55C20DDF876835AE35
SHA256:309E6FEDB75EDB45DFF3937EFB1565F19443EC2CDB8EA20B91254701C3E7AC6D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
12
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4072
pdfeditor.exe
GET
302
220.194.79.107:80
http://tj.sjhfrj.com/redirect/ver1/pdfeditor/download_silent/1.0/installer/123456
CN
—
—
malicious
2628
iexplore.exe
GET
302
220.194.79.107:80
http://tj.sjhfrj.com/redirect/ver1/PDFConverter/welcome/8.0.1.3/Setup_pdfeditor.exe/%7Bmachineid%7D
CN
—
—
malicious
4072
pdfeditor.exe
GET
200
122.246.20.202:80
http://download.huduntech.com/software/pdf2word/silent/pdfconverter.exe
CN
executable
37.6 Mb
malicious
3332
lunach.exe
POST
200
123.206.214.101:80
http://update.api.huduntech.com/ver1/checkUpdate
CN
text
43 b
unknown
1660
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
772
pdfconverter.exe
61.154.126.89:443
download.huduntech.com
No.31,Jin-rong Street
CN
unknown
772
pdfconverter.exe
118.25.118.230:443
tj2.huduntech.com
—
CN
unknown
4072
pdfeditor.exe
220.194.79.107:80
tj.sjhfrj.com
CHINA UNICOM China169 Backbone
CN
malicious
4072
pdfeditor.exe
122.246.20.202:80
download.huduntech.com
No.31,Jin-rong Street
CN
suspicious
1660
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2628
iexplore.exe
103.235.46.191:443
hm.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
suspicious
2628
iexplore.exe
59.111.163.4:443
da.qiyukf.com
Guangzhou NetEase Computer System Co., Ltd.
CN
unknown
2628
iexplore.exe
101.69.121.89:443
tj.sjhfrj.com
CHINA UNICOM China169 Backbone
CN
unknown
3332
lunach.exe
123.206.214.101:80
update.api.huduntech.com
Shenzhen Tencent Computer Systems Company Limited
CN
unknown
2628
iexplore.exe
220.194.79.107:80
tj.sjhfrj.com
CHINA UNICOM China169 Backbone
CN
malicious

DNS requests

Domain
IP
Reputation
tj.sjhfrj.com
  • 220.194.79.107
  • 101.69.121.120
  • 113.59.43.98
  • 221.204.60.63
  • 221.204.60.97
  • 112.90.58.197
  • 101.69.121.89
  • 221.204.60.123
  • 27.221.54.190
  • 123.6.4.228
  • 58.251.150.54
  • 119.188.3.139
  • 121.29.54.199
malicious
download.huduntech.com
  • 122.246.20.202
  • 61.154.126.89
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.xunjiepdf.com
  • 101.69.121.89
  • 221.204.60.123
  • 27.221.54.190
  • 123.6.4.228
  • 58.251.150.54
  • 119.188.3.139
  • 121.29.54.199
  • 220.194.79.107
  • 101.69.121.120
  • 113.59.43.98
  • 221.204.60.63
  • 221.204.60.97
  • 112.90.58.197
malicious
update.api.huduntech.com
  • 123.206.214.101
unknown
qiyukf.com
  • 59.111.163.134
whitelisted
tj2.huduntech.com
  • 118.25.118.230
unknown
hm.baidu.com
  • 103.235.46.191
whitelisted
da.qiyukf.com
  • 59.111.163.4
unknown

Threats

PID
Process
Class
Message
4072
pdfeditor.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4072
pdfeditor.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
772
pdfconverter.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
Process
Message
lunach.exe
QMetaObject::connectSlotsByName: No matching signal for on_ok_clicked()
lunach.exe
qt.network.ssl: QSslSocket: cannot resolve TLSv1_1_client_method
lunach.exe
qt.network.ssl: QSslSocket: cannot resolve TLSv1_2_client_method
lunach.exe
qt.network.ssl: QSslSocket: cannot resolve TLSv1_1_server_method
lunach.exe
qt.network.ssl: QSslSocket: cannot resolve TLSv1_2_server_method
lunach.exe
qt.network.ssl: QSslSocket: cannot resolve SSL_select_next_proto
lunach.exe
qt.network.ssl: QSslSocket: cannot resolve SSL_CTX_set_next_proto_select_cb
lunach.exe
qt.network.ssl: QSslSocket: cannot resolve SSL_get0_next_proto_negotiated
pdfconverter.exe
QMetaObject::connectSlotsByName: No matching signal for on_helpweb_clicked()
pdfconverter.exe
QMetaObject::connectSlotsByName: No matching signal for on_openfilebt2_clicked()
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pdfeditor.exe