| File name: | Acrobat_DC_Set-Up.exe |
| Full analysis: | https://app.any.run/tasks/3e4e4c4a-515f-4ab6-8ef6-25951fb1c8e7 |
| Verdict: | Suspicious activity |
| Analysis date: | November 13, 2018, 19:01:17 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5: | C781501151F6EE588A51CD216A61EE2A |
| SHA1: | 2153DFDB4B33810DD0D053765C0212ECEB5FC6FE |
| SHA256: | 87C715612D205C312802758FFB64D56C104794CD291C17B0E5C8E61079201207 |
| SSDEEP: | 49152:V6lcJlgIp7A+1d1cIieE+RY1ZEwCE+WF12SL4s+c:GcgIlX1cDcot128Gc |
MALICIOUS
No malicious indicators.SUSPICIOUS
Application launched itself
- Acrobat_DC_Set-Up.exe (PID: 2456)
Reads internet explorer settings
- Acrobat_DC_Set-Up.exe (PID: 2456)
Changes IE settings (feature browser emulation)
- Acrobat_DC_Set-Up.exe (PID: 2456)
Reads Internet Cache Settings
- Acrobat_DC_Set-Up.exe (PID: 2456)
Reads Environment values
- Acrobat_DC_Set-Up.exe (PID: 2456)
INFO
Reads settings of System Certificates
- Acrobat_DC_Set-Up.exe (PID: 2456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | UPX compressed Win32 Executable (43.5) |
|---|---|---|
| .exe | | | Win32 EXE Yoda's Crypter (42.7) |
| .exe | | | Win32 Executable (generic) (7.2) |
| .exe | | | Generic Win/DOS Executable (3.2) |
| .exe | | | DOS Executable Generic (3.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2018:09:13 11:37:54+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 1974272 |
| InitializedDataSize: | 106496 |
| UninitializedDataSize: | 3072000 |
| EntryPoint: | 0x4d08e0 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 4.7.0.400 |
| ProductVersionNumber: | 4.7.0.400 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Dynamic link library |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Adobe Inc. |
| FileDescription: | Adobe Installer |
| FileVersion: | 4.7.0.400 |
| InternalName: | Adobe Installer |
| LegalCopyright: | © 2015-2018 Adobe. All rights reserved. |
| OriginalFileName: | Adobe Installer |
| ProductName: | Adobe Installer |
| ProductVersion: | 4.7.0.400 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 13-Sep-2018 09:37:54 |
| Detected languages: |
|
| CompanyName: | Adobe Inc. |
| FileDescription: | Adobe Installer |
| FileVersion: | 4.7.0.400 |
| InternalName: | Adobe Installer |
| LegalCopyright: | © 2015-2018 Adobe. All rights reserved. |
| OriginalFilename: | Adobe Installer |
| ProductName: | Adobe Installer |
| ProductVersion: | 4.7.0.400 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000150 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 13-Sep-2018 09:37:54 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x002EE000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x002EF000 | 0x001E2000 | 0x001E1C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.89528 |
.rsrc | 0x004D1000 | 0x0001A000 | 0x00019A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.68727 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.13585 | 1821 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 3.46426 | 67624 | UNKNOWN | English - United States | RT_ICON |
3 | 3.70519 | 9640 | UNKNOWN | English - United States | RT_ICON |
4 | 4.01029 | 4264 | UNKNOWN | English - United States | RT_ICON |
5 | 4.31128 | 1128 | UNKNOWN | English - United States | RT_ICON |
101 | 2.61881 | 76 | UNKNOWN | English - United States | RT_GROUP_ICON |
102 | 7.5908 | 1994 | UNKNOWN | English - United States | PNG |
103 | 7.72462 | 4446 | UNKNOWN | English - United States | PNG |
104 | 7.80193 | 9739 | UNKNOWN | English - United States | PNG |
105 | 6.89915 | 281 | UNKNOWN | English - United States | XML |
Imports
ADVAPI32.dll |
COMCTL32.dll |
CRYPT32.dll |
GDI32.dll |
KERNEL32.DLL |
OLEAUT32.dll |
PSAPI.DLL |
SETUPAPI.dll |
SHELL32.dll |
SHLWAPI.dll |
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 936 | "C:\Users\admin\AppData\Local\Temp\Acrobat_DC_Set-Up.exe" --pipename={205C9510-B045-4B77-9173-DE898482FBBD} --pid=2456 | C:\Users\admin\AppData\Local\Temp\Acrobat_DC_Set-Up.exe | Acrobat_DC_Set-Up.exe | ||||||||||||
User: admin Company: Adobe Inc. Integrity Level: HIGH Description: Adobe Installer Exit code: 0 Version: 4.7.0.400 Modules
| |||||||||||||||
| 2456 | "C:\Users\admin\AppData\Local\Temp\Acrobat_DC_Set-Up.exe" | C:\Users\admin\AppData\Local\Temp\Acrobat_DC_Set-Up.exe | explorer.exe | ||||||||||||
User: admin Company: Adobe Inc. Integrity Level: MEDIUM Description: Adobe Installer Exit code: 0 Version: 4.7.0.400 Modules
| |||||||||||||||
Total events
535
Read events
504
Write events
31
Delete events
0
Modification events
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION |
| Operation: | write | Name: | Acrobat_DC_Set-Up.exe |
Value: 8888 | |||
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: Acrobat_DC_Set-Up.exe | |||
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Acrobat_DC_Set-Up_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Acrobat_DC_Set-Up_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Acrobat_DC_Set-Up_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Acrobat_DC_Set-Up_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2456) Acrobat_DC_Set-Up.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Acrobat_DC_Set-Up_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
Executable files
0
Suspicious files
0
Text files
62
Unknown types
11
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Temp\CreativeCloud\ACC\WAM.log | text | |
MD5:— | SHA256:— | |||
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Temp\{72E80464-0E37-4976-8F90-CF5AEFB2F054}\js\mainController.js | text | |
MD5:— | SHA256:— | |||
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Adobe\OOBE\temp_lbs_wid | text | |
MD5:— | SHA256:— | |||
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Adobe\OOBE\temp_ins_lbs_wid | text | |
MD5:— | SHA256:— | |||
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Temp\{72E80464-0E37-4976-8F90-CF5AEFB2F054}\main.html | html | |
MD5:— | SHA256:— | |||
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Temp\{72E80464-0E37-4976-8F90-CF5AEFB2F054}\js\overlayController.js | text | |
MD5:— | SHA256:— | |||
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Temp\{72E80464-0E37-4976-8F90-CF5AEFB2F054}\js\utils.js | text | |
MD5:11671543588B007E7BE2AF6C784CB8AC | SHA256:BC354F2E25FE40AE21745C51B06D8F34643E238EE67FB94F5CD59C9B56AC17F5 | |||
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Temp\{72E80464-0E37-4976-8F90-CF5AEFB2F054}\lib\jquery.min.js | text | |
MD5:6407E5047D51C05AFF0294DBFA08070F | SHA256:C607FFD463124F60D8569DC49738DF743DC304FAC7FFA19477B4794CE0FD5486 | |||
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Temp\{72E80464-0E37-4976-8F90-CF5AEFB2F054}\js\main.js | text | |
MD5:0A164B7A1A48F5B514B0A2C737097D71 | SHA256:5BCE2B75737EDB79760DF7F29A2C8273196A5ED6231946A72B0E98F6E7C6D394 | |||
| 2456 | Acrobat_DC_Set-Up.exe | C:\Users\admin\AppData\Local\Temp\{72E80464-0E37-4976-8F90-CF5AEFB2F054}\images\productIcon2x.png | image | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
21
DNS requests
10
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2456 | Acrobat_DC_Set-Up.exe | 52.0.109.47:443 | na1e-acc.services.adobe.com | Amazon.com, Inc. | US | unknown |
2456 | Acrobat_DC_Set-Up.exe | 34.232.227.192:443 | prod-rel-ffc-ccm.oobesaas.adobe.com | Amazon.com, Inc. | US | unknown |
2456 | Acrobat_DC_Set-Up.exe | 52.16.190.94:443 | ims-prod07.adobelogin.com | Amazon.com, Inc. | IE | unknown |
2456 | Acrobat_DC_Set-Up.exe | 104.108.162.156:443 | www.adobe.com | Akamai Technologies, Inc. | NL | whitelisted |
2456 | Acrobat_DC_Set-Up.exe | 34.250.12.167:443 | adobeid-na1.services.adobe.com | Amazon.com, Inc. | IE | unknown |
2456 | Acrobat_DC_Set-Up.exe | 104.111.237.111:443 | wwwimages2.adobe.com | Akamai International B.V. | NL | whitelisted |
2456 | Acrobat_DC_Set-Up.exe | 143.204.204.68:443 | static.adobelogin.com | — | US | unknown |
2456 | Acrobat_DC_Set-Up.exe | 104.90.187.53:443 | use.typekit.net | Akamai Technologies, Inc. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
na1e-acc.services.adobe.com |
| whitelisted |
prod-rel-ffc-ccm.oobesaas.adobe.com |
| whitelisted |
ims-prod07.adobelogin.com |
| whitelisted |
adobeid-na1.services.adobe.com |
| whitelisted |
www.adobe.com |
| whitelisted |
wwwimages2.adobe.com |
| whitelisted |
static.adobelogin.com |
| whitelisted |
use.typekit.net |
| whitelisted |