URL:

https://s3.jcloud.sjtu.edu.cn/331a60d07b0a4ac5b121dba66bf2b863-files/account_1/attachments/8538217/%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E7%AE%A1%E7%90%86lecture2.pdf?response-content-disposition=attachment;%20filename=%22______lecture2.pdf%22;%20filename*=utf-8%27%27%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E8%AE%A1%E9%87%8Flecture2.pdf&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=6ff09c1934f74c46ac1e2f9d9165ba8c/20240321/us-east-1/s3/aws4_request&x-amz-date=20240321t013631z&x-amz-expires=3600&x-amz-signedheaders=host&x-amz-signature=a75169b574624b1dc6fb257164b0624ae21768e29615882d9ffa276b27b162e4

Full analysis: https://app.any.run/tasks/ebc02ffa-3474-49b7-9c80-97d04cc5beb1
Verdict: Malicious activity
Analysis date: March 21, 2024, 03:02:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6B0F1ECF7484832B3C22CBB246CF26F6

SHA1:

ACDFEEA8BA3A5244C81FBCA7306EF7CC41BFF88C

SHA256:

6801DFA1DD7B9D40981B79F6FE6B34BF605356405D1558808DD2D66C1B389D28

SSDEEP:

12:2awWt0mWfgRgpZxiTcCBkyyJWOSi+ChAJI41M5QLUJSSH0Y:2tMDWfg2RK/2Q9J91MSYz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2572"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3936 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3936"C:\Program Files\Internet Explorer\iexplore.exe" "https://s3.jcloud.sjtu.edu.cn/331a60d07b0a4ac5b121dba66bf2b863-files/account_1/attachments/8538217/%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E7%AE%A1%E7%90%86lecture2.pdf?response-content-disposition=attachment;%20filename=%22______lecture2.pdf%22;%20filename*=utf-8%27%27%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E8%AE%A1%E9%87%8Flecture2.pdf&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=6ff09c1934f74c46ac1e2f9d9165ba8c/20240321/us-east-1/s3/aws4_request&x-amz-date=20240321t013631z&x-amz-expires=3600&x-amz-signedheaders=host&x-amz-signature=a75169b574624b1dc6fb257164b0624ae21768e29615882d9ffa276b27b162e4"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
12 638
Read events
12 514
Write events
91
Delete events
33

Modification events

(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31095612
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31095612
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
10
Text files
6
Unknown types
6

Dropped files

PID
Process
Filename
Type
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:795FE9695AA8756402A27B0D289F74C3
SHA256:D42C213F34C9862E5F7882CD59D781318535D5D70CD82C6C451D6ABE89D28A78
2572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25der
MD5:0AD25FC0D477755B7EF40DBFC3FF505A
SHA256:B165F423699EA451FFA80C5CADF04EBE2774175978B65F2022F874335BEFE950
2572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_477B6851A9C658AD696F733A44332855der
MD5:E9207D1DE43F759F5A59B924997383D2
SHA256:F5BD6F9E5FF771A3F9FBADBC32FF63D4069D375ABF5B0C5E0878023E08F6844C
3936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:CB741356D6346EEA18A35CDFD094714E
SHA256:54AA275D45C09FC00AB4EDB8B3AEA38456B5F26FFADCA571E2404B38ED64E8B8
2572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59618A625A936DB3C027FA8CB8DAFCBEder
MD5:64615E61A06714D3B2E32A74C80459AE
SHA256:9E1268E06D97AEA65E7A840622DA72D51C98BCE9E3105622A9756865EDDE13A5
2572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:1A40EE3D3F41846E6A2C18E4FE3BA2B0
SHA256:268AE408E6C0630C6819FF38116B21119E027D40A0D3F98D1A4295B79E2E5EE3
2572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59618A625A936DB3C027FA8CB8DAFCBEbinary
MD5:59F561E2E27B0B8759863656CF9E0460
SHA256:D8F9C433FD553DF01DEE2B421EBA3768BAA7E0D37E4D606D9579BC05D429F3E7
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1B3A861FB8AD85A44DEB5E4E19269CE1
SHA256:F59F42AF3D014CB1F3738F0F6AB8634DD6A18CEB054A75D5A4B83637C8443B77
3936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
35
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3936
iexplore.exe
GET
304
2.22.242.122:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
unknown
3936
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
2572
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
binary
1.42 Kb
unknown
2572
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEBQh1tv%2F8Hem%2BLMLun4drv4%3D
unknown
binary
978 b
unknown
2572
iexplore.exe
GET
200
150.139.142.18:80
http://ocsp.trust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSbE%2BXqEx8zZGHQka14Q6SZmwksCwQUwhuX3yLFUNE4gQNtV9OGIKVuAFYCEQDmVW0%2FcHTWUtTeR5jai2zJ
unknown
binary
282 b
unknown
3936
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3936
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
95.101.54.248:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?aa4b77dd5ef709e5
unknown
compressed
67.5 Kb
unknown
3936
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
304
95.101.54.248:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ae332821cb231d51
unknown
compressed
67.5 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2572
iexplore.exe
111.186.60.57:443
s3.jcloud.sjtu.edu.cn
China Education and Research Network Center
CN
unknown
3936
iexplore.exe
104.126.37.185:443
www.bing.com
Akamai International B.V.
DE
unknown
3936
iexplore.exe
2.22.242.122:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3936
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2572
iexplore.exe
111.186.60.59:443
s3.jcloud.sjtu.edu.cn
China Education and Research Network Center
CN
unknown
2572
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
3936
iexplore.exe
104.126.37.178:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
s3.jcloud.sjtu.edu.cn
  • 111.186.60.57
  • 111.186.60.58
  • 111.186.60.59
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.178
  • 104.126.37.123
  • 104.126.37.163
  • 104.126.37.171
  • 104.126.37.130
whitelisted
ctldl.windowsupdate.com
  • 2.22.242.122
  • 2.22.242.105
  • 95.101.54.248
  • 2.16.202.65
  • 2.16.202.67
  • 95.101.54.227
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.trust-provider.cn
  • 150.139.142.18
  • 117.27.246.96
  • 183.201.244.22
  • 112.50.95.96
  • 36.248.38.100
malicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://s3.jcloud.sjtu.edu.cn/331a60d07b0a4ac5b121dba66bf2b863-files/account_1/attachments/8538217/%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E7%AE%A1%E7%90%86lecture2.pdf?response-content-disposition=attachment;%20filename=%22______lecture2.pdf%22;%20filename*=utf-8%27%27%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E8%AE%A1%E9%87%8Flecture2.pdf&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=6ff09c1934f74c46ac1e2f9d9165ba8c/20240321/us-east-1/s3/aws4_request&x-amz-date=20240321t013631z&x-amz-expires=3600&x-amz-signedheaders=host&x-amz-signature=a75169b574624b1dc6fb257164b0624ae21768e29615882d9ffa276b27b162e4