URL:

http://clawpdf.findmysoft.com

Full analysis: https://app.any.run/tasks/b0eb4754-029e-4f45-b9c1-a2f637fd031e
Verdict: Malicious activity
Analysis date: August 04, 2023, 19:27:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

4556CE7136700CCDA038A13590D32F42

SHA1:

5701981EB36CC939FA492DA2FB29BB7D4D89D0A0

SHA256:

C0C269A6EA8AF1D8B808C7F218F387A5E4E64C70DE1F59A3682365D2D2BB5E8D

SSDEEP:

3:N1KdJEm+WKDR2:CzKo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 3512)
      • msiexec.exe (PID: 2372)
      • SetupHelper.exe (PID: 2488)
      • SetupHelper.exe (PID: 2204)
      • spoolsv.exe (PID: 1064)
      • clawPDF.exe (PID: 1796)

    • Application was dropped or rewritten from another process

      • SetupHelper.exe (PID: 2488)
      • SetupHelper.exe (PID: 2204)
      • clawPDF.exe (PID: 1796)

    • Starts NET.EXE for service management

      • SetupHelper.exe (PID: 2488)
      • net.exe (PID: 1508)
      • net.exe (PID: 4040)
      • SetupHelper.exe (PID: 2204)
      • net.exe (PID: 1992)
      • net.exe (PID: 2892)

    • Creates a writable file the system directory

      • SetupHelper.exe (PID: 2204)
      • spoolsv.exe (PID: 1064)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 3708)
      • spoolsv.exe (PID: 2412)
      • spoolsv.exe (PID: 1064)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 2372)

    • Executable content was dropped or overwritten

      • SetupHelper.exe (PID: 2204)
      • spoolsv.exe (PID: 1064)

    • Reads the Internet Settings

      • clawPDF.exe (PID: 1796)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3316)
      • msiexec.exe (PID: 2372)

    • Checks supported languages

      • msiexec.exe (PID: 2372)
      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 3512)
      • SetupHelper.exe (PID: 2488)
      • SetupHelper.exe (PID: 2204)
      • clawPDF.exe (PID: 1796)

    • The process checks LSA protection

      • msiexec.exe (PID: 3280)
      • msiexec.exe (PID: 2372)
      • msiexec.exe (PID: 280)
      • VSSVC.exe (PID: 3708)
      • msiexec.exe (PID: 3512)
      • spoolsv.exe (PID: 2412)
      • spoolsv.exe (PID: 1064)
      • wisptis.exe (PID: 1924)
      • clawPDF.exe (PID: 1796)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2372)
      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 3512)
      • clawPDF.exe (PID: 1796)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3316)
      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2972)

    • Reads the computer name

      • msiexec.exe (PID: 2372)
      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 3512)
      • SetupHelper.exe (PID: 2488)
      • SetupHelper.exe (PID: 2204)
      • clawPDF.exe (PID: 1796)

    • Create files in a temporary directory

      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 2372)
      • msiexec.exe (PID: 3512)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3280)
      • msiexec.exe (PID: 2372)

    • Manual execution by a user

      • clawPDF.exe (PID: 1796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
25
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs setuphelper.exe no specs net.exe net1.exe no specs rundll32.exe no specs net.exe net1.exe no specs spoolsv.exe no specs setuphelper.exe net.exe net1.exe no specs net.exe net1.exe no specs spoolsv.exe clawpdf.exe no specs wisptis.exe no specs wisptis.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
280C:\Windows\system32\MsiExec.exe -Embedding 81C0A3C16353F4B2178E27DDCEAACF1C CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
328"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\System32\wisptis.exe—clawPDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
1056C:\Windows\system32\net1 start spoolerC:\Windows\System32\net1.exe—net.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\sechost.dll
c:\windows\system32\netutils.dll
1064C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Spooler SubSystem App
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1508"net.exe" start spoolerC:\Windows\System32\net.exe
SetupHelper.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
1700"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
1796"C:\Program Files\clawpdf\clawPDF.exe" C:\Program Files\clawpdf\clawPDF.exe—explorer.exe
User:
admin
Company:
Andrew Hess // clawSoft
Integrity Level:
MEDIUM
Description:
clawPDF
Exit code:
0
Version:
0.8.4.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\clawpdf\clawpdf.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1924"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\System32\wisptis.exe
clawPDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wisptis.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\oleaut32.dll
1992"net.exe" stop spoolerC:\Windows\System32\net.exe
SetupHelper.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
2204"C:\Program Files\clawpdf\SetupHelper.exe" /Driver=AddC:\Program Files\clawpdf\SetupHelper.exe
msiexec.exe
User:
admin
Company:
Andrew Hess // clawSoft
Integrity Level:
MEDIUM
Description:
clawPDF.SetupHelper
Exit code:
0
Version:
0.8.4.0
Modules
Images
c:\program files\clawpdf\setuphelper.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
Total events
29 315
Read events
28 835
Write events
467
Delete events
13

Modification events

(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
41
Suspicious files
98
Text files
139
Unknown types
0

Dropped files

PID
Process
Filename
Type
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\YDX12G1L.htmhtml
MD5:667CA2E61B995C1E304B2B4D2E68E2A0
SHA256:1FC779832891B21061725887DF58B72A41872DC3455F2DACFB689BBF7199C62A
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\135386[1].jpgimage
MD5:37A3E4FE5A556486F465D1F68DB27FD3
SHA256:DEFAF134DF203BE697BD7F0270CB339359D446F304D7E405E09DDD8F1135AC9D
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\s4[1].csstext
MD5:86FB317C372F7FA581D5A0593A5FAA07
SHA256:3A8FF59A7DDD1BFF1862756337A59A3EF2660EEB346CE85F0A016CF4F0AE00DF
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\behavior[1].jstext
MD5:6287C9B096CF43BB5790893BCC78FC3B
SHA256:DC23BC46254C776C75D2CBAC30B1A97A1D37FC832EE2A98B269D6EA0EB07D800
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\review2_5_clawPDF_award[1].pngimage
MD5:141E0726CEE752D635996540668F6AA7
SHA256:80786C81D76EFCF7B65FA434E5F25EBEA6E8491547BEA403DF3F3BA7BEFB06FF
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\rating[1].jstext
MD5:F21BD523822B9A9873F0F0F9D8885AE9
SHA256:B38AD8BC1E195C67915DE1D2305C631D17982B6066D6CD8EEB392EF9861C5EE3
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\135386[1].pngimage
MD5:1856CE30414615297D780B1BBFCC8E60
SHA256:7E9AFFBC86436CBC40BFB5079053425A39BDCCDDFE02BE9143D394668C98B3B8
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\logo[1].pngimage
MD5:5359F397C2E27B8A60647288F4E37EE4
SHA256:EEE06E3F30375C3ED6A4B4F4056E5FCF2C048C6B089FB97018AD922BC668D125
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\Frederick-Barton_th[1].jpgimage
MD5:A87D037501139DE4BEB25B26ED82DD0B
SHA256:A24F2DBA227E606E5CCC25DE71CB47592CAA95E31CC12890949EC34CDD5A1F3F
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\ga_social_tracking[1].jstext
MD5:19DF44BAEDD49786DF8A49AAA35280D5
SHA256:ADB6DE4817A59A7447597D3431BFF2A7B48B0EAD564B9A863536D8C1DE2F7524
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
72
TCP/UDP connections
111
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2732
iexplore.exe
GET
—
52.73.84.74:80
http://www.findmysoft.com/i3/header.jpg
US
—
—
unknown
2732
iexplore.exe
GET
—
172.217.18.8:80
http://www.googletagmanager.com/gtm.js?id=GTM-MJ4SPG
US
—
—
whitelisted
2732
iexplore.exe
GET
200
52.73.84.74:80
http://www.findmysoft.com/s4.css
US
image
15.7 Kb
unknown
2732
iexplore.exe
GET
200
52.73.84.74:80
http://www.findmysoft.com/thumb/135386.jpg
US
image
6.60 Kb
unknown
2732
iexplore.exe
GET
200
108.138.17.3:80
http://img.findmysoft.com/js3/js.js
US
text
19.3 Kb
shared
2732
iexplore.exe
GET
200
52.73.84.74:80
http://www.findmysoft.com/img/users/Frederick-Barton_th.jpg
US
image
1.60 Kb
unknown
2732
iexplore.exe
GET
200
108.138.17.3:80
http://img.findmysoft.com/i3/blank.gif
US
image
49 b
shared
2732
iexplore.exe
GET
200
108.138.17.3:80
http://img.findmysoft.com/js3/ga_social_tracking.js
US
text
4.70 Kb
shared
2732
iexplore.exe
GET
200
52.73.84.74:80
http://clawpdf.findmysoft.com/
US
html
7.05 Kb
unknown
2732
iexplore.exe
GET
200
108.138.17.3:80
http://img.findmysoft.com/ico/135386.png
US
image
795 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2640
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2732
iexplore.exe
172.217.18.8:443
www.googletagmanager.com
GOOGLE
US
whitelisted
2732
iexplore.exe
108.138.17.3:80
img.findmysoft.com
AMAZON-02
US
suspicious
2732
iexplore.exe
35.186.251.103:80
static.totalav.com
GOOGLE
US
unknown
2732
iexplore.exe
67.27.159.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2732
iexplore.exe
157.240.252.13:443
connect.facebook.net
FACEBOOK
DE
whitelisted
2732
iexplore.exe
142.250.186.46:443
www.google-analytics.com
GOOGLE
US
whitelisted
2732
iexplore.exe
23.35.236.137:443
geo2.adobe.com
AKAMAI-AS
DE
suspicious
2732
iexplore.exe
142.250.185.206:443
apis.google.com
GOOGLE
US
whitelisted
3316
iexplore.exe
184.86.251.7:443
www.bing.com
Akamai International B.V.
DE
suspicious

DNS requests

Domain
IP
Reputation
clawpdf.findmysoft.com
  • 52.73.84.74
unknown
www.findmysoft.com
  • 52.73.84.74
unknown
img.findmysoft.com
  • 108.138.17.3
  • 108.138.17.120
  • 108.138.17.26
  • 108.138.17.14
shared
static.totalav.com
  • 35.186.251.103
unknown
connect.facebook.net
  • 157.240.252.13
whitelisted
ctldl.windowsupdate.com
  • 67.27.159.126
  • 67.27.233.254
  • 8.248.145.254
  • 67.27.235.254
  • 67.27.158.254
whitelisted
www.google-analytics.com
  • 142.250.186.46
whitelisted
www.googletagmanager.com
  • 172.217.18.8
whitelisted
apis.google.com
  • 142.250.185.206
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://clawpdf.findmysoft.com