File name:

Citacion Personal Juzgado sexto.pdf

Full analysis: https://app.any.run/tasks/581d9838-9ab0-4424-9f6d-1e1ca842d314
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: December 06, 2019, 16:29:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
trojan
vjworm
Indicators:
MIME: application/pdf
File info: PDF document, version 1.7
MD5:

C220589DDEACB594EFF446FD94275D3B

SHA1:

165707BC50BB8576BC3C460D6CC6F7448E701E61

SHA256:

82B6D46E59C34C6E970C509ECEE2850246EA4771F30492B7341AC70B652531CA

SSDEEP:

768:yFSzSZfK5VEp0HlGLXcAGaiqDEsvfJ80CwE4hGOqqlmSTP7k5boi+DmkwHzuv0Sc:VACsHJiqEqz72MPmfQqVJNRNkIDnq945

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • WScript.exe (PID: 2248)

    • Application was dropped or rewritten from another process

      • Casuelas que dieron origen a la activacion del aparato fiscal en su contra agradecemos su pronta respuesta esta notificacion tendra efectoa al no ser atendia.exe (PID: 3808)

    • Connects to CnC server

      • WScript.exe (PID: 2248)

    • Writes to a start menu file

      • WScript.exe (PID: 2248)

    • VJWORM was detected

      • WScript.exe (PID: 2248)

  • SUSPICIOUS

    • Starts Internet Explorer

      • AcroRd32.exe (PID: 4060)

    • Executes scripts

      • Casuelas que dieron origen a la activacion del aparato fiscal en su contra agradecemos su pronta respuesta esta notificacion tendra efectoa al no ser atendia.exe (PID: 3808)

    • Creates files in the user directory

      • WScript.exe (PID: 2248)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3620)

    • Creates files in the program directory

      • AdobeARM.exe (PID: 2792)

  • INFO

    • Application launched itself

      • AcroRd32.exe (PID: 4060)
      • RdrCEF.exe (PID: 3576)
      • chrome.exe (PID: 3620)
      • AcroRd32.exe (PID: 3988)

    • Changes internet zones settings

      • iexplore.exe (PID: 2348)

    • Reads the hosts file

      • RdrCEF.exe (PID: 3576)
      • chrome.exe (PID: 3620)
      • chrome.exe (PID: 2632)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3472)

    • Creates files in the user directory

      • iexplore.exe (PID: 2348)
      • iexplore.exe (PID: 3472)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2348)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2348)
      • AdobeARM.exe (PID: 2792)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3472)
      • chrome.exe (PID: 3620)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2348)

    • Manual execution by user

      • chrome.exe (PID: 3620)
      • Casuelas que dieron origen a la activacion del aparato fiscal en su contra agradecemos su pronta respuesta esta notificacion tendra efectoa al no ser atendia.exe (PID: 3808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

PDFVersion: 1.7
Linearized: No
PageCount: 2
Language: es-CO
TaggedPDF: Yes
Author: orca-pc
Creator: Microsoft® Word 2019
CreateDate: 2019:12:06 09:51:25-05:00
ModifyDate: 2019:12:06 09:51:25-05:00
Producer: Microsoft® Word 2019

XMP

XMPToolkit: 3.1-701
Producer: Microsoft® Word 2019
Creator: orca-pc
CreatorTool: Microsoft® Word 2019
CreateDate: 2019:12:06 09:51:25-05:00
ModifyDate: 2019:12:06 09:51:25-05:00
DocumentID: uuid:2D80987C-700A-46F5-92BE-C92D0E474B9D
InstanceID: uuid:2D80987C-700A-46F5-92BE-C92D0E474B9D
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
46
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs iexplore.exe iexplore.exe adobearm.exe no specs reader_sl.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs casuelas que dieron origen a la activacion del aparato fiscal en su contra agradecemos su pronta respuesta esta notificacion tendra efectoa al no ser atendia.exe no specs #VJWORM wscript.exe acrord32.exe no specs acrord32.exe no specs rdrcef.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
388"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1004,9191464078310283097,16982333148205802728,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=8263993358814381090 --mojo-platform-channel-handle=1032 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
516"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6b54a9d0,0x6b54a9e0,0x6b54a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
600"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1004,9191464078310283097,16982333148205802728,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=2608924250767605194 --mojo-platform-channel-handle=3624 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
788"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1004,9191464078310283097,16982333148205802728,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=5671953463379085345 --mojo-platform-channel-handle=3268 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1296"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1004,9191464078310283097,16982333148205802728,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4997735601053561115 --mojo-platform-channel-handle=3732 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1428"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1004,9191464078310283097,16982333148205802728,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=777956691776230852 --mojo-platform-channel-handle=5092 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1952"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1004,9191464078310283097,16982333148205802728,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=13263292072766131942 --mojo-platform-channel-handle=3368 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2248"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\1.js" C:\Windows\System32\WScript.exe
Casuelas que dieron origen a la activacion del aparato fiscal en su contra agradecemos su pronta respuesta esta notificacion tendra efectoa al no ser atendia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2332"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Citacion Personal Juzgado sexto civil Control de garantias.Uue"C:\Program Files\WinRAR\WinRAR.exe—chrome.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2348"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
AcroRd32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 173
Read events
1 931
Write events
236
Delete events
6

Modification events

(PID) Process:(3480) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(3480) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral
Operation:writeName:bExpandRHPInViewer
Value:
1
(PID) Process:(3480) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\NoTimeOut
Operation:writeName:smailto
Value:
5900
(PID) Process:(2348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{A12D83FF-1845-11EA-AB41-5254004A04AF}
Value:
0
Executable files
0
Suspicious files
42
Text files
307
Unknown types
28

Dropped files

PID
Process
Filename
Type
3480AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
3480AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.3480 —
MD5:—
SHA256:—
3480AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.3480 —
MD5:—
SHA256:—
3480AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rkhm2lu_9jukjl_2oo.tmp —
MD5:—
SHA256:—
3480AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R1r4qk3m_9jukjk_2oo.tmp —
MD5:—
SHA256:—
3480AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rsxmyzg_9jukjj_2oo.tmp —
MD5:—
SHA256:—
3480AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R2uhnqf_9jukji_2oo.tmp —
MD5:—
SHA256:—
2348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2348iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3480AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rp125ti_9jukjm_2oo.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
49
DNS requests
32
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4060
AcroRd32.exe
GET
304
2.16.186.57:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
—
—
whitelisted
2248
WScript.exe
POST
200
181.141.15.28:2025
http://misenvios.duckdns.org:2025/Vre
CO
—
—
malicious
2248
WScript.exe
POST
—
181.141.15.28:2025
http://misenvios.duckdns.org:2025/Vre
CO
—
—
malicious
4060
AcroRd32.exe
GET
304
2.16.186.57:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip
unknown
—
—
whitelisted
4060
AcroRd32.exe
GET
304
2.16.186.57:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
—
—
whitelisted
4060
AcroRd32.exe
GET
304
2.16.186.57:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
—
—
whitelisted
2632
chrome.exe
GET
302
172.217.21.206:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
508 b
whitelisted
2632
chrome.exe
GET
302
172.217.21.206:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
513 b
whitelisted
2632
chrome.exe
GET
200
209.85.226.7:80
http://r2---sn-5hnekn76.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=85.203.44.11&mm=28&mn=sn-5hnekn76&ms=nvh&mt=1575649760&mv=m&mvi=1&pl=26&shardbypass=yes
US
crx
862 Kb
whitelisted
2632
chrome.exe
GET
200
209.85.226.10:80
http://r5---sn-5hnekn76.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mip=85.203.44.11&mm=28&mn=sn-5hnekn76&ms=nvh&mt=1575649760&mv=m&mvi=4&pl=26&shardbypass=yes
US
crx
293 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3472
iexplore.exe
13.107.42.13:443
onedrive.live.com
Microsoft Corporation
US
malicious
4060
AcroRd32.exe
23.210.248.251:443
armmf.adobe.com
Akamai International B.V.
NL
whitelisted
3472
iexplore.exe
2.16.186.25:443
spoprod-a.akamaihd.net
Akamai International B.V.
—
whitelisted
4060
AcroRd32.exe
2.16.186.57:80
acroipm2.adobe.com
Akamai International B.V.
—
whitelisted
2348
iexplore.exe
104.108.51.219:443
p.sfx.ms
Akamai Technologies, Inc.
NL
unknown
3472
iexplore.exe
20.36.253.92:443
c.live.com
—
US
whitelisted
3472
iexplore.exe
104.108.51.219:443
p.sfx.ms
Akamai Technologies, Inc.
NL
unknown
3472
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2348
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2632
chrome.exe
216.58.205.234:443
fonts.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
onedrive.live.com
  • 13.107.42.13
shared
acroipm2.adobe.com
  • 2.16.186.57
  • 2.16.186.97
whitelisted
armmf.adobe.com
  • 23.210.248.251
whitelisted
spoprod-a.akamaihd.net
  • 2.16.186.25
  • 2.16.186.40
whitelisted
p.sfx.ms
  • 104.108.51.219
whitelisted
c.live.com
  • 20.36.253.92
whitelisted
c.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
clientservices.googleapis.com
  • 172.217.18.163
whitelisted
accounts.google.com
  • 216.58.205.237
shared

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2248
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] VJworm activity
2248
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] vjw0rm
2248
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] VJworm activity
2248
WScript.exe
A Network Trojan was detected
MALWARE [PTsecurity] vjw0rm
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Citacion Personal Juzgado sexto.pdf