URL:

https://s3.jcloud.sjtu.edu.cn/331a60d07b0a4ac5b121dba66bf2b863-files/account_1/attachments/8538217/%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E7%AE%A1%E7%90%86lecture2.pdf?response-content-disposition=attachment;%20filename=%22______lecture2.pdf%22;%20filename*=utf-8%27%27%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E8%AE%A1%E9%87%8Flecture2.pdf&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=6ff09c1934f74c46ac1e2f9d9165ba8c/20240321/us-east-1/s3/aws4_request&x-amz-date=20240321t013631z&x-amz-expires=3600&x-amz-signedheaders=host&x-amz-signature=a75169b574624b1dc6fb257164b0624ae21768e29615882d9ffa276b27b162e4

Full analysis: https://app.any.run/tasks/ebc02ffa-3474-49b7-9c80-97d04cc5beb1
Verdict: Malicious activity
Analysis date: March 21, 2024, 03:02:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6B0F1ECF7484832B3C22CBB246CF26F6

SHA1:

ACDFEEA8BA3A5244C81FBCA7306EF7CC41BFF88C

SHA256:

6801DFA1DD7B9D40981B79F6FE6B34BF605356405D1558808DD2D66C1B389D28

SSDEEP:

12:2awWt0mWfgRgpZxiTcCBkyyJWOSi+ChAJI41M5QLUJSSH0Y:2tMDWfg2RK/2Q9J91MSYz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2572"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3936 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3936"C:\Program Files\Internet Explorer\iexplore.exe" "https://s3.jcloud.sjtu.edu.cn/331a60d07b0a4ac5b121dba66bf2b863-files/account_1/attachments/8538217/%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E7%AE%A1%E7%90%86lecture2.pdf?response-content-disposition=attachment;%20filename=%22______lecture2.pdf%22;%20filename*=utf-8%27%27%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E8%AE%A1%E9%87%8Flecture2.pdf&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=6ff09c1934f74c46ac1e2f9d9165ba8c/20240321/us-east-1/s3/aws4_request&x-amz-date=20240321t013631z&x-amz-expires=3600&x-amz-signedheaders=host&x-amz-signature=a75169b574624b1dc6fb257164b0624ae21768e29615882d9ffa276b27b162e4"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
12 638
Read events
12 514
Write events
91
Delete events
33

Modification events

(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31095612
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31095612
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
10
Text files
6
Unknown types
6

Dropped files

PID
Process
Filename
Type
3936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1B3A861FB8AD85A44DEB5E4E19269CE1
SHA256:F59F42AF3D014CB1F3738F0F6AB8634DD6A18CEB054A75D5A4B83637C8443B77
3936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_477B6851A9C658AD696F733A44332855der
MD5:E9207D1DE43F759F5A59B924997383D2
SHA256:F5BD6F9E5FF771A3F9FBADBC32FF63D4069D375ABF5B0C5E0878023E08F6844C
3936iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Y83D9UF7.txttext
MD5:BFA9B5EB2C94F7E711CD38C7E9901B59
SHA256:2C002EAAFC8F305964F34ACD9D1E2C3B5ECD81A3B971C8FC8F8D60CF016B4240
2572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25der
MD5:0AD25FC0D477755B7EF40DBFC3FF505A
SHA256:B165F423699EA451FFA80C5CADF04EBE2774175978B65F2022F874335BEFE950
2572iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_477B6851A9C658AD696F733A44332855binary
MD5:241ACD232FFF5B19D551757C41641833
SHA256:ED9D7E0AFA04C23D4DAFC1A6F7FDF30CEFE321F4C4583D80E6B2DD05F734E7E0
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53der
MD5:ABC8BD25A287A6D4F0DB456AB8F9F44C
SHA256:B93132EB8760AA06E9445F55717BAE67DF70935FF16E079E41A4FC9CFE1A7EE0
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:958A05B34A48684E3C1409E3457831A2
SHA256:308FEDB5EF66D69D37A18B550B0347D68B2F1E2CC4637D5D88C2584CAC03F64E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
35
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3936
iexplore.exe
GET
304
2.22.242.122:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
unknown
3936
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
2572
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
binary
1.42 Kb
unknown
2572
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEBQh1tv%2F8Hem%2BLMLun4drv4%3D
unknown
binary
978 b
unknown
2572
iexplore.exe
GET
200
150.139.142.18:80
http://ocsp.trust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSbE%2BXqEx8zZGHQka14Q6SZmwksCwQUwhuX3yLFUNE4gQNtV9OGIKVuAFYCEQDmVW0%2FcHTWUtTeR5jai2zJ
unknown
binary
282 b
unknown
3936
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3936
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
95.101.54.248:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?aa4b77dd5ef709e5
unknown
compressed
67.5 Kb
unknown
3936
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
304
95.101.54.248:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ae332821cb231d51
unknown
compressed
67.5 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2572
iexplore.exe
111.186.60.57:443
s3.jcloud.sjtu.edu.cn
China Education and Research Network Center
CN
unknown
3936
iexplore.exe
104.126.37.185:443
www.bing.com
Akamai International B.V.
DE
unknown
3936
iexplore.exe
2.22.242.122:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3936
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2572
iexplore.exe
111.186.60.59:443
s3.jcloud.sjtu.edu.cn
China Education and Research Network Center
CN
unknown
2572
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
3936
iexplore.exe
104.126.37.178:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
s3.jcloud.sjtu.edu.cn
  • 111.186.60.57
  • 111.186.60.58
  • 111.186.60.59
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.178
  • 104.126.37.123
  • 104.126.37.163
  • 104.126.37.171
  • 104.126.37.130
whitelisted
ctldl.windowsupdate.com
  • 2.22.242.122
  • 2.22.242.105
  • 95.101.54.248
  • 2.16.202.65
  • 2.16.202.67
  • 95.101.54.227
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.trust-provider.cn
  • 150.139.142.18
  • 117.27.246.96
  • 183.201.244.22
  • 112.50.95.96
  • 36.248.38.100
malicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://s3.jcloud.sjtu.edu.cn/331a60d07b0a4ac5b121dba66bf2b863-files/account_1/attachments/8538217/%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E7%AE%A1%E7%90%86lecture2.pdf?response-content-disposition=attachment;%20filename=%22______lecture2.pdf%22;%20filename*=utf-8%27%27%E4%BF%A1%E7%94%A8%E9%A3%8E%E9%99%A9%E8%AE%A1%E9%87%8Flecture2.pdf&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=6ff09c1934f74c46ac1e2f9d9165ba8c/20240321/us-east-1/s3/aws4_request&x-amz-date=20240321t013631z&x-amz-expires=3600&x-amz-signedheaders=host&x-amz-signature=a75169b574624b1dc6fb257164b0624ae21768e29615882d9ffa276b27b162e4