| download: | /downloads/PDFast.exe |
| Full analysis: | https://app.any.run/tasks/ea0fdce1-44d9-4f0c-91e1-3266a957e247 |
| Verdict: | Malicious activity |
| Analysis date: | April 20, 2025, 12:14:57 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 1E995EEF7DEBA589543F502C4B14DA47 |
| SHA1: | 8950965F40F30EB40D11DE71754A4FE93B098F3D |
| SHA256: | A7F0794872BC5D0FEDCF6161C7002E0D9FC7E23CD8D390E0327DB7C010DD7A1A |
| SSDEEP: | 98304:pL0druM/vIX0pafjCHE6B5fMxNRlOqAhcNAjcXILaN2nVmqZLDvHUVGT4aSx2J5l:G7a88G |
MALICIOUS
No malicious indicators.SUSPICIOUS
ADVANCEDINSTALLER mutex has been found
- PDFast.exe (PID: 7488)
Reads security settings of Internet Explorer
- PDFast.exe (PID: 7488)
Reads the Windows owner or organization settings
- PDFast.exe (PID: 7488)
- msiexec.exe (PID: 7600)
Executable content was dropped or overwritten
- PDFast.exe (PID: 7488)
- rundll32.exe (PID: 6476)
- rundll32.exe (PID: 8060)
- rundll32.exe (PID: 7480)
- rundll32.exe (PID: 5392)
Process drops legitimate windows executable
- PDFast.exe (PID: 7488)
INFO
Reads Environment values
- PDFast.exe (PID: 7488)
- msiexec.exe (PID: 8004)
- identity_helper.exe (PID: 6080)
The sample compiled with english language support
- PDFast.exe (PID: 7488)
- msiexec.exe (PID: 7600)
Creates files or folders in the user directory
- PDFast.exe (PID: 7488)
- msiexec.exe (PID: 7600)
Checks supported languages
- PDFast.exe (PID: 7488)
- msiexec.exe (PID: 7600)
- msiexec.exe (PID: 8004)
- identity_helper.exe (PID: 6080)
Reads the computer name
- PDFast.exe (PID: 7488)
- msiexec.exe (PID: 7600)
- msiexec.exe (PID: 8004)
- identity_helper.exe (PID: 6080)
Reads the machine GUID from the registry
- PDFast.exe (PID: 7488)
- msiexec.exe (PID: 7600)
Checks proxy server information
- PDFast.exe (PID: 7488)
- rundll32.exe (PID: 8060)
- rundll32.exe (PID: 5392)
Reads the software policy settings
- PDFast.exe (PID: 7488)
- msiexec.exe (PID: 7600)
- rundll32.exe (PID: 8060)
- rundll32.exe (PID: 5392)
Create files in a temporary directory
- PDFast.exe (PID: 7488)
- rundll32.exe (PID: 8060)
- rundll32.exe (PID: 6476)
- rundll32.exe (PID: 7480)
- rundll32.exe (PID: 5392)
Executable content was dropped or overwritten
- msiexec.exe (PID: 7600)
Disables trace logs
- rundll32.exe (PID: 8060)
- rundll32.exe (PID: 5392)
Creates a software uninstall entry
- msiexec.exe (PID: 7600)
Reads security settings of Internet Explorer
- rundll32.exe (PID: 7480)
Application launched itself
- msedge.exe (PID: 2152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 EXE PECompact compressed (generic) (49.3) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (32.7) |
| .dll | | | Win32 Dynamic Link Library (generic) (7.8) |
| .exe | | | Win32 Executable (generic) (5.3) |
| .exe | | | Generic Win/DOS Executable (2.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:08:08 12:49:22+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.36 |
| CodeSize: | 2534912 |
| InitializedDataSize: | 964608 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1e0862 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | Debug |
| FileOS: | Win32 |
| ObjectFileType: | Dynamic link library |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | PDFast |
| FileDescription: | PDFast Installer |
| FileVersion: | 1.0.0 |
| InternalName: | PDFast |
| LegalCopyright: | Copyright (C) 2025 PDFast |
| OriginalFileName: | PDFast.exe |
| ProductName: | PDFast |
| ProductVersion: | 1.0.0 |
Total processes
174
Monitored processes
42
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 720 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2352 --field-trial-handle=2136,i,14479532226982744754,10096633351296004992,262144 --variations-seed-version /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2152 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://pdf-fast.com/thankyou.html | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | rundll32.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2656 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2700 --field-trial-handle=2136,i,14479532226982744754,10096633351296004992,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 3008 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5808 --field-trial-handle=2136,i,14479532226982744754,10096633351296004992,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 3884 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5328 --field-trial-handle=2136,i,14479532226982744754,10096633351296004992,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 4008 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6716 --field-trial-handle=2136,i,14479532226982744754,10096633351296004992,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 4400 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6972 --field-trial-handle=2136,i,14479532226982744754,10096633351296004992,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 4988 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x300,0x304,0x308,0x2f8,0x310,0x7ffc87735fd8,0x7ffc87735fe4,0x7ffc87735ff0 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 5228 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5664 --field-trial-handle=2136,i,14479532226982744754,10096633351296004992,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
Total events
19 599
Read events
19 428
Write events
159
Delete events
12
Modification events
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: B01D0000C7EDBFD9EDB1DB01 | |||
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: DDA0747D2DE2F96BFE6A7F42AE0A3842C02F3E32DFFFF4D4AA351DC19B3B6175 | |||
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Users\admin\AppData\Roaming\Microsoft\Installer\ |
Value: | |||
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E6D75F3AEC5D60546A92D26B2626F334 |
| Operation: | write | Name: | 2869F0CE147ABAD43AAB440DC66A40AD |
Value: 01:\Software\PDFast\PDFast\DownloadFolder | |||
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\1A80A04C94B770E41878CED7E208CAF1 |
| Operation: | write | Name: | 2869F0CE147ABAD43AAB440DC66A40AD |
Value: 01:\Software\PDFast\PDFast\URL | |||
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\6C4D10F4C18EEB24E819C8E49BF583B1 |
| Operation: | write | Name: | 2869F0CE147ABAD43AAB440DC66A40AD |
Value: C:\Users\admin\AppData\Roaming\PDFast\Core.dll | |||
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\5DDD908ABF28E984EA3B61D7192D2EDE |
| Operation: | write | Name: | 2869F0CE147ABAD43AAB440DC66A40AD |
Value: C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe | |||
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\F8A9A5AE80612BF40B656CB177D82131 |
| Operation: | write | Name: | 2869F0CE147ABAD43AAB440DC66A40AD |
Value: C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe.config | |||
| (PID) Process: | (7600) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Users\admin\AppData\Roaming\Microsoft\Installer\{EC0F9682-A741-4DAB-A3BA-44D06CA604DA}\ |
Value: | |||
Executable files
54
Suspicious files
88
Text files
34
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7488 | PDFast.exe | C:\Users\admin\AppData\Roaming\PDFast\PDFast 1.0.0\install\CA604DA\PDFast.msi | executable | |
MD5:9193849BA75ECA3516FDA249D9149700 | SHA256:D625019951CFD3FEEABE95307FC5C1D7E89D0749A5D8BE5FF62701A44206BAF4 | |||
| 7600 | msiexec.exe | C:\Windows\Installer\MSICD26.tmp | executable | |
MD5:B7A6A99CBE6E762C0A61A8621AD41706 | SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D | |||
| 7600 | msiexec.exe | C:\Windows\Installer\MSICDA4.tmp | executable | |
MD5:B7A6A99CBE6E762C0A61A8621AD41706 | SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D | |||
| 8060 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\SFXCABA98B0442E4FFCCB38B19777004AFA23\WixToolset.Dtf.WindowsInstaller.dll | executable | |
MD5:EF8D5785AC8669F5FD54E22F52770E6B | SHA256:A614884EA627DA1925131EBF41E8AE202CAEAC0FE543B86384F5EB2BFAF1AA75 | |||
| 8060 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\SFXCABA98B0442E4FFCCB38B19777004AFA23\CustomAction.config | xml | |
MD5:EE9A8381338B060D86C58E2415F481F3 | SHA256:7E1096D6F39EBE04D6E38BC714983AF05ED92CC2BB4D3365ED4C85E733CB145C | |||
| 8060 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\SFXCABA98B0442E4FFCCB38B19777004AFA23\Microsoft.Win32.TaskScheduler.resources.dll | executable | |
MD5:C9B4EAED07EF72E5ED0F9ECB3E9FFB66 | SHA256:B2996E6B102FE829B5683936DD7197F26F375EA16499CC4E6AF88E78538B9FF1 | |||
| 7488 | PDFast.exe | C:\Users\admin\AppData\Local\Temp\MSIC21C.tmp | executable | |
MD5:B7A6A99CBE6E762C0A61A8621AD41706 | SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D | |||
| 7488 | PDFast.exe | C:\Users\admin\AppData\Local\Temp\shiC073.tmp | executable | |
MD5:84A34BF3486F7B9B7035DB78D78BDD1E | SHA256:F85911C910B660E528D2CF291BAA40A92D09961996D6D84E7A53A7095C7CD96E | |||
| 7488 | PDFast.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_17C8AB9779FC5F78079CADEDFCBF773B | binary | |
MD5:02D632979FB22A484455AB5C570DF485 | SHA256:35BF8B38F3BC7D06F281B9DC7FBE3B54270111CE88F9361D0FC68FD6A41434F4 | |||
| 7488 | PDFast.exe | C:\Users\admin\AppData\Local\Temp\MSIC0D2.tmp | executable | |
MD5:B7A6A99CBE6E762C0A61A8621AD41706 | SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
72
DNS requests
66
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.20:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7488 | PDFast.exe | GET | 200 | 104.18.21.226:80 | http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D | unknown | — | — | whitelisted |
7488 | PDFast.exe | GET | 200 | 104.18.21.226:80 | http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDH02JuY%2BNRarIhFtHg%3D%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7520 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7520 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.216.77.20:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7488 | PDFast.exe | 104.18.21.226:80 | ocsp.globalsign.com | CLOUDFLARENET | — | whitelisted |
6544 | svchost.exe | 20.190.159.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
8060 | rundll32.exe | 169.150.247.37:443 | b.pdf-fast.com | — | GB | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
ocsp.globalsign.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
b.pdf-fast.com |
| malicious |
config.edge.skype.com |
| whitelisted |