analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Invoice Copy 3223-443.pdf

Full analysis: https://app.any.run/tasks/23870e22-d9a5-45c4-bde2-6d3f80671c45
Verdict: Malicious activity
Analysis date: February 21, 2020, 23:30:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/pdf
File info: PDF document, version 1.3
MD5:

AB20C78380CE1B026B4D89F98CFDD4F3

SHA1:

A23E6AFF40147720FD69A9EA588A2991C56B0E09

SHA256:

800391B2E0B255B5B5BC8FB8A1C781D9CAF615DA7865EEC92423F4246A8E2459

SSDEEP:

768:gl/2/B3ALMfapTaErHq3xso/pqqqqqqRFRg8n1P2ZFrIl5dD:QeJ3eYapv+rpqqqqqqRFRg9ZF45dD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Changes IE settings (feature browser emulation)

      • AcroRd32.exe (PID: 2896)
    • Starts Internet Explorer

      • AcroRd32.exe (PID: 2896)
    • Creates files in the program directory

      • AdobeARM.exe (PID: 2000)
  • INFO

    • Reads Internet Cache Settings

      • AcroRd32.exe (PID: 2896)
      • iexplore.exe (PID: 2408)
      • AcroRd32.exe (PID: 1140)
      • iexplore.exe (PID: 2516)
    • Application launched itself

      • iexplore.exe (PID: 2516)
      • RdrCEF.exe (PID: 4008)
    • Changes internet zones settings

      • iexplore.exe (PID: 2516)
    • Reads the hosts file

      • RdrCEF.exe (PID: 4008)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2408)
    • Reads settings of System Certificates

      • AcroRd32.exe (PID: 2896)
      • iexplore.exe (PID: 2408)
      • iexplore.exe (PID: 2516)
    • Changes settings of System certificates

      • iexplore.exe (PID: 2516)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

Linearized: No
PageCount: 1
PDFVersion: 1.4
Title: Untitled
Producer: macOS Version 10.14.6 (Build 18G1012) Quartz PDFContext
Creator: TextEdit
CreateDate: 2020:02:20 14:42:10Z
ModifyDate: 2020:02:20 14:42:10Z
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
9
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs iexplore.exe rdrcef.exe no specs iexplore.exe adobearm.exe no specs reader_sl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2896"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Temp\Invoice Copy 3223-443.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
1140"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Temp\Invoice Copy 3223-443.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
4008"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2728"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4008.0.68462966\2135979357" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2516"C:\Program Files\Internet Explorer\iexplore.exe" https://storage.googleapis.com/fg3q857tp39qtgfp3fiuqt97.appspot.com/mf%20bv7tg%207wrf/gf8%207gft%20wf4fC:\Program Files\Internet Explorer\iexplore.exe
AcroRd32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3508"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4008.1.619837126\1132251628" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2408"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2516 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2000"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:15.0 /MODE:3C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Reader and Acrobat Manager
Version:
1.824.27.2646
2616"C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe" C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exeAdobeARM.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat SpeedLauncher
Exit code:
0
Version:
15.23.20053.211670
Total events
4 935
Read events
1 191
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
47
Text files
27
Unknown types
42

Dropped files

PID
Process
Filename
Type
1140AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
MD5:
SHA256:
1140AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.1140
MD5:
SHA256:
2408iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9A25.tmp
MD5:
SHA256:
2408iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9A26.tmp
MD5:
SHA256:
2896AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt15.lstps
MD5:0D5624ABBF1C79AEC38CBE52B56038B4
SHA256:AB5A46BA09F515E56892C0270D67EED215E56E43557B83A2CE295F2ED87D09D6
1140AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.1140ps
MD5:3A9453CC2C495F23ECDB3E5D39795FE8
SHA256:ECFDAA4E922FF49CAC2A8A970DBFEAFA59382297680ED167B436186810BFC82A
2408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bder
MD5:E550DA03AEE5B546B436CD553D3233B9
SHA256:9ABFD4E29B96CCA442502B1DE6071FE0293455DF22B4EFF19FA3E6DF060947E7
1140AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\UserCache.binbinary
MD5:75E30C67F3519849C33ECA7B212DAD54
SHA256:B5B32E4908AE196D277923729CEEC3AC736FB2075CE103C60E157CC541EA3274
2408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:DADDF27A757C20E599B8C322F2F8F49D
SHA256:952EFD476691EAEE6B6A8449F7053754FE2EC347FFB795FA5390D27E4076EF43
2896AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt15.lstps
MD5:76C993D6E29FBE12DA4525151364653B
SHA256:F1CBECC2D9952366CE231E4B651EC8354C17288AEB1908B4A01B6E5A29F6270E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
35
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2408
iexplore.exe
GET
200
216.58.207.67:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCSaJP2bCz9oAgAAAAALnFI
US
der
472 b
whitelisted
2408
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
2408
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D
US
der
471 b
whitelisted
2408
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D
US
der
471 b
whitelisted
2408
iexplore.exe
GET
200
172.217.16.163:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCSaJP2bCz9oAgAAAAALnFI
US
der
472 b
whitelisted
2408
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
2408
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEQCNmx6n%2FS%2FCc0UBRhCdwaxd
US
der
280 b
whitelisted
2408
iexplore.exe
GET
200
172.217.16.163:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2408
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2408
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2408
iexplore.exe
185.199.110.153:443
lipis.github.io
GitHub, Inc.
NL
shared
2408
iexplore.exe
172.217.16.176:443
storage.googleapis.com
Google Inc.
US
whitelisted
2408
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2408
iexplore.exe
209.197.3.24:443
code.jquery.com
Highwinds Network Group, Inc.
US
malicious
2408
iexplore.exe
172.217.16.163:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2408
iexplore.exe
216.58.207.67:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2896
AcroRd32.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2408
iexplore.exe
104.17.64.4:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
2896
AcroRd32.exe
2.16.186.57:80
acroipm2.adobe.com
Akamai International B.V.
whitelisted
2408
iexplore.exe
104.31.13.182:443
raw.githack.com
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
storage.googleapis.com
  • 172.217.16.176
whitelisted
ocsp.pki.goog
  • 172.217.16.163
  • 216.58.207.67
whitelisted
lipis.github.io
  • 185.199.110.153
  • 185.199.109.153
  • 185.199.111.153
  • 185.199.108.153
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
code.jquery.com
  • 209.197.3.24
whitelisted
cdnjs.cloudflare.com
  • 104.17.64.4
  • 104.17.65.4
whitelisted
raw.githack.com
  • 104.31.13.182
  • 104.31.12.182
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted

Threats

No threats detected
No debug info