analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DHL-#547748384637GU_pdf.gz

Full analysis: https://app.any.run/tasks/e367e0de-7a62-4109-b2a6-3d967380a047
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: July 11, 2019, 22:44:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
agenttesla
trojan
evasion
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1FC3CD8BD4359205827668593AA66690

SHA1:

3EA397BAF9753F11CE120B504164A33074A8F4CB

SHA256:

A84820B869B8325FF6B874B66A5C6482CDFF88F1270C4363CEC9941ADF8DDC80

SSDEEP:

6144:AsQtbOpcEA0uyVI1KXGxLQcH22dYo6Axq/ewQZgB5jH+liS2WlosP/dk5ZUjFu40:ATOpIxtpp22d5xq/lQ2Bgx2W6sq7G0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DHL-#547748384637GU_pdf.exe (PID: 1332)
      • DHL-#547748384637GU_pdf.exe (PID: 1160)
    • AGENTTESLA was detected

      • DHL-#547748384637GU_pdf.exe (PID: 1332)
    • Actions looks like stealing of personal data

      • DHL-#547748384637GU_pdf.exe (PID: 1332)
  • SUSPICIOUS

    • Checks for external IP

      • DHL-#547748384637GU_pdf.exe (PID: 1332)
    • Application launched itself

      • DHL-#547748384637GU_pdf.exe (PID: 1160)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3416)
  • INFO

    • Manual execution by user

      • WINWORD.EXE (PID: 3536)
      • WINWORD.EXE (PID: 3760)
      • WINWORD.EXE (PID: 1764)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3760)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3536)
      • WINWORD.EXE (PID: 3760)
      • WINWORD.EXE (PID: 1764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: DHL-#547748384637GU_pdf.exe
ZipUncompressedSize: 868352
ZipCompressedSize: 450397
ZipCRC: 0x3991ae73
ZipModifyDate: 2016:04:13 05:15:03
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe dhl-#547748384637gu_pdf.exe no specs #AGENTTESLA dhl-#547748384637gu_pdf.exe winword.exe no specs winword.exe no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\DHL-#547748384637GU_pdf.gz.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1160"C:\Users\admin\AppData\Local\Temp\Rar$EXa3416.8091\DHL-#547748384637GU_pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3416.8091\DHL-#547748384637GU_pdf.exeWinRAR.exe
User:
admin
Company:
REPRIME6
Integrity Level:
MEDIUM
Description:
POLYAMYLOSE3
Exit code:
0
Version:
1.07.0007
1332C:\Users\admin\AppData\Local\Temp\Rar$EXa3416.8091\DHL-#547748384637GU_pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3416.8091\DHL-#547748384637GU_pdf.exe
DHL-#547748384637GU_pdf.exe
User:
admin
Company:
REPRIME6
Integrity Level:
MEDIUM
Description:
POLYAMYLOSE3
Version:
1.07.0007
3760"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\muchtickets.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1764"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\serverpark.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
3536"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\novpanel.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Total events
1 691
Read events
1 266
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
6
Unknown types
11

Dropped files

PID
Process
Filename
Type
3760WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6245.tmp.cvr
MD5:
SHA256:
1764WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6448.tmp.cvr
MD5:
SHA256:
3536WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR67D2.tmp.cvr
MD5:
SHA256:
3760WINWORD.EXEC:\Users\admin\Desktop\~$chtickets.rtfpgc
MD5:9A569D2CF73CBED03DD04396739623E4
SHA256:205E29871E2ACE9C333DE500A82ED8DCAB3EAC385B805CA27BA9C4244ADB4E42
3760WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\novpanel.rtf.LNKlnk
MD5:F7A300514BD5AC43B0B295038F0C1538
SHA256:ED63DDC69309AAEE10272066C723471FA0A562EB5C4A5F4C0C87A1811F6CC7CF
3760WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\muchtickets.rtf.LNKlnk
MD5:944C7450D447A9794DBF7DD81869A476
SHA256:3B2DC19AAFA8B3FB748B2540C4433E4FB487762D1C4654893DAFF587E4433AAF
3760WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\serverpark.rtf.LNKlnk
MD5:8C7CC3EF98021A2B9C508B311C623E56
SHA256:817228BD388073F5CED079C7376A9F81ABF4FFC97BE0B161FA4DDE7A3D59B41E
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3416.8091\DHL-#547748384637GU_pdf.exeexecutable
MD5:238D0FD6A1C62BD98682A1D3E1A79358
SHA256:2FB7149AD75EE8C15A58744B7849CC9EC2878CB78F1A3FE55939B26B46DC7EC0
3760WINWORD.EXEC:\Users\admin\Desktop\~$vpanel.rtfpgc
MD5:9A569D2CF73CBED03DD04396739623E4
SHA256:205E29871E2ACE9C333DE500A82ED8DCAB3EAC385B805CA27BA9C4244ADB4E42
3760WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:51AE026F5DA44C1625E684680FF31985
SHA256:322F1B0EAB6EC99535262EC90F141180AD14015F2D7855CF113D092244FA3574
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1332
DHL-#547748384637GU_pdf.exe
GET
200
52.200.125.74:80
http://checkip.amazonaws.com/
US
text
15 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1332
DHL-#547748384637GU_pdf.exe
46.21.144.100:587
server1.monovm.com
Swiftway Sp. z o.o.
NL
malicious
1332
DHL-#547748384637GU_pdf.exe
52.200.125.74:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared

DNS requests

Domain
IP
Reputation
server1.monovm.com
  • 46.21.144.100
unknown
checkip.amazonaws.com
  • 52.200.125.74
  • 18.211.215.84
  • 52.202.139.131
  • 34.233.102.38
  • 52.206.161.133
  • 52.6.79.229
shared

Threats

PID
Process
Class
Message
1332
DHL-#547748384637GU_pdf.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
1332
DHL-#547748384637GU_pdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
2 ETPRO signatures available at the full report
No debug info