| File name: | PDFTool-v4.2.1228.0.msi |
| Full analysis: | https://app.any.run/tasks/b6efb45e-d8b5-4012-833d-cf5d73867063 |
| Verdict: | Malicious activity |
| Analysis date: | June 14, 2024, 15:24:30 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDFTool, Author: PDFTool, Keywords: Installer, MSI, Database, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o PDFTool., Create Time/Date: Fri Jun 7 01:15:52 2024, Name of Creating Application: PDFTool, Security: 0, Template: ;1033, Last Saved By: ;1046, Revision Number: {1D881603-9472-4DA8-ACE0-F1F439DB4DFC}4.2.1228.0;{1D881603-9472-4DA8-ACE0-F1F439DB4DFC}4.2.1228.0;{A0D9FBCF-6C79-4E3B-B7A0-54DCC675BD69}, Number of Pages: 450, Number of Characters: 63 |
| MD5: | 2D1E05F2A4BD4886A7934FFCE8A40F01 |
| SHA1: | 621129B87200B699EAE06585DA64240968048B18 |
| SHA256: | 7DD9222230B6A0BE922C6DCBAE3DE048A88CB0007171C8AAD2ECF4B26615F508 |
| SSDEEP: | 98304:T9ISoCSpkmN/2W4x0xaAW9BvOqPgBGs8fcE3JrOrSLDunddx+8tr7ELzXOpkAnva:fyQ |
MALICIOUS
Drops the executable file immediately after the start
- msiexec.exe (PID: 1200)
- msiexec.exe (PID: 3980)
- msiexec.exe (PID: 2276)
Bypass execution policy to execute commands
- powershell.exe (PID: 2264)
- powershell.exe (PID: 2612)
Changes powershell execution policy (Bypass)
- msiexec.exe (PID: 2276)
Changes the autorun value in the registry
- msiexec.exe (PID: 1200)
SUSPICIOUS
Reads the Internet Settings
- msiexec.exe (PID: 3980)
- powershell.exe (PID: 2264)
- msiexec.exe (PID: 2276)
- powershell.exe (PID: 2612)
- msiexec.exe (PID: 752)
Reads the Windows owner or organization settings
- msiexec.exe (PID: 1200)
Executes as Windows Service
- VSSVC.exe (PID: 2204)
Checks Windows Trust Settings
- msiexec.exe (PID: 1200)
- msiexec.exe (PID: 2276)
The process hide an interactive prompt from the user
- msiexec.exe (PID: 2276)
The process executes Powershell scripts
- msiexec.exe (PID: 2276)
The process bypasses the loading of PowerShell profile settings
- msiexec.exe (PID: 2276)
Starts POWERSHELL.EXE for commands execution
- msiexec.exe (PID: 2276)
Reads security settings of Internet Explorer
- msiexec.exe (PID: 2276)
- msiexec.exe (PID: 752)
Node.exe was dropped
- msiexec.exe (PID: 2276)
Process drops legitimate windows executable
- msiexec.exe (PID: 1200)
INFO
Create files in a temporary directory
- msiexec.exe (PID: 3980)
- msiexec.exe (PID: 1200)
- msiexec.exe (PID: 2276)
- powershell.exe (PID: 2264)
- powershell.exe (PID: 2612)
Checks supported languages
- msiexec.exe (PID: 1200)
- msiexec.exe (PID: 752)
- msiexec.exe (PID: 2276)
- wmpnscfg.exe (PID: 1680)
- PDFTool.exe (PID: 2432)
Reads the computer name
- msiexec.exe (PID: 752)
- msiexec.exe (PID: 1200)
- msiexec.exe (PID: 2276)
- wmpnscfg.exe (PID: 1680)
- PDFTool.exe (PID: 2432)
Reads the machine GUID from the registry
- msiexec.exe (PID: 752)
- msiexec.exe (PID: 1200)
- msiexec.exe (PID: 2276)
- PDFTool.exe (PID: 2432)
Manual execution by a user
- wmpnscfg.exe (PID: 1680)
Executable content was dropped or overwritten
- msiexec.exe (PID: 1200)
- msiexec.exe (PID: 3980)
- msiexec.exe (PID: 2276)
Reads security settings of Internet Explorer
- msiexec.exe (PID: 3980)
- powershell.exe (PID: 2264)
- powershell.exe (PID: 2612)
Creates files or folders in the user directory
- msiexec.exe (PID: 3980)
- msiexec.exe (PID: 1200)
- msiexec.exe (PID: 2276)
Reads the software policy settings
- msiexec.exe (PID: 3980)
- msiexec.exe (PID: 1200)
- msiexec.exe (PID: 2276)
Application launched itself
- msiexec.exe (PID: 1200)
Reads Environment values
- msiexec.exe (PID: 2276)
Disables trace logs
- powershell.exe (PID: 2264)
- powershell.exe (PID: 2612)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 2264)
- powershell.exe (PID: 2612)
Creates a software uninstall entry
- msiexec.exe (PID: 1200)
Checks proxy server information
- msiexec.exe (PID: 2276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Windows Installer (81.9) |
|---|---|---|
| .mst | | | Windows SDK Setup Transform Script (9.2) |
| .msp | | | Windows Installer Patch (7.6) |
| .msi | | | Microsoft Installer (100) |
EXIF
FlashPix
| Security: | None |
|---|---|
| CodePage: | Windows Latin 1 (Western European) |
| RevisionNumber: | {7127C901-3E00-4507-80E3-FA86FADB5431} |
| Words: | 10 |
| Subject: | PDFTool |
| Author: | PDFTool |
| LastModifiedBy: | - |
| Software: | PDFTool |
| Template: | ;1033,1046,3082,1055 |
| Comments: | PDFTool 4.2.1228.0 |
| Title: | Installation Database |
| Keywords: | Installer, MSI, Database |
| CreateDate: | 2024:06:07 01:16:14 |
| ModifyDate: | 2024:06:07 01:16:14 |
| LastPrinted: | 2024:06:07 01:16:14 |
| Pages: | 450 |
| Characters: | 63 |
Total processes
48
Monitored processes
9
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 752 | C:\Windows\system32\MsiExec.exe -Embedding F5ADCF5CDE31C0C91771189F24A8EF47 C | C:\Windows\System32\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1200 | C:\Windows\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1680 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2204 | C:\Windows\system32\vssvc.exe | C:\Windows\System32\VSSVC.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2264 | -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pss6892.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msi6880.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scr6881.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scr6891.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue." | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 2276 | C:\Windows\system32\MsiExec.exe -Embedding D90E816E29A4BADB49AD860312BDF825 | C:\Windows\System32\msiexec.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2432 | "C:\Users\admin\AppData\Local\PDFTool\PDFTool.exe" /register | C:\Users\admin\AppData\Local\PDFTool\PDFTool.exe | msiexec.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: WebView2App Version: 4.2.1228.0 Modules
| |||||||||||||||
| 2612 | -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\PDFTool\pssD7FC.ps1" -propFile "C:\Users\admin\AppData\Local\PDFTool\msiD7E9.txt" -scriptFile "C:\Users\admin\AppData\Local\PDFTool\scrD7EA.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\PDFTool\scrD7EB.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue." | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 3980 | "C:\Windows\System32\msiexec.exe" /i C:\Users\admin\Desktop\PDFTool-v4.2.1228.0.msi | C:\Windows\System32\msiexec.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
30 999
Read events
30 633
Write events
345
Delete events
21
Modification events
| (PID) Process: | (3980) msiexec.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1200) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore |
| Operation: | write | Name: | SrCreateRp (Enter) |
Value: 40000000000000000E6FB3FC6EBEDA01B004000084080000D5070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (1200) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP |
| Operation: | write | Name: | SppCreate (Enter) |
Value: 40000000000000000E6FB3FC6EBEDA01B004000084080000D0070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (1200) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
| Operation: | write | Name: | LastIndex |
Value: 75 | |||
| (PID) Process: | (1200) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGatherWriterMetadata (Enter) |
Value: 400000000000000086561CFD6EBEDA01B004000084080000D3070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (1200) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4000000000000000E0B81EFD6EBEDA01B004000024040000E80300000100000000000000000000008FB69F63EC443841A5E9611DFB3294260000000000000000 | |||
| (PID) Process: | (2204) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4000000000000000FC062DFD6EBEDA019C080000B4020000E8030000010000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2204) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4000000000000000FC062DFD6EBEDA019C0800000C090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2204) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4000000000000000FC062DFD6EBEDA019C08000008090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2204) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 400000000000000056692FFD6EBEDA019C08000068020000E8030000010000000100000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
26
Suspicious files
46
Text files
15
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1200 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
| 1200 | msiexec.exe | C:\Windows\Installer\1065b1.msi | — | |
MD5:— | SHA256:— | |||
| 2276 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\msi6880.txt | — | |
MD5:— | SHA256:— | |||
| 2276 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\scr6881.ps1 | — | |
MD5:— | SHA256:— | |||
| 2276 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\scr6891.txt | — | |
MD5:— | SHA256:— | |||
| 2276 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\pss6892.ps1 | — | |
MD5:— | SHA256:— | |||
| 3980 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\MSI3436.tmp | executable | |
MD5:D0C9613582605F3793FDAD7279DE428B | SHA256:8BD84F1156EBDFA44AFAAC8A4579BA56A8C7513E3D51E00822167EA144923726 | |||
| 3980 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560 | binary | |
MD5:E94FB54871208C00DF70F708AC47085B | SHA256:7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86 | |||
| 3980 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\MSI3397.tmp | executable | |
MD5:D0C9613582605F3793FDAD7279DE428B | SHA256:8BD84F1156EBDFA44AFAAC8A4579BA56A8C7513E3D51E00822167EA144923726 | |||
| 3980 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\Cab3105.tmp | compressed | |
MD5:49AEBF8CBD62D92AC215B2923FB1B9F5 | SHA256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
14
DNS requests
11
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3980 | msiexec.exe | GET | 200 | 95.101.54.128:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?440ced30b185b4f4 | unknown | — | — | unknown |
3980 | msiexec.exe | GET | 200 | 104.18.21.226:80 | http://secure.globalsign.com/cacert/codesigningrootr45.crt | unknown | — | — | unknown |
2276 | msiexec.exe | GET | 304 | 95.101.54.128:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f7b19f92030fa4e0 | unknown | — | — | unknown |
2264 | powershell.exe | POST | 200 | 18.239.82.118:80 | http://d25xn4y1w1xf3s.cloudfront.net/ | unknown | — | — | unknown |
2276 | msiexec.exe | GET | 200 | 18.239.15.174:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | unknown | — | — | unknown |
2276 | msiexec.exe | GET | 200 | 18.65.41.80:80 | http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D | unknown | — | — | unknown |
2612 | powershell.exe | POST | 200 | 18.239.82.118:80 | http://d25xn4y1w1xf3s.cloudfront.net/ | unknown | — | — | unknown |
1088 | svchost.exe | GET | 304 | 92.123.77.35:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9fb5557a30a98ae7 | unknown | — | — | unknown |
2276 | msiexec.exe | GET | 200 | 18.65.41.80:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3980 | msiexec.exe | 104.18.21.226:80 | secure.globalsign.com | CLOUDFLARENET | — | shared |
3980 | msiexec.exe | 95.101.54.128:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
2264 | powershell.exe | 18.239.82.118:80 | d25xn4y1w1xf3s.cloudfront.net | — | US | unknown |
2276 | msiexec.exe | 18.66.92.74:443 | dn0diw4x4ljz4.cloudfront.net | — | US | unknown |
2276 | msiexec.exe | 95.101.54.128:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
2276 | msiexec.exe | 18.239.15.174:80 | o.ss2.us | — | US | unknown |
2276 | msiexec.exe | 18.65.41.80:80 | ocsp.rootg2.amazontrust.com | AMAZON-02 | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
secure.globalsign.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
d25xn4y1w1xf3s.cloudfront.net |
| unknown |
dn0diw4x4ljz4.cloudfront.net |
| unknown |
o.ss2.us |
| whitelisted |
ocsp.rootg2.amazontrust.com |
| whitelisted |
ocsp.rootca1.amazontrust.com |
| shared |
Threats
Process | Message |
|---|---|
PDFTool.exe | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|
PDFTool.exe | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|