analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

WG nicht öffnen Fwd (VFL-157958) 2nd line -reverse text is missing on the invoice-1973067 ist das scam.msg

Full analysis: https://app.any.run/tasks/88923601-0ffc-4db2-bced-deff3052d55e
Verdict: Malicious activity
Analysis date: March 22, 2019, 08:08:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

99B7687B85E78CD08F80B06D4D6DC59A

SHA1:

7673ACB64F31C55B7CE819701FCC74967B3DA4DA

SHA256:

BA8523CDA414C6200FC4BDF1FB5D86D438F5263197680EE14B889DC0EF0658C1

SSDEEP:

768:Nr5u7oQj9iRt/o7UxUyeFNcgJyJ43cJEz:RSIR9bxOSO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • MsiExec.exe (PID: 1920)
      • MsiExec.exe (PID: 3652)

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2452)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • AdobeARM.exe (PID: 3060)
      • msiexec.exe (PID: 3764)

    • Uses RUNDLL32.EXE to load library

      • OUTLOOK.EXE (PID: 2452)

    • Creates files in the program directory

      • AdobeARM.exe (PID: 3060)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2452)

  • INFO

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1920)
      • MsiExec.exe (PID: 3652)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 3764)

    • Application launched itself

      • RdrCEF.exe (PID: 728)
      • msiexec.exe (PID: 3764)
      • RdrCEF.exe (PID: 3604)

    • Creates files in the program directory

      • msiexec.exe (PID: 3764)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3764)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
22
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs adobearm.exe reader_sl.exe no specs rundll32.exe no specs acrord32.exe no specs acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs adobearm.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2452"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\4f7f4d2e-3bb5-4378-b5c7-31be510e49cf.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
2148"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\IOMX93WZ\1973067.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
OUTLOOK.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
2880"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\IOMX93WZ\1973067.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
728"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
3221225547
Version:
15.23.20053.211670
4060"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="728.0.1809657040\1302595159" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
2380"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="728.1.547478210\268439427" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
3060"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:15.0 /MODE:3C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Reader and Acrobat Manager
Exit code:
1073807364
Version:
1.824.27.2646
2252"C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe" C:\Program Files\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe—AdobeARM.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat SpeedLauncher
Exit code:
0
Version:
15.23.20053.211670
2680"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\IOMX93WZ\Attached Message PartC:\Windows\system32\rundll32.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2448"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\IOMX93WZ\Attached Message Part"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—rundll32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
Total events
2 995
Read events
2 155
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
14
Text files
60
Unknown types
27

Dropped files

PID
Process
Filename
Type
2452OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR7C6A.tmp.cvr —
MD5:—
SHA256:—
2880AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
2880AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.2880 —
MD5:—
SHA256:—
2880AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.2880 —
MD5:—
SHA256:—
2452OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:90DF67632EAA24F963E5879D028B0775
SHA256:E6BC3EA249C1CDAE588C6C615F722B087AABF29FC2D5365152A942AEF743F163
2880AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagessqlite
MD5:0B8BDBB076B08E5036ED7E9D59564860
SHA256:60E1FE70C2C455F22D9BE3E19CAB4FF36C4D12D92B5058EE5CE71A8C8373E3EB
2880AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rhcm737_80iurk_280.tmp —
MD5:—
SHA256:—
2880AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R1jh0rfw_80iurj_280.tmp —
MD5:—
SHA256:—
2880AcroRd32.exeC:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R1an4yue_80iurm_280.tmp —
MD5:—
SHA256:—
2452OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\IOMX93WZ\1973067.pdfpdf
MD5:F501BA754F633408A3170ABBEACED37D
SHA256:499764BBD8BE6BFFD84EA80532529C0499DC0706E00E58646EC06BA98CE5C957
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
8
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2452
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
2148
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
—
—
whitelisted
2996
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
—
—
whitelisted
2148
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
—
—
whitelisted
2996
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
—
—
whitelisted
2148
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip
unknown
—
—
whitelisted
2148
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
—
—
whitelisted
2148
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/278_15_23_20070.zip
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2452
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2148
AcroRd32.exe
2.16.186.32:80
acroipm2.adobe.com
Akamai International B.V.
—
whitelisted
2148
AcroRd32.exe
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
—
whitelisted
2996
AcroRd32.exe
2.16.186.32:80
acroipm2.adobe.com
Akamai International B.V.
—
whitelisted
—
—
23.210.248.251:443
ardownload2.adobe.com
Akamai International B.V.
NL
whitelisted
—
—
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
acroipm2.adobe.com
  • 2.16.186.32
  • 2.16.186.33
whitelisted
armmf.adobe.com
  • 2.18.233.74
whitelisted
ardownload2.adobe.com
  • 23.210.248.251
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
WG nicht öffnen Fwd (VFL-157958) 2nd line -reverse text is missing on the invoice-1973067 ist das scam.msg