File name:

pdnob-pdf-editor_8946.exe

Full analysis: https://app.any.run/tasks/33f1cd89-b4f2-4902-a146-7d0966995c52
Verdict: Malicious activity
Analysis date: January 02, 2025, 19:16:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

0717BB6347D511D9EFA74FAD1CF9097C

SHA1:

9B561A1ACAFF6E73CE676B19FB955D0338BAEA42

SHA256:

AABCA2B5CEB657E49FFDA7495805E1CE090634029739CEBECD2AD16D2FED0C4F

SSDEEP:

98304:tC7wWqznnKgE9L0PeP8MOEa2VoovjpxyCsyxcMYdzrOgAFwgC7zy2uHf0lGSWyqB:SHOs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Checks for external IP

      • pdnob-pdf-editor_8946.exe (PID: 6164)
      • svchost.exe (PID: 2192)

    • Potential Corporate Privacy Violation

      • pdnob-pdf-editor_8946.exe (PID: 6164)

    • Reads security settings of Internet Explorer

      • pdnob-pdf-editor_8946.exe (PID: 6164)
      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • Checks Windows Trust Settings

      • pdnob-pdf-editor_8946.exe (PID: 6164)

    • Executable content was dropped or overwritten

      • pdfeditor_ts_1.2.0.exe (PID: 624)
      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • Get information on the list of running processes

      • cmd.exe (PID: 5748)
      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • Drops 7-zip archiver for unpacking

      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • The process drops C-runtime libraries

      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • Process drops legitimate windows executable

      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • Starts CMD.EXE for commands execution

      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • Reads the Windows owner or organization settings

      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

  • INFO

    • Reads the computer name

      • pdnob-pdf-editor_8946.exe (PID: 6164)
      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • Checks supported languages

      • pdnob-pdf-editor_8946.exe (PID: 6164)
      • pdfeditor_ts_1.2.0.tmp (PID: 4672)
      • pdfeditor_ts_1.2.0.exe (PID: 624)

    • The sample compiled with english language support

      • pdnob-pdf-editor_8946.exe (PID: 6164)
      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • UPX packer has been detected

      • pdnob-pdf-editor_8946.exe (PID: 6164)

    • Checks proxy server information

      • pdnob-pdf-editor_8946.exe (PID: 6164)

    • Reads the machine GUID from the registry

      • pdnob-pdf-editor_8946.exe (PID: 6164)

    • Creates files in the program directory

      • pdnob-pdf-editor_8946.exe (PID: 6164)
      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • Create files in a temporary directory

      • pdfeditor_ts_1.2.0.exe (PID: 624)
      • pdnob-pdf-editor_8946.exe (PID: 6164)
      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • Creates files or folders in the user directory

      • pdnob-pdf-editor_8946.exe (PID: 6164)

    • Reads the software policy settings

      • pdnob-pdf-editor_8946.exe (PID: 6164)

    • Process checks computer location settings

      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • The process uses the downloaded file

      • pdfeditor_ts_1.2.0.tmp (PID: 4672)

    • The sample compiled with chinese language support

      • pdfeditor_ts_1.2.0.tmp (PID: 4672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:03 10:13:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 1961984
InitializedDataSize: 204800
UninitializedDataSize: 1867776
EntryPoint: 0x3a7990
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.8.5.3
ProductVersionNumber: 2.8.5.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: PDNob
FileDescription: PDNob Software
FileVersion: 2.8.5.3
LegalCopyright: Copyright © 2007-2024 TENORSHARE(HONGKONG)LIMITED All Rights Reserved.
ProductName: 20241203181317
ProductVersion: 2.8.5.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pdnob-pdf-editor_8946.exe svchost.exe pdfeditor_ts_1.2.0.exe pdfeditor_ts_1.2.0.tmp cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs pdnob-pdf-editor_8946.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
624 /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\PDNob\PDNob PDF Editor\" /LANG=en /LOG="C:\Users\admin\AppData\Local\Temp\PDNob PDF Editor_Setup_20250102191740.log" /sptrack "pdnob-pdf-editor_8946.exe"C:\Users\admin\AppData\Local\Temp\pdfeditor_ts\pdfeditor_ts_1.2.0.exe
pdnob-pdf-editor_8946.exe
User:
admin
Company:
PDNob
Integrity Level:
HIGH
Description:
PDNob PDF Editor Setup
Version:
1.2.0
Modules
Images
c:\users\admin\appdata\local\temp\pdfeditor_ts\pdfeditor_ts_1.2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3952"C:\Users\admin\AppData\Local\Temp\pdnob-pdf-editor_8946.exe" C:\Users\admin\AppData\Local\Temp\pdnob-pdf-editor_8946.exe—explorer.exe
User:
admin
Company:
PDNob
Integrity Level:
MEDIUM
Description:
PDNob Software
Exit code:
3221226540
Version:
2.8.5.3
Modules
Images
c:\users\admin\appdata\local\temp\pdnob-pdf-editor_8946.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4528find /c /i "PDNob PDF Editor.exe" C:\Windows\SysWOW64\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\find.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4672"C:\Users\admin\AppData\Local\Temp\is-9B1CB.tmp\pdfeditor_ts_1.2.0.tmp" /SL5="$50242,176990026,357376,C:\Users\admin\AppData\Local\Temp\pdfeditor_ts\pdfeditor_ts_1.2.0.exe" /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\PDNob\PDNob PDF Editor\" /LANG=en /LOG="C:\Users\admin\AppData\Local\Temp\PDNob PDF Editor_Setup_20250102191740.log" /sptrack "pdnob-pdf-editor_8946.exe"C:\Users\admin\AppData\Local\Temp\is-9B1CB.tmp\pdfeditor_ts_1.2.0.tmp
pdfeditor_ts_1.2.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-9b1cb.tmp\pdfeditor_ts_1.2.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5000tasklist /fo csv C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5748"C:\WINDOWS\system32\cmd.exe" /c tasklist /fo csv | find /c /i "PDNob PDF Editor.exe" > "C:\Users\admin\AppData\Local\Temp\findSoftRes.txt"C:\Windows\SysWOW64\cmd.exe—pdfeditor_ts_1.2.0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6164"C:\Users\admin\AppData\Local\Temp\pdnob-pdf-editor_8946.exe" C:\Users\admin\AppData\Local\Temp\pdnob-pdf-editor_8946.exe
explorer.exe
User:
admin
Company:
PDNob
Integrity Level:
HIGH
Description:
PDNob Software
Version:
2.8.5.3
Modules
Images
c:\users\admin\appdata\local\temp\pdnob-pdf-editor_8946.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
4 226
Read events
4 223
Write events
3
Delete events
0

Modification events

(PID) Process:(6164) pdnob-pdf-editor_8946.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Tenorshare\Downloader2.5.0
Operation:writeName:GA_PC
Value:
1
(PID) Process:(6164) pdnob-pdf-editor_8946.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GuidGuidold
Operation:writeName:guid
Value:
5F368DCB-2E97-4BDD-A771-756F17B0B430
(PID) Process:(6164) pdnob-pdf-editor_8946.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GuidGuidold
Operation:writeName:user_id
Value:
1001
Executable files
473
Suspicious files
61
Text files
3 114
Unknown types
0

Dropped files

PID
Process
Filename
Type
6164pdnob-pdf-editor_8946.exeC:\Users\admin\AppData\Local\Temp\pdfeditor_ts\pdfeditor_ts_1.2.0.exe —
MD5:—
SHA256:—
6164pdnob-pdf-editor_8946.exeC:\Users\admin\AppData\Local\Temp\pdfeditor_ts\pdfeditor_ts_1.2.0.exe.xmltext
MD5:7FDDB299ED4AB79021252DE00541D6E8
SHA256:2E43CD9DD102C7375EF425A064D16F1FD7ED0F7B355C9196EC58CAC43B764C25
4672pdfeditor_ts_1.2.0.tmpC:\Program Files (x86)\PDNob\PDNob PDF Editor\7z.exeexecutable
MD5:CFF15591D62661ADE13B58E362EA31D9
SHA256:C1ED4CC5FF426B59133E4AB6099B1CCF1708127DF448D2FB498C6CE7FF075F5C
4672pdfeditor_ts_1.2.0.tmpC:\Program Files (x86)\PDNob\PDNob PDF Editor\unins000.exeexecutable
MD5:C4B29582F3D11F692AA0945921DD9377
SHA256:57165C688A117FAFA17FFF5512F33F40FD7AD5B214BBD07CC4682AA2E4D7E9AE
6164pdnob-pdf-editor_8946.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_E93D4349D1D2AF4AE2F3CBFF382A5C9Dbinary
MD5:21B2166E2620A1FB1641C1E625FE9C7F
SHA256:17ABF8FA2438E097DA12DB3F61BF82DFF794B8B03AB62FF9AF96119725B30BB5
6164pdnob-pdf-editor_8946.exeC:\Users\admin\AppData\Local\Temp\pdfeditor_ts\galog.jsonbinary
MD5:F57C1884F1BCDF87A0870F05C0C9516F
SHA256:1CF5920A27AA0CCBED5963CA0B9F2BD62A69EA815633D12BD1B781DABF57D0D8
4528find.exeC:\Users\admin\AppData\Local\Temp\findSoftRes.txttext
MD5:21438EF4B9AD4FC266B6129A2F60DE29
SHA256:13BF7B3039C63BF5A50491FA3CFD8EB4E699D1BA1436315AEF9CBE5711530354
4672pdfeditor_ts_1.2.0.tmpC:\Program Files (x86)\PDNob\PDNob PDF Editor\PDNob PDF Editor.exeexecutable
MD5:102434248C51E5DFA7C2932AD8876BCE
SHA256:7301A475CE28E977AAFD1B3663A3CF068B7C761AFA128652B75BBDBAD15171D4
4672pdfeditor_ts_1.2.0.tmpC:\Program Files (x86)\PDNob\PDNob PDF Editor\7z.dllexecutable
MD5:5718C312C250DD8909029CCEA5081222
SHA256:11E5FCF30862C299D558D2CC33521E740C426DF8E0C93FCF8B9F98E337FACAC7
624pdfeditor_ts_1.2.0.exeC:\Users\admin\AppData\Local\Temp\is-9B1CB.tmp\pdfeditor_ts_1.2.0.tmpexecutable
MD5:C4B29582F3D11F692AA0945921DD9377
SHA256:57165C688A117FAFA17FFF5512F33F40FD7AD5B214BBD07CC4682AA2E4D7E9AE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
106
DNS requests
32
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5864
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6164
pdnob-pdf-editor_8946.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv
unknown
—
—
shared
6164
pdnob-pdf-editor_8946.exe
GET
301
104.17.192.141:80
http://www.tenorshare.com/downloads/service/softwarelog.txt
unknown
—
—
whitelisted
5864
svchost.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6164
pdnob-pdf-editor_8946.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
—
—
whitelisted
7160
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7160
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6252
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6164
pdnob-pdf-editor_8946.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTjzY2p9Pa8oibmj%2BNSMWsz63kmWgQUuhbZbU2FL3MpdpovdYxqII%2BeyG8CEAuuZrxaun%2BVh8b56QTjMwQ%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5864
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5864
svchost.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
5064
SearchApp.exe
2.23.209.140:443
www.bing.com
Akamai International B.V.
GB
whitelisted
6164
pdnob-pdf-editor_8946.exe
104.18.2.37:443
data-service.afirstsoft.cn
CLOUDFLARENET
—
unknown
6164
pdnob-pdf-editor_8946.exe
104.18.24.249:443
update.tenorshare.com
CLOUDFLARENET
—
suspicious
6164
pdnob-pdf-editor_8946.exe
104.17.192.141:80
www.tenorshare.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 23.37.237.227
whitelisted
google.com
  • 172.217.23.110
whitelisted
www.bing.com
  • 2.23.209.140
  • 2.23.209.130
  • 2.23.209.182
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.179
  • 2.23.209.187
whitelisted
data-service.afirstsoft.cn
  • 104.18.2.37
  • 104.18.3.37
unknown
update.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
unknown
www.tenorshare.com
  • 104.17.192.141
  • 104.17.207.155
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ip-api.com
  • 208.95.112.1
shared

Threats

PID
Process
Class
Message
6164
pdnob-pdf-editor_8946.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
6164
pdnob-pdf-editor_8946.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6164
pdnob-pdf-editor_8946.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pdnob-pdf-editor_8946.exe