analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

2018_1.zip

Full analysis: https://app.any.run/tasks/a67d1223-1d7a-4167-b754-ed744ef568f3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: February 19, 2019, 11:07:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

184FB0CB920D18A311E3A6320C9E545C

SHA1:

0B11850776A83AA0B087D7B960B420B853C5BA0B

SHA256:

8496DECA49BD8F7915FF69F9A15A29A9971C4EDF35365D9A2D283D602CD1DFA7

SSDEEP:

1536:yTJJ2qvkAy4ezol2lUjFwCPpAE0FVlS2XYIuV2U+9:yT32p4ekNwwpYFQIe2Ue

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads the Task Scheduler COM API

      • MsiExec.exe (PID: 3804)
      • MsiExec.exe (PID: 3192)
    • Application was dropped or rewritten from another process

      • 194.exe (PID: 1712)
    • Downloads executable files from the Internet

      • powersheLl.exe (PID: 3784)
  • SUSPICIOUS

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2376)
    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2376)
      • powersheLl.exe (PID: 3784)
    • Starts Internet Explorer

      • AcroRd32.exe (PID: 3892)
    • Creates files in the program directory

      • AdobeARM.exe (PID: 2232)
    • Executable content was dropped or overwritten

      • AdobeARM.exe (PID: 2232)
      • msiexec.exe (PID: 3236)
      • powersheLl.exe (PID: 3784)
    • Starts Microsoft Office Application

      • WINWORD.EXE (PID: 3420)
    • Application launched itself

      • WINWORD.EXE (PID: 3420)
  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3504)
      • OUTLOOK.EXE (PID: 2376)
      • WINWORD.EXE (PID: 3420)
      • WINWORD.EXE (PID: 3756)
      • WINWORD.EXE (PID: 3408)
    • Application launched itself

      • AcroRd32.exe (PID: 3892)
      • RdrCEF.exe (PID: 3556)
      • iexplore.exe (PID: 3320)
      • iexplore.exe (PID: 3932)
      • iexplore.exe (PID: 3496)
      • msiexec.exe (PID: 3236)
      • chrome.exe (PID: 3480)
    • Creates files in the user directory

      • AcroRd32.exe (PID: 3892)
      • iexplore.exe (PID: 2316)
      • WINWORD.EXE (PID: 3420)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 1944)
      • iexplore.exe (PID: 3928)
      • iexplore.exe (PID: 3848)
      • chrome.exe (PID: 3480)
    • Changes internet zones settings

      • iexplore.exe (PID: 3320)
      • iexplore.exe (PID: 456)
      • iexplore.exe (PID: 3932)
      • iexplore.exe (PID: 3496)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 1944)
      • iexplore.exe (PID: 3848)
      • iexplore.exe (PID: 3928)
    • Creates a software uninstall entry

      • msiexec.exe (PID: 3236)
    • Creates files in the program directory

      • msiexec.exe (PID: 3236)
    • Reads settings of System Certificates

      • msiexec.exe (PID: 3236)
      • chrome.exe (PID: 3480)
    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3804)
      • MsiExec.exe (PID: 3192)
    • Application was crashed

      • 194.exe (PID: 1712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0001
ZipCompression: Unknown (99)
ZipModifyDate: 2019:02:19 12:10:17
ZipCRC: 0x00000000
ZipCompressedSize: 55247
ZipUncompressedSize: 55219
ZipFileName: envelopes.eml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
38
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs outlook.exe outlook.exe no specs acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs iexplore.exe iexplore.exe adobearm.exe reader_sl.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs winword.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winword.exe no specs winword.exe no specs powershell.exe 194.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2992"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\2018_1.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2376"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\envelopes.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
3504"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXEsvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
3892"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\Rechnung_2019_02_2742515778.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
3560"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Desktop\Rechnung_2019_02_2742515778.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
3556"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
3456"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3556.0.546826653\2139543597" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
3764"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3556.1.1302617857\1577249164" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
3320"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
AcroRd32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2316"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3320 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
6 979
Read events
5 372
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
66
Text files
129
Unknown types
23

Dropped files

PID
Process
Filename
Type
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2992.47133\envelopes.eml
MD5:
SHA256:
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2992.47752\»«ña«í¡«ßG¿.docx
MD5:
SHA256:
2376OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR3D05.tmp.cvr
MD5:
SHA256:
3504OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR9835.tmp.cvr
MD5:
SHA256:
3560AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
MD5:
SHA256:
3560AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rr1qcc4_y8p1m_2qw.tmp
MD5:
SHA256:
3560AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R5fu0g6_y8p1n_2qw.tmp
MD5:
SHA256:
3560AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rg526r4_y8p1p_2qw.tmp
MD5:
SHA256:
3560AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rrasny8_y8p1o_2qw.tmp
MD5:
SHA256:
3560AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rwxjen3_y8p1q_2qw.tmp
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
33
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3892
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip
unknown
whitelisted
2376
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
3892
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
whitelisted
3892
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
whitelisted
3892
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/278_15_23_20070.zip
unknown
whitelisted
3892
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
whitelisted
1944
iexplore.exe
GET
200
103.15.51.170:80
http://deverlop.familyhospital.vn/De/AAINDN6592125/Rechnungs-Details/DOC-Dokument/
VN
document
316 Kb
unknown
3928
iexplore.exe
GET
301
103.15.51.170:80
http://deverlop.familyhospital.vn/De/AAINDN6592125/Rechnungs-Details/DOC-Dokument
VN
html
366 b
unknown
3848
iexplore.exe
GET
200
103.15.51.170:80
http://deverlop.familyhospital.vn/De/AAINDN6592125/Rechnungs-Details/DOC-Dokument/
VN
document
316 Kb
unknown
2316
iexplore.exe
GET
301
103.15.51.170:80
http://deverlop.familyhospital.vn/De/AAINDN6592125/Rechnungs-Details/DOC-Dokument
VN
html
366 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3892
AcroRd32.exe
2.16.186.32:80
acroipm2.adobe.com
Akamai International B.V.
whitelisted
2376
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3320
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2316
iexplore.exe
103.15.51.170:80
deverlop.familyhospital.vn
Online data services
VN
unknown
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
whitelisted
3892
AcroRd32.exe
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
whitelisted
3932
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
456
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3848
iexplore.exe
103.15.51.170:80
deverlop.familyhospital.vn
Online data services
VN
unknown
1944
iexplore.exe
103.15.51.170:80
deverlop.familyhospital.vn
Online data services
VN
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
acroipm2.adobe.com
  • 2.16.186.32
  • 2.16.186.33
whitelisted
armmf.adobe.com
  • 2.18.233.74
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
deverlop.familyhospital.vn
  • 103.15.51.170
unknown
ardownload2.adobe.com
  • 23.38.53.244
whitelisted
www.gstatic.com
  • 172.217.22.35
whitelisted
clientservices.googleapis.com
  • 216.58.207.67
whitelisted
www.google.de
  • 172.217.16.131
whitelisted
safebrowsing.googleapis.com
  • 172.217.21.234
whitelisted

Threats

PID
Process
Class
Message
2316
iexplore.exe
Misc activity
SUSPICIOUS [PTsecurity] Download DOC file with VBAScript
1944
iexplore.exe
Misc activity
SUSPICIOUS [PTsecurity] Download DOC file with VBAScript
3848
iexplore.exe
Misc activity
SUSPICIOUS [PTsecurity] Download DOC file with VBAScript
3928
iexplore.exe
Misc activity
SUSPICIOUS [PTsecurity] Download DOC file with VBAScript
3480
chrome.exe
Misc activity
SUSPICIOUS [PTsecurity] Download DOC file with VBAScript
3784
powersheLl.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3784
powersheLl.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3784
powersheLl.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info