analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RV Una mejor solución para sus viajes - Uber Para Empresas.msg

Full analysis: https://app.any.run/tasks/c7a0d3ca-70d6-4998-9999-a963067d6baf
Verdict: Malicious activity
Analysis date: October 14, 2019, 21:25:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

00F786D42D796316437284CC4C034431

SHA1:

2E27C22D3165F0B1DB348F430D560E3E8AC83D2F

SHA256:

6FFF38EA3E755B05736015F8BD8DED8A63B01A1868F62A6BFCA73C125C201A6B

SSDEEP:

49152:0BK6bjtvCOOk77cu9yhd/4+/1TSHaGU1Cc8nRjGbas2T:0zb4Zk7Am4ZdTPCc8np8J2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2448)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2448)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2448)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2448)

    • Creates files in the program directory

      • AdobeARM.exe (PID: 3452)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2448)

    • Reads the hosts file

      • RdrCEF.exe (PID: 3836)

    • Reads internet explorer settings

      • iexplore.exe (PID: 184)

    • Changes internet zones settings

      • iexplore.exe (PID: 892)

    • Application launched itself

      • RdrCEF.exe (PID: 3836)
      • iexplore.exe (PID: 892)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs iexplore.exe iexplore.exe adobearm.exe no specs reader_sl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2448"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\RV Una mejor solución para sus viajes - Uber Para Empresas.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
1892"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\URETD0QF\Guía rápida para usuarios.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
OUTLOOK.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
3864"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\URETD0QF\Guía rápida para usuarios.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
3836"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
4088"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3836.0.1981780421\1665458924" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2876"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3836.1.349492310\1442287211" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
892"C:\Program Files\Internet Explorer\iexplore.exe" https://redeem.uber.com/public/opt-in/b3ef4483-1614-4c53-b2b5-b78ccba3c238C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
184"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:892 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3452"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:15.0 /MODE:3C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Reader and Acrobat Manager
Version:
1.824.27.2646
3796"C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe" C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe—AdobeARM.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat SpeedLauncher
Exit code:
0
Version:
15.23.20053.211670
Total events
2 416
Read events
1 767
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
3
Text files
45
Unknown types
15

Dropped files

PID
Process
Filename
Type
2448OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRAE5B.tmp.cvr —
MD5:—
SHA256:—
2448OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\URETD0QF\Guía rápida para usuarios (2).pdf\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3864AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
2448OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:16EF3B3F544FBE961BDD0EECB3E21BAD
SHA256:4B7D6904441FA5C79FA1139B6071B409A3DD23569617CE46044D83DB9CD01E3F
2448OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:26A845814C11A63A2CB89071ADA1C9AA
SHA256:0B51744A356FB70F84A4BED49E17F4BCD330C1BB955A54BBFC06DACB5F159F98
2448OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5537BAD4.datimage
MD5:6F1BEC12BB2AB11DF79177D2D7A26E97
SHA256:8BC4119CE123356EE3E0F6B022B0639D17F2DAA9CD15289F953EEDF1A05F72C3
2448OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\URETD0QF\Guía rápida para usuarios (2).pdfpdf
MD5:43B48C8F5D979EFB4766BB9D1DE5B474
SHA256:7DE013050E83DEBE481CF11CF2AF3FE6E9ACA19A503E0B9BB43B46BB5D4DE12B
2448OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\URETD0QF\Guía rápida para usuarios.pdfpdf
MD5:43B48C8F5D979EFB4766BB9D1DE5B474
SHA256:7DE013050E83DEBE481CF11CF2AF3FE6E9ACA19A503E0B9BB43B46BB5D4DE12B
3864AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagessqlite
MD5:71289F8F8D3000638A846F994C51E52B
SHA256:A67239B25EF289BB16B95FEB12A1D0A77FEF6772CD26901970BCE3116D81FCB9
2448OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:48DD6CAE43CE26B992C35799FCD76898
SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
11
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1892
AcroRd32.exe
GET
304
2.16.186.57:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
—
—
whitelisted
1892
AcroRd32.exe
GET
304
2.16.186.57:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
—
—
whitelisted
1892
AcroRd32.exe
GET
304
2.16.186.57:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip
unknown
—
—
whitelisted
1892
AcroRd32.exe
GET
304
2.16.186.57:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
—
—
whitelisted
892
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2448
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
892
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
2.21.36.203:443
armmf.adobe.com
GTT Communications Inc.
FR
suspicious
1892
AcroRd32.exe
2.16.186.57:80
acroipm2.adobe.com
Akamai International B.V.
—
whitelisted
184
iexplore.exe
104.36.195.216:443
redeem.uber.com
Uber Technologies, Inc
US
unknown
1892
AcroRd32.exe
2.21.36.203:443
armmf.adobe.com
GTT Communications Inc.
FR
suspicious
—
—
2.18.233.74:443
ardownload2.adobe.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
acroipm2.adobe.com
  • 2.16.186.57
  • 2.16.186.97
whitelisted
armmf.adobe.com
  • 2.21.36.203
whitelisted
redeem.uber.com
  • 104.36.195.216
  • 104.36.195.222
  • 104.36.195.231
  • 104.36.195.215
  • 104.36.195.212
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ardownload2.adobe.com
  • 2.18.233.74
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RV Una mejor solución para sus viajes - Uber Para Empresas.msg