URL: | https://documentcloud.adobe.com/link/track?uri=urn%3Aaaid%3Ascds%3AUS%3A2c96174a-0a6e-460f-9864-5e6091c2f2a1 |
Full analysis: | https://app.any.run/tasks/4936432a-4c3d-4164-a839-1e9e83a29573 |
Verdict: | Malicious activity |
Analysis date: | February 21, 2020, 21:31:59 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 5316FF471547051918D0254896E967A6 |
SHA1: | 681081E3E3C1886C2488AA07579F1D6D1B171D76 |
SHA256: | 8E1A503C0C23E78D9003D18B334DF1B3579C2C531AF1AE27EF1C7031A8DD25CB |
SSDEEP: | 3:N8SJRqLX8JMHXEZXMnEMBSgJS3nIVEfTJTRtTXEU:2SJIlHiXMnEASg43nIufdTRtTN |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2564 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://documentcloud.adobe.com/link/track?uri=urn%3Aaaid%3Ascds%3AUS%3A2c96174a-0a6e-460f-9864-5e6091c2f2a1" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
3216 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2564 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3216 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab6E23.tmp | — | |
MD5:— | SHA256:— | |||
3216 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar6E24.tmp | — | |
MD5:— | SHA256:— | |||
2564 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3216 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\track[1].htm | html | |
MD5:2CBBF9728B754919C3F1888766497603 | SHA256:471EB77185328AA502D1824F149438B4777870AC1EA80B462EDE3399E62F4248 | |||
3216 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\dc-polyfill-old[1].js | text | |
MD5:3EF1C2EF590C8284563D1ABD2278D9A8 | SHA256:150EACD9E4992BE9D969B2FBE4EE69C4B9009E0E4AE024556CCD6DAB1A00FA61 | |||
3216 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 | der | |
MD5:0BF8CA519A1BB579E8672DCABC168EB6 | SHA256:A843073F747AF0B48EFC63531005E73D361EE3A5D7C156EC44E29CEF803BB6EF | |||
3216 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\dc-core[1].css | text | |
MD5:8F4A93990BC278D11B130980F3B8CE4A | SHA256:31BF403193DEECC27CC2A2CA944838C43C9807AAA69BA0C8BAB70B1B09974DBD | |||
3216 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 | binary | |
MD5:DA55E9FF0FD3DA001E8F6E79E43605C1 | SHA256:D1C45A80527257C884ACAC43273C95784D384F341080DF8AC088ACCAA6E7AC25 | |||
3216 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\privacy.min[1].css | text | |
MD5:A97B71E5F6498E69435F4BDFEF1B5DB1 | SHA256:0CF448A3B314F13B350913A040BC9286BED305FE866EA9FD2B51E4778D4E6AAB | |||
3216 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E11E75149C17A93653DA7DC0B8CF53F_488B9ED69293AD834070F2CA331DEBCD | binary | |
MD5:4B4C0D29E90FE9E2D9B42664F15C5FA0 | SHA256:9DC8261845820A553E2F6F83574CBAE620414C8CE1A59B8A56AC1EEEA7B30865 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3216 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAXrr5Qp565TRnKDIZg9oqE%3D | US | der | 471 b | whitelisted |
3216 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D | US | der | 471 b | whitelisted |
3216 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA8kLHIRmq7IIrty3ZKxWUw%3D | US | der | 471 b | whitelisted |
3216 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAFT5zSjKfJcBOJBfeXVZHY%3D | US | der | 471 b | whitelisted |
3216 | iexplore.exe | GET | 200 | 192.124.249.41:80 | http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D | US | der | 1.69 Kb | whitelisted |
3216 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEArLKLpGXuU5CHZ0cPPNxhI%3D | US | der | 471 b | whitelisted |
3216 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAza5nSVYZrPeIlAtSf0Rcs%3D | US | der | 471 b | whitelisted |
3216 | iexplore.exe | GET | 200 | 192.124.249.41:80 | http://ocsp.godaddy.com//MEgwRjBEMEIwQDAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CB206dZYDOTM%3D | US | der | 1.73 Kb | whitelisted |
3216 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAeZCid9YNsjZtldC0Jur4E%3D | US | der | 471 b | whitelisted |
3216 | iexplore.exe | GET | 200 | 192.124.249.41:80 | http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D | US | der | 1.66 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3216 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3216 | iexplore.exe | 2.18.232.153:443 | wwwimages2.adobe.com | Akamai International B.V. | — | unknown |
3216 | iexplore.exe | 13.224.91.69:443 | static.adobelogin.com | — | US | unknown |
3216 | iexplore.exe | 52.212.234.58:443 | adobeid-na1.services.adobe.com | Amazon.com, Inc. | IE | unknown |
3216 | iexplore.exe | 23.60.21.95:443 | documentcloud.adobe.com | Akamai Technologies, Inc. | NL | unknown |
2564 | iexplore.exe | 23.60.21.95:443 | documentcloud.adobe.com | Akamai Technologies, Inc. | NL | unknown |
3216 | iexplore.exe | 23.210.248.158:443 | www.adobe.com | Akamai International B.V. | NL | malicious |
2564 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3216 | iexplore.exe | 34.194.77.92:443 | p13n.adobe.io | Amazon.com, Inc. | US | unknown |
3216 | iexplore.exe | 34.252.123.130:443 | dpm.demdex.net | Amazon.com, Inc. | IE | unknown |
Domain | IP | Reputation |
---|---|---|
documentcloud.adobe.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
wwwimages2.adobe.com |
| whitelisted |
static.adobelogin.com |
| whitelisted |
adobeid-na1.services.adobe.com |
| whitelisted |
www.adobe.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
assets.adobedtm.com |
| whitelisted |
p13n.adobe.io |
| whitelisted |