File name:

Soda_PDF_11_Installer.exe.zip

Full analysis: https://app.any.run/tasks/d460e9ed-3302-4da6-bd59-3630ebc4aa1a
Verdict: Malicious activity
Analysis date: June 29, 2020, 14:11:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

46D3D204F4436047B098E2D5E13C053D

SHA1:

58519EDBB59BC7514E57B9CA289599F40394A3C2

SHA256:

B0F730E400AAF73BD023C2DA1640EFCD10F0D070210C4978D73E621EE1BFF6FB

SSDEEP:

196608:0QMjx1eQ3a1Fyp8lF73hnf8klIMq4dBkOWyUW0VR3Qv:2jxBaB7h0q/rD0c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 2724)
      • DllHost.exe (PID: 1844)
      • Soda_PDF_11_Installer.exe (PID: 2984)
      • svchost.exe (PID: 672)

    • Application was dropped or rewritten from another process

      • Soda_PDF_Desktop_11_Installer.exe (PID: 2288)
      • Soda_PDF_11_Installer.exe (PID: 2148)
      • Soda_PDF_11_Installer.exe (PID: 2984)

    • Registers / Runs the DLL via REGSVR32.EXE

      • Soda_PDF_11_Installer.exe (PID: 2984)

    • Changes settings of System certificates

      • Soda_PDF_11_Installer.exe (PID: 2984)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Soda_PDF_11_Installer.exe (PID: 2984)
      • WinRAR.exe (PID: 2344)

    • Executed via COM

      • DllHost.exe (PID: 1844)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2724)

    • Creates files in the program directory

      • Soda_PDF_11_Installer.exe (PID: 2984)

    • Starts itself from another location

      • Soda_PDF_11_Installer.exe (PID: 2984)

    • Reads Internet Cache Settings

      • Soda_PDF_11_Installer.exe (PID: 2984)

    • Adds / modifies Windows certificates

      • Soda_PDF_11_Installer.exe (PID: 2984)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • Soda_PDF_11_Installer.exe (PID: 2984)

    • Reads settings of System Certificates

      • Soda_PDF_11_Installer.exe (PID: 2984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x5479d950
ZipCompressedSize: 8185037
ZipUncompressedSize: 14076088
ZipFileName: Soda_PDF_11_Installer.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
8
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start winrar.exe soda_pdf_11_installer.exe no specs soda_pdf_11_installer.exe regsvr32.exe no specs soda_pdf_desktop_11_installer.exe no specs server no specs msiexec.exe no specs svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672C:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\rpcepmap.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\secur32.dll
1844C:\Windows\system32\DllHost.exe /Processid:{570EEAE9-654E-4392-9781-7FBB8B54C2FD}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2148"C:\Users\admin\AppData\Local\Temp\Rar$EXb2344.26927\Soda_PDF_11_Installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2344.26927\Soda_PDF_11_Installer.exe—WinRAR.exe
User:
admin
Company:
LULU Software
Integrity Level:
MEDIUM
Description:
Soda PDF Desktop 11 Installer
Exit code:
3221226540
Version:
11.2.45.1756
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2344.26927\soda_pdf_11_installer.exe
c:\systemroot\system32\ntdll.dll
2288"C:\ProgramData\Soda PDF Desktop 11\Installation\Soda_PDF_Desktop_11_Installer.exe" /RegServerC:\ProgramData\Soda PDF Desktop 11\Installation\Soda_PDF_Desktop_11_Installer.exe—Soda_PDF_11_Installer.exe
User:
admin
Company:
LULU Software
Integrity Level:
HIGH
Description:
Soda PDF Desktop 11 Installer
Exit code:
0
Version:
11.2.45.1756
Modules
Images
c:\programdata\soda pdf desktop 11\installation\soda_pdf_desktop_11_installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2344"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Soda_PDF_11_Installer.exe.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2724regsvr32.exe /s "C:\ProgramData\Soda PDF Desktop 11\Installation\Statistics.dll"C:\Windows\system32\regsvr32.exe—Soda_PDF_11_Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2984"C:\Users\admin\AppData\Local\Temp\Rar$EXb2344.26927\Soda_PDF_11_Installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2344.26927\Soda_PDF_11_Installer.exe
WinRAR.exe
User:
admin
Company:
LULU Software
Integrity Level:
HIGH
Description:
Soda PDF Desktop 11 Installer
Exit code:
0
Version:
11.2.45.1756
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2344.26927\soda_pdf_11_installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3852C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 187
Read events
561
Write events
1 586
Delete events
40

Modification events

(PID) Process:(2344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2344) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2344) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Soda_PDF_11_Installer.exe.zip
(PID) Process:(2344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
3
Suspicious files
10
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2984Soda_PDF_11_Installer.exeC:\Users\admin\AppData\Local\Temp\Cab2B79.tmp —
MD5:—
SHA256:—
2984Soda_PDF_11_Installer.exeC:\Users\admin\AppData\Local\Temp\Tar2B8A.tmp —
MD5:—
SHA256:—
2984Soda_PDF_11_Installer.exeC:\ProgramData\Soda PDF Desktop 11\Installation\common-data.dat.zip —
MD5:—
SHA256:—
2344WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2344.26927\Soda_PDF_11_Installer.exeexecutable
MD5:—
SHA256:—
2984Soda_PDF_11_Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dder
MD5:—
SHA256:—
2984Soda_PDF_11_Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:—
SHA256:—
2984Soda_PDF_11_Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771der
MD5:—
SHA256:—
2984Soda_PDF_11_Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\47191C5B0CC70DB61EF9BFC552DF7578_468DE29DAAA9BA12E3F9DA04C554DFFEder
MD5:—
SHA256:—
2984Soda_PDF_11_Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:—
SHA256:—
2984Soda_PDF_11_Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\47191C5B0CC70DB61EF9BFC552DF7578_468DE29DAAA9BA12E3F9DA04C554DFFEbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
12
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2984
Soda_PDF_11_Installer.exe
HEAD
301
64.15.159.202:80
http://download11.sodapdf.com/x86/module/main
CA
—
—
suspicious
2984
Soda_PDF_11_Installer.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
2984
Soda_PDF_11_Installer.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
2984
Soda_PDF_11_Installer.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDGDa3wvpTZTw%3D%3D
US
der
1.74 Kb
whitelisted
2984
Soda_PDF_11_Installer.exe
GET
301
64.15.159.202:80
http://download11.sodapdf.com/x86/module/main
CA
html
169 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2984
Soda_PDF_11_Installer.exe
64.15.159.202:80
download11.sodapdf.com
iWeb Technologies Inc.
CA
suspicious
2984
Soda_PDF_11_Installer.exe
64.15.159.202:443
download11.sodapdf.com
iWeb Technologies Inc.
CA
suspicious
2984
Soda_PDF_11_Installer.exe
64.15.159.203:443
cdn.lulusoft.com
iWeb Technologies Inc.
CA
suspicious
2984
Soda_PDF_11_Installer.exe
104.16.181.79:443
api-updateservice.sodapdf.com
Cloudflare Inc
US
shared
2984
Soda_PDF_11_Installer.exe
198.72.111.244:443
wsgeoip.lulusoft.com
iWeb Technologies Inc.
CA
suspicious
2984
Soda_PDF_11_Installer.exe
192.124.249.41:80
ocsp.godaddy.com
Sucuri
US
suspicious

DNS requests

Domain
IP
Reputation
api-updateservice.sodapdf.com
  • 104.16.181.79
  • 104.16.180.79
unknown
wsgeoip.lulusoft.com
  • 198.72.111.244
suspicious
ocsp.godaddy.com
  • 192.124.249.41
  • 192.124.249.23
  • 192.124.249.22
  • 192.124.249.24
  • 192.124.249.36
whitelisted
download11.sodapdf.com
  • 64.15.159.202
unknown
dns.msftncsi.com
  • 131.107.255.255
shared
cdn.lulusoft.com
  • 64.15.159.203
suspicious
redmtl.sodapdf.com
  • 104.16.181.79
  • 104.16.180.79
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Soda_PDF_11_Installer.exe.zip