analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DHL Consignment Details_pdf.gz

Full analysis: https://app.any.run/tasks/acb4c0fc-b035-4a21-87a5-37dc99725281
Verdict: Malicious activity
Analysis date: November 15, 2018, 08:52:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/gzip
File info: gzip compressed data, was "DHL Consignment Details_pdf.exe", last modified: Thu Oct 17 20:00:15 2013, max speed, from FAT filesystem (MS-DOS, OS/2, NT)
MD5:

FCD83D1788745B01C4AB0D1E27D9E5BD

SHA1:

4489064D426344C1FFB1C9349C2F0EF7509963BD

SHA256:

8FF00270CA7A4869399523771874EDE6C0B64CDF2B7A41938EE29FF9FA9E85D4

SSDEEP:

3072:vVQ22IPVjd8sIwc0ZAvPNZff0NAdMpjfaTC6/CLKWOTuKqg1OFDjJo4UGA:vVTNjNf5GNZR8jyTCwtQA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DHL Consignment Details_pdf.exe (PID: 3932)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3760)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

Compression: Deflated
Flags: FileName
ModifyDate: 2013:10:17 22:00:15+02:00
ExtraFlags: Fastest Algorithm
OperatingSystem: FAT filesystem (MS-DOS, OS/2, NT/Win32)
ArchivedFileName: DHL Consignment Details_pdf.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe dhl consignment details_pdf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3760"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DHL Consignment Details_pdf.gz"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3932"C:\Users\admin\Desktop\DHL Consignment Details_pdf.exe" C:\Users\admin\Desktop\DHL Consignment Details_pdf.exe—explorer.exe
User:
admin
Company:
ACEDIAMINE3
Integrity Level:
MEDIUM
Description:
plectognathic
Version:
4.09
Total events
429
Read events
419
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3760WinRAR.exeC:\Users\admin\Desktop\DHL Consignment Details_pdf.exeexecutable
MD5:B7A6F7DE5C28A9E053AAFA44D91950D5
SHA256:72BEE7CB2A83FD7D96E5A7A563CBAB75B966864F71899083184E6C1C7C91B855
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DHL Consignment Details_pdf.gz