Malware analysis AdobeAIRInstaller.exe Malicious activity

Add for printing

File name:	AdobeAIRInstaller.exe
Full analysis:	https://app.any.run/tasks/472c2a14-8878-4ba6-ba14-0577d4e15857
Verdict:	Malicious activity
Analysis date:	October 05, 2019, 18:24:05
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	A57C38903764F64BA656DF01130C38D7
SHA1:	1CA3FCE6593960706526D26563A398CEF37628CC
SHA256:	6718308E10A45176155D0ECC8458BD3606308925B91F26A7D08C148CF52C9DB3
SSDEEP:	196608:HPXlRdMGELAS2tJVGts2mekfEI2KQrtQbTO1VSyOjqOH7zQiD0yo5n:/dMclGt+ekfE3KQX1VSy+q27zQiLo5n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - Adobe AIR Installer.exe (PID: 2868)
  - adobe air installer.exe (PID: 3744)
  - Adobe AIR Updater.exe (PID: 1032)
- Loads dropped or rewritten executable
  - Adobe AIR Installer.exe (PID: 2868)
  - adobe air installer.exe (PID: 3744)
  - Adobe AIR Updater.exe (PID: 1032)
SUSPICIOUS
- Executable content was dropped or overwritten
  - AdobeAIRInstaller.exe (PID: 3292)
  - msiexec.exe (PID: 1896)
  - adobe air installer.exe (PID: 3744)
- Application launched itself
  - Adobe AIR Installer.exe (PID: 2868)
- Creates files in the user directory
  - Adobe AIR Installer.exe (PID: 2868)
  - Adobe AIR Updater.exe (PID: 1032)
- Modifies the open verb of a shell class
  - msiexec.exe (PID: 1896)
- Creates files in the program directory
  - adobe air installer.exe (PID: 3744)
- Reads Internet Cache Settings
  - Adobe AIR Updater.exe (PID: 1032)
INFO
- Creates files in the program directory
  - msiexec.exe (PID: 1896)
- Creates a software uninstall entry
  - msiexec.exe (PID: 1896)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2019:04:18 00:43:23+02:00
PEType:	PE32
LinkerVersion:	14
CodeSize:	92672
InitializedDataSize:	350208
UninitializedDataSize:	-
EntryPoint:	0x1360
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI
FileVersionNumber:	32.0.0.125
ProductVersionNumber:	32.0.0.125
FileFlagsMask:	0x0003
FileFlags:	Pre-release
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
CompanyName:	Adobe
FileDescription:	Adobe AIR Installer
FileVersion:	32.0.0.125
InternalName:	Adobe AIR Installer.exe
LegalCopyright:	Copyright 2007-2019, Adobe
OriginalFileName:	Adobe AIR Installer.exe
ProductName:	Adobe AIR
ProductVersion:	32

Summary

Architecture:	IMAGE_FILE_MACHINE_I386
Subsystem:	IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:	17-Apr-2019 22:43:23
Detected languages:	English - United States
Debug artifacts:	E:\r\ws\St_Make\code\build\win\int\SelfExtractor.build\Release\info\SelfExtractor.pdb
CompanyName:	Adobe
FileDescription:	Adobe AIR Installer
FileVersion:	32.0.0.125
InternalName:	Adobe AIR Installer.exe
LegalCopyright:	Copyright 2007-2019, Adobe
OriginalFilename:	Adobe AIR Installer.exe
ProductName:	Adobe AIR
ProductVersion:	32.0

DOS Header

Magic number:	MZ
Bytes on last page of file:	0x0090
Pages in file:	0x0003
Relocations:	0x0000
Size of header:	0x0004
Min extra paragraphs:	0x0000
Max extra paragraphs:	0xFFFF
Initial SS value:	0x0000
Initial SP value:	0x00B8
Checksum:	0x0000
Initial IP value:	0x0000
Initial CS value:	0x0000
Overlay number:	0x0000
OEM identifier:	0x0000
OEM information:	0x0000
Address of NE header:	0x00000120

PE Headers

Signature:	PE
Machine:	IMAGE_FILE_MACHINE_I386
Number of sections:	5
Time date stamp:	17-Apr-2019 22:43:23
Pointer to Symbol Table:	0x00000000
Number of symbols:	0
Size of Optional Header:	0x00E0
Characteristics:	IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
.text	0x00001000	0x00016869	0x00016A00	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.64183
.rdata	0x00018000	0x00008CF4	0x00008E00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.87973
.data	0x00021000	0x00003278	0x00000A00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	2.1891
.rsrc	0x00025000	0x00048088	0x00048200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	3.68231
.reloc	0x0006E000	0x0000124C	0x00001400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.33652

Resources

Title	Entropy	Size	Codepage	Language	Type
1	5.3298	822	UNKNOWN	English - United States	RT_MANIFEST
2	3.6005	2216	UNKNOWN	English - United States	RT_ICON
3	2.66625	1384	UNKNOWN	English - United States	RT_ICON
4	3.53645	270376	UNKNOWN	English - United States	RT_ICON
5	3.82425	9640	UNKNOWN	English - United States	RT_ICON
6	4.05991	4264	UNKNOWN	English - United States	RT_ICON
7	4.41053	1128	UNKNOWN	English - United States	RT_ICON
100	2.71787	104	UNKNOWN	English - United States	RT_GROUP_ICON

Imports


KERNEL32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
ole32.dll

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1032

"c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe" -installupdatecheck

c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe

Adobe AIR Installer.exe

User:

admin

Company:

Adobe

Integrity Level:

MEDIUM

Description:

Adobe AIR Installer

Exit code:

Version:

32.0.0.125

Modules

Images
c:\program files\common files\adobe air\versions\1.0\resources\adobe air updater.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll

1896

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\msiexec.exe

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows® installer

Exit code:

Version:

5.0.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

2868

"C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\Adobe AIR Installer.exe"

C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\Adobe AIR Installer.exe

—

AdobeAIRInstaller.exe

User:

admin

Company:

Adobe

Integrity Level:

MEDIUM

Description:

Adobe AIR Installer

Exit code:

Version:

32.0.0.125

Modules

Images
c:\users\admin\appdata\local\temp\air6260.tmp\adobe air installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll

3292

"C:\Users\admin\AppData\Local\Temp\AdobeAIRInstaller.exe"

C:\Users\admin\AppData\Local\Temp\AdobeAIRInstaller.exe

explorer.exe

User:

admin

Company:

Adobe

Integrity Level:

MEDIUM

Description:

Adobe AIR Installer

Exit code:

Version:

32.0.0.125

Modules

Images
c:\users\admin\appdata\local\temp\adobeairinstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll

3744

"C:\Users\admin\appdata\local\temp\air6260.tmp\adobe air installer.exe" -stdio \\.\pipe\AIR_2868_0 -ei

C:\Users\admin\appdata\local\temp\air6260.tmp\adobe air installer.exe

Adobe AIR Installer.exe

User:

admin

Company:

Adobe

Integrity Level:

HIGH

Description:

Adobe AIR Installer

Exit code:

Version:

32.0.0.125

Modules

Images
c:\users\admin\appdata\local\temp\air6260.tmp\adobe air installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll

Add for printing

Total events

1 153

Read events

967

Write events

174

Delete events

Modification events


(PID) Process:	(3292) AdobeAIRInstaller.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0
(PID) Process:	(3292) AdobeAIRInstaller.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 1
(PID) Process:	(2868) Adobe AIR Installer.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0
(PID) Process:	(2868) Adobe AIR Installer.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 1
(PID) Process:	(1896) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000_CLASSES\Local Settings\MuiCache\72\52C64B7E
Operation:	write	Name:	LanguageList
Value: en-US
(PID) Process:	(1896) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Owner
Value: 68070000358F3D25AA7BD501
(PID) Process:	(1896) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:	write	Name:	SessionHash
Value: 580979C25347163004289F8DAD9BCC8FDF798B2ACF30BCB3D2B66D9228954843
(PID) Process:	(1896) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Sequence
Value: 1
(PID) Process:	(1896) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
Operation:	write	Name:
Value: c:\Windows\Installer\118d5a.ipi
(PID) Process:	(1896) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:	write	Name:	c:\Config.Msi\
Value:

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3292	AdobeAIRInstaller.exe	C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\Adobe AIR\Versions\1.0\Resources\template.msi		executable
		MD5:C0F9CE208B293C4FFEC4E06C94EEED2B	SHA256:025AC52C8FFA35FA35705523C7EB64366CE88914D6D0621C0C6182FEFAEC1C46
3292	AdobeAIRInstaller.exe	C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\Adobe AIR\Versions\1.0\Resources\setup.swf		swf
		MD5:71CD5B508E7450F68046374BDCE2260E	SHA256:D2EBA031A6B2C8FC21003AE94A71592EE71A5EE56A68984306310690F8BE5501
3292	AdobeAIRInstaller.exe	C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.swf		swf
		MD5:EB7B002188DA8F02732CA4801432E5A0	SHA256:AF8EE134BC888EC868D256A11193418C5C174970E4062085B43122E8806D685A
3292	AdobeAIRInstaller.exe	C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\setup.swf		swf
		MD5:71CD5B508E7450F68046374BDCE2260E	SHA256:D2EBA031A6B2C8FC21003AE94A71592EE71A5EE56A68984306310690F8BE5501
2868	Adobe AIR Installer.exe	C:\Users\admin\AppData\Local\Temp\fla7155.tmp		—
		MD5:—	SHA256:—
3292	AdobeAIRInstaller.exe	C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\Adobe AIR\Versions\1.0\Resources\stylesNative.swf		swf
		MD5:2DE5BAA003284509B0818E178B43E1DC	SHA256:AF23D54742C5B3D6FD2E524CCCE19C241DAFBD6F1EFB08589777A55C6195D305
2868	Adobe AIR Installer.exe	C:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx		—
		MD5:—	SHA256:—
3292	AdobeAIRInstaller.exe	C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\Adobe AIR Installer.exe		executable
		MD5:AFFCA265CBEE65DB29B75E97A0DABCD6	SHA256:F439BBACE34B523D2FBD7ADC5DC8E5D1597A270F8D6FB5887EC8DF4A28E4630E
3292	AdobeAIRInstaller.exe	C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\Adobe AIR\Versions\1.0\Resources\Adobe Root Certificate.cer		der
		MD5:BF70913FF8D6D60A47FE825330815DB4	SHA256:944E66AA967BD390952D22426BF1DFCD379A2C87A21B942FBCA79F41F0354AAC
3292	AdobeAIRInstaller.exe	C:\Users\admin\AppData\Local\Temp\AIR6260.tmp\Adobe AIR\Versions\1.0\Resources\WebKit\LGPL License.txt		text
		MD5:8C2A8D5DB686D0E41323611A1DCABB67	SHA256:98B84A0EF7B265DFD8C4796BC03EFF27EBCE5491026798C14508D80049434FEB

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

No HTTP requests

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
1032	Adobe AIR Updater.exe	2.18.233.74:443	airdownload.adobe.com	Akamai International B.V.	—	whitelisted

DNS requests

Domain	IP	Reputation
airdownload.adobe.com	2.18.233.74	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

AdobeAIRInstaller.exe

A57C38903764F64BA656DF01130C38D7

1CA3FCE6593960706526D26563A398CEF37628CC

6718308E10A45176155D0ECC8458BD3606308925B91F26A7D08C148CF52C9DB3

196608:HPXlRdMGELAS2tJVGts2mekfEI2KQrtQbTO1VSyOjqOH7zQiD0yo5n:/dMclGt+ekfE3KQX1VSy+q27zQiLo5n

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Loads dropped or rewritten executable

SUSPICIOUS

Executable content was dropped or overwritten

Application launched itself

Creates files in the user directory

Modifies the open verb of a shell class

Creates files in the program directory

Reads Internet Cache Settings

INFO

Creates files in the program directory

Creates a software uninstall entry

Malware configuration

Static information

TRiD

EXIF

EXE

Summary

DOS Header

PE Headers

Sections

Resources

Imports

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings