analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BFG_CAPITAL.pdf

Full analysis: https://app.any.run/tasks/eace9759-0912-4e2e-917b-6dda4a025c50
Verdict: Malicious activity
Analysis date: October 14, 2019, 07:18:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/pdf
File info: PDF document, version 1.7
MD5:

605B72B46C0E6B0991FFABEC3616F1EE

SHA1:

D79949C9FAB19D468E88B2BCC3C79D40FB984B6B

SHA256:

963D093EF9BC774A5E2E51A96054A119B3549A7FDAFC91DAA257CF84276F66CF

SSDEEP:

6144:QU2i+F/z/goCUHfMMc2vq3XBDkszlWAAhzT8E0HwQHdzC13jR0:gZF/z/tHa2vq3XlJjAhzT8EQHdzCljW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2408)
    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2408)
    • Creates files in the program directory

      • AdobeARM.exe (PID: 3984)
    • Starts Internet Explorer

      • AcroRd32.exe (PID: 2172)
    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3424)
  • INFO

    • Application launched itself

      • RdrCEF.exe (PID: 1160)
      • AcroRd32.exe (PID: 2172)
      • iexplore.exe (PID: 1728)
    • Reads the hosts file

      • RdrCEF.exe (PID: 1160)
    • Creates files in the user directory

      • AcroRd32.exe (PID: 2172)
      • iexplore.exe (PID: 2848)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3424)
      • iexplore.exe (PID: 1728)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2848)
      • iexplore.exe (PID: 1728)
    • Changes internet zones settings

      • iexplore.exe (PID: 1728)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2848)
    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2408)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 1728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

PDFVersion: 1.7
Linearized: No
PageCount: 3
Language: de-DE
TaggedPDF: Yes
Title: Günes Öztürk
Author: KURS
Creator: Microsoft® Word 2016
CreateDate: 2019:10:12 23:33:09+02:00
ModifyDate: 2019:10:12 23:33:09+02:00
Producer: Microsoft® Word 2016

XMP

XMPToolkit: 3.1-701
Producer: Microsoft® Word 2016
Title: Günes Öztürk
Creator: KURS
CreatorTool: Microsoft® Word 2016
CreateDate: 2019:10:12 23:33:09+02:00
ModifyDate: 2019:10:12 23:33:09+02:00
DocumentID: uuid:F4CE856A-D697-47A0-A75A-F9C0DEE6A2A1
InstanceID: uuid:F4CE856A-D697-47A0-A75A-F9C0DEE6A2A1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
11
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs outlook.exe adobearm.exe no specs reader_sl.exe no specs iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2172"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Temp\BFG_CAPITAL.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
496"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Temp\BFG_CAPITAL.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
1160"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
1248"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="1160.0.2007039665\1807847542" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
964"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="1160.1.1858117442\367397871" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeRdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2408"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
AcroRd32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
3984"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:15.0 /MODE:3C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exeAcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Reader and Acrobat Manager
Version:
1.824.27.2646
3788"C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe" C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exeAdobeARM.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat SpeedLauncher
Exit code:
0
Version:
15.23.20053.211670
1728"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
AcroRd32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2848"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1728 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
2 161
Read events
1 507
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
117
Unknown types
21

Dropped files

PID
Process
Filename
Type
496AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
MD5:
SHA256:
2408OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRE0F4.tmp.cvr
MD5:
SHA256:
496AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R1d2ooyd_dnhrqx_ds.tmp
MD5:
SHA256:
496AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rjvc2xe_dnhrqw_ds.tmp
MD5:
SHA256:
496AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rypq9ni_dnhrqy_ds.tmp
MD5:
SHA256:
496AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rkvdm0f_dnhrqz_ds.tmp
MD5:
SHA256:
496AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R7jx0gv_dnhrr0_ds.tmp
MD5:
SHA256:
2408OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp
MD5:
SHA256:
2408OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{99E24499-81C7-48A4-84A9-D36CF9896FAC}.tmp
MD5:
SHA256:
496AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\UserCache.binbinary
MD5:B8C906128B999360A1AE54E411023DBA
SHA256:52B7C28136A1BAFA2FAEDE175EB6B901E02878E1C37DD152799EDF31482C5951
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
48
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2408
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
2172
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
whitelisted
2172
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
whitelisted
2172
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip
unknown
whitelisted
2172
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/278_15_23_20070.zip
unknown
whitelisted
2848
iexplore.exe
GET
301
162.13.248.112:80
http://www.indeed.fr/
GB
unknown
2172
AcroRd32.exe
GET
304
2.16.186.97:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
whitelisted
1728
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2172
AcroRd32.exe
2.16.186.97:80
acroipm2.adobe.com
Akamai International B.V.
whitelisted
1728
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2408
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
whitelisted
2848
iexplore.exe
162.13.248.112:80
www.indeed.fr
Rackspace Ltd.
GB
unknown
2172
AcroRd32.exe
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
whitelisted
1728
iexplore.exe
162.13.248.112:443
www.indeed.fr
Rackspace Ltd.
GB
unknown
2848
iexplore.exe
162.13.248.106:443
t.indeed.com
Rackspace Ltd.
GB
unknown
2848
iexplore.exe
13.225.84.10:443
d3hbwax96mbv6t.cloudfront.net
US
suspicious
2848
iexplore.exe
13.224.197.46:443
d3fw5vlhllyvee.cloudfront.net
US
suspicious

DNS requests

Domain
IP
Reputation
acroipm2.adobe.com
  • 2.16.186.97
  • 2.16.186.57
whitelisted
armmf.adobe.com
  • 2.18.233.74
whitelisted
config.messenger.msn.com
  • 64.4.26.155
whitelisted
ardownload2.adobe.com
  • 2.18.233.74
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.indeed.fr
  • 162.13.248.112
unknown
d3hbwax96mbv6t.cloudfront.net
  • 13.225.84.10
  • 13.225.84.152
  • 13.225.84.164
  • 13.225.84.99
whitelisted
d3fw5vlhllyvee.cloudfront.net
  • 13.224.197.46
  • 13.224.197.136
  • 13.224.197.99
  • 13.224.197.191
shared
my.indeed.com
  • 169.44.165.67
unknown
t.indeed.com
  • 162.13.248.106
suspicious

Threats

No threats detected
No debug info