File name:

AdobeCollabSync.exe

Full analysis: https://app.any.run/tasks/d937ca91-693a-4553-bffa-3ebcf6a414ea
Verdict: No threats detected
Analysis date: November 04, 2019, 22:19:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

169C293CE9460A05646D17DC6AA2FB2C

SHA1:

F0C018D61E844447DCC5A5734E1EDFF4997E59D5

SHA256:

A7ACECC562EE9C9FFBFBA51BB5963A2E0C1A8FA9A5B6A8309988A5BCD48E70E6

SSDEEP:

12288:s6QXqw9MgKnxYaGu5jji2YQ6MpzUK1bOnnCOazb4gR8wmq3/PFdTyVD:sDKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Creates files in the user directory

      • AdobeCollabSync.exe (PID: 2692)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2006:10:23 10:01:42+02:00
PEType: PE32
LinkerVersion: 8
CodeSize: 561152
InitializedDataSize: 163840
UninitializedDataSize: -
EntryPoint: 0x8033f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.0.0.0
ProductVersionNumber: 8.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Unknown (0x50004)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unknown (000B)
build: build
EnglishName: English
FileVersion: 8.0.0.0
LanguageId: 0409
ProductVersion: 8, 0, 0, 0
Signature: Read
Tag040904e4: -

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 23-Oct-2006 08:01:42
Detected languages:
  • English - United States
Debug artifacts:
  • g:\acro_root_at\acrobat\systemsynchronizer\synchronizerapp\build\win\release\AdobeCollabSync.pdb
build: build
EnglishName: English
FileVersion: 8.0.0.0
LanguageId: 0409
ProductVersion: 8, 0, 0, 0
Signature: Read

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 23-Oct-2006 08:01:42
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00088C0B
0x00089000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.59296
.rdata
0x0008A000
0x0001C21C
0x0001D000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.40398
.data
0x000A7000
0x000030E8
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.84899
.tls
0x000AB000
0x00000019
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x000AC000
0x000074F4
0x00008000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.69887

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.03863
752
Latin 1 / Western European
English - United States
RT_MANIFEST
2
2.77752
744
Latin 1 / Western European
English - United States
RT_ICON
3
3.06244
296
Latin 1 / Western European
English - United States
RT_ICON
4
3.57053
3752
Latin 1 / Western European
English - United States
RT_ICON
5
3.45305
2216
Latin 1 / Western European
English - United States
RT_ICON
6
5.69002
1384
Latin 1 / Western European
English - United States
RT_ICON
7
3.18591
468
Latin 1 / Western European
English - United States
RT_STRING
8
3.28374
956
Latin 1 / Western European
English - United States
RT_STRING
9
3.13301
190
Latin 1 / Western European
English - United States
RT_STRING
101
2.89097
132
Latin 1 / Western European
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
CRYPT32.dll
KERNEL32.dll
MPR.dll
MSVCP80.dll
MSVCR80.dll
MSWSOCK.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll

Exports

Title
Ordinal
Address
GetExecutionEnvironment
1
0x0001580E
LL_MaxInt
2
0x0002985A
LL_MaxUint
3
0x00029872
LL_MinInt
4
0x00029866
LL_Zero
5
0x0002984E
PL_Base64Decode
6
0x000399C0
PL_Base64Encode
7
0x000396D0
PL_strlen
8
0x00039A60
PL_strnlen
9
0x00039A80
PRP_DestroyNakedCondVar
10
0x00019EFF
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start adobecollabsync.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2692"C:\Users\admin\AppData\Local\Temp\AdobeCollabSync.exe" C:\Users\admin\AppData\Local\Temp\AdobeCollabSync.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
8.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\adobecollabsync.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
33
Read events
33
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
2692AdobeCollabSync.exeC:\Users\admin\AppData\Local\Temp\sqlite_OKJMU0CADP2xUvb —
MD5:—
SHA256:—
2692AdobeCollabSync.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\8.0\Synchronizer\metadata\Synchronizer80-journal —
MD5:—
SHA256:—
2692AdobeCollabSync.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\8.0\Synchronizer\adobesynchronizersu80-journal —
MD5:—
SHA256:—
2692AdobeCollabSync.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\8.0\Synchronizer\adobesynchronizersu80 —
MD5:—
SHA256:—
2692AdobeCollabSync.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\8.0\Synchronizer\metadata\Synchronizer80sqlite
MD5:20A51CEBB59C490F2CD762B2D226441A
SHA256:F0DF46C88FB99F2D6F0A4EAFF116E7CF00E137820996C0D4628A62B81F475B38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AdobeCollabSync.exe