URL:

http://clawpdf.findmysoft.com

Full analysis: https://app.any.run/tasks/b0eb4754-029e-4f45-b9c1-a2f637fd031e
Verdict: Malicious activity
Analysis date: August 04, 2023, 19:27:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

4556CE7136700CCDA038A13590D32F42

SHA1:

5701981EB36CC939FA492DA2FB29BB7D4D89D0A0

SHA256:

C0C269A6EA8AF1D8B808C7F218F387A5E4E64C70DE1F59A3682365D2D2BB5E8D

SSDEEP:

3:N1KdJEm+WKDR2:CzKo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 3512)
      • msiexec.exe (PID: 2372)
      • SetupHelper.exe (PID: 2488)
      • SetupHelper.exe (PID: 2204)
      • spoolsv.exe (PID: 1064)
      • clawPDF.exe (PID: 1796)

    • Application was dropped or rewritten from another process

      • SetupHelper.exe (PID: 2488)
      • SetupHelper.exe (PID: 2204)
      • clawPDF.exe (PID: 1796)

    • Starts NET.EXE for service management

      • SetupHelper.exe (PID: 2488)
      • net.exe (PID: 4040)
      • net.exe (PID: 1508)
      • SetupHelper.exe (PID: 2204)
      • net.exe (PID: 1992)
      • net.exe (PID: 2892)

    • Creates a writable file the system directory

      • SetupHelper.exe (PID: 2204)
      • spoolsv.exe (PID: 1064)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 3708)
      • spoolsv.exe (PID: 2412)
      • spoolsv.exe (PID: 1064)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 2372)

    • Executable content was dropped or overwritten

      • spoolsv.exe (PID: 1064)
      • SetupHelper.exe (PID: 2204)

    • Reads the Internet Settings

      • clawPDF.exe (PID: 1796)

  • INFO

    • The process uses the downloaded file

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2972)
      • iexplore.exe (PID: 3316)

    • Application launched itself

      • iexplore.exe (PID: 3316)
      • msiexec.exe (PID: 2372)

    • The process checks LSA protection

      • msiexec.exe (PID: 2372)
      • VSSVC.exe (PID: 3708)
      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 3280)
      • msiexec.exe (PID: 3512)
      • spoolsv.exe (PID: 2412)
      • spoolsv.exe (PID: 1064)
      • clawPDF.exe (PID: 1796)
      • wisptis.exe (PID: 1924)

    • Reads the computer name

      • msiexec.exe (PID: 2372)
      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 3512)
      • SetupHelper.exe (PID: 2488)
      • SetupHelper.exe (PID: 2204)
      • clawPDF.exe (PID: 1796)

    • Checks supported languages

      • msiexec.exe (PID: 2372)
      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 3512)
      • SetupHelper.exe (PID: 2488)
      • SetupHelper.exe (PID: 2204)
      • clawPDF.exe (PID: 1796)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 2372)
      • msiexec.exe (PID: 3512)
      • clawPDF.exe (PID: 1796)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3280)
      • msiexec.exe (PID: 2372)

    • Create files in a temporary directory

      • msiexec.exe (PID: 280)
      • msiexec.exe (PID: 3512)
      • msiexec.exe (PID: 2372)

    • Manual execution by a user

      • clawPDF.exe (PID: 1796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
25
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs setuphelper.exe no specs net.exe net1.exe no specs rundll32.exe no specs net.exe net1.exe no specs spoolsv.exe no specs setuphelper.exe net.exe net1.exe no specs net.exe net1.exe no specs spoolsv.exe clawpdf.exe no specs wisptis.exe no specs wisptis.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
280C:\Windows\system32\MsiExec.exe -Embedding 81C0A3C16353F4B2178E27DDCEAACF1C CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
328"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\System32\wisptis.exe—clawPDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
1056C:\Windows\system32\net1 start spoolerC:\Windows\System32\net1.exe—net.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\sechost.dll
c:\windows\system32\netutils.dll
1064C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Spooler SubSystem App
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1508"net.exe" start spoolerC:\Windows\System32\net.exe
SetupHelper.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
1700"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
1796"C:\Program Files\clawpdf\clawPDF.exe" C:\Program Files\clawpdf\clawPDF.exe—explorer.exe
User:
admin
Company:
Andrew Hess // clawSoft
Integrity Level:
MEDIUM
Description:
clawPDF
Exit code:
0
Version:
0.8.4.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\clawpdf\clawpdf.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1924"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\System32\wisptis.exe
clawPDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wisptis.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\oleaut32.dll
1992"net.exe" stop spoolerC:\Windows\System32\net.exe
SetupHelper.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
2204"C:\Program Files\clawpdf\SetupHelper.exe" /Driver=AddC:\Program Files\clawpdf\SetupHelper.exe
msiexec.exe
User:
admin
Company:
Andrew Hess // clawSoft
Integrity Level:
MEDIUM
Description:
clawPDF.SetupHelper
Exit code:
0
Version:
0.8.4.0
Modules
Images
c:\program files\clawpdf\setuphelper.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
Total events
29 315
Read events
28 835
Write events
467
Delete events
13

Modification events

(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3316) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
41
Suspicious files
98
Text files
139
Unknown types
0

Dropped files

PID
Process
Filename
Type
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\rating[1].jstext
MD5:F21BD523822B9A9873F0F0F9D8885AE9
SHA256:B38AD8BC1E195C67915DE1D2305C631D17982B6066D6CD8EEB392EF9861C5EE3
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\YDX12G1L.htmhtml
MD5:667CA2E61B995C1E304B2B4D2E68E2A0
SHA256:1FC779832891B21061725887DF58B72A41872DC3455F2DACFB689BBF7199C62A
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\blank[1].gifimage
MD5:76084E29CB2CF72B320E888EDC583DFB
SHA256:02D2855C8A5417CD637DF1E81F781E42FF2B12AD6DFFB923A3822F16B5BFA82A
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\135386[1].pngimage
MD5:1856CE30414615297D780B1BBFCC8E60
SHA256:7E9AFFBC86436CBC40BFB5079053425A39BDCCDDFE02BE9143D394668C98B3B8
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\Frederick-Barton_th[1].jpgimage
MD5:A87D037501139DE4BEB25B26ED82DD0B
SHA256:A24F2DBA227E606E5CCC25DE71CB47592CAA95E31CC12890949EC34CDD5A1F3F
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\135386[1].jpgimage
MD5:37A3E4FE5A556486F465D1F68DB27FD3
SHA256:DEFAF134DF203BE697BD7F0270CB339359D446F304D7E405E09DDD8F1135AC9D
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\ga_social_tracking[1].jstext
MD5:19DF44BAEDD49786DF8A49AAA35280D5
SHA256:ADB6DE4817A59A7447597D3431BFF2A7B48B0EAD564B9A863536D8C1DE2F7524
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\review2_5_clawPDF_award[1].pngimage
MD5:141E0726CEE752D635996540668F6AA7
SHA256:80786C81D76EFCF7B65FA434E5F25EBEA6E8491547BEA403DF3F3BA7BEFB06FF
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\tav_v1_300x250[1].pngimage
MD5:0004540C3AFB7E74C3CC42FA8EA8124B
SHA256:1C49C354C6E38714224C046944D887BF2A0BE88A6460588F10E9941FCEF7C821
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\js[1].jstext
MD5:700722778315D497388F357E2C432E25
SHA256:E8F1415F11AFA97BBAF1EA4FDDFAECA7FCF6B2184B839B0D56F564455BC3651A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
72
TCP/UDP connections
111
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2732
iexplore.exe
GET
—
52.73.84.74:80
http://www.findmysoft.com/i3/sprite.png
US
—
—
unknown
2732
iexplore.exe
GET
—
52.73.84.74:80
http://www.findmysoft.com/i3/dl.gif
US
—
—
unknown
2732
iexplore.exe
GET
—
52.73.84.74:80
http://www.findmysoft.com/i3/verticalbg.gif
US
—
—
unknown
2732
iexplore.exe
GET
—
52.73.84.74:80
http://www.findmysoft.com/i3/header.jpg
US
—
—
unknown
2732
iexplore.exe
GET
200
52.73.84.74:80
http://www.findmysoft.com/thumb/135386.jpg
US
image
6.60 Kb
unknown
2732
iexplore.exe
GET
200
52.73.84.74:80
http://www.findmysoft.com/s4.css
US
image
15.7 Kb
unknown
2732
iexplore.exe
GET
200
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?120f34a79f4bffbd
US
compressed
4.70 Kb
whitelisted
2732
iexplore.exe
GET
200
52.73.84.74:80
http://www.findmysoft.com/dl/blank.jpg?2289
US
image
695 b
unknown
2732
iexplore.exe
GET
200
108.138.17.3:80
http://img.findmysoft.com/js3/rating.js
US
text
3.49 Kb
shared
2732
iexplore.exe
GET
200
108.138.17.3:80
http://img.findmysoft.com/js3/js.js
US
text
19.3 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2732
iexplore.exe
3.161.127.55:80
d1xxdi1bvp4gvz.cloudfront.net
—
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2732
iexplore.exe
52.73.84.74:80
clawpdf.findmysoft.com
AMAZON-AES
US
unknown
2640
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2732
iexplore.exe
108.138.17.3:80
img.findmysoft.com
AMAZON-02
US
suspicious
2732
iexplore.exe
172.217.18.8:443
www.googletagmanager.com
GOOGLE
US
whitelisted
2732
iexplore.exe
35.186.251.103:80
static.totalav.com
GOOGLE
US
unknown
2732
iexplore.exe
67.27.159.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2732
iexplore.exe
157.240.252.13:443
connect.facebook.net
FACEBOOK
DE
whitelisted
2732
iexplore.exe
142.250.186.46:443
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
clawpdf.findmysoft.com
  • 52.73.84.74
unknown
www.findmysoft.com
  • 52.73.84.74
unknown
img.findmysoft.com
  • 108.138.17.3
  • 108.138.17.120
  • 108.138.17.26
  • 108.138.17.14
shared
static.totalav.com
  • 35.186.251.103
unknown
connect.facebook.net
  • 157.240.252.13
whitelisted
ctldl.windowsupdate.com
  • 67.27.159.126
  • 67.27.233.254
  • 8.248.145.254
  • 67.27.235.254
  • 67.27.158.254
whitelisted
www.google-analytics.com
  • 142.250.186.46
whitelisted
www.googletagmanager.com
  • 172.217.18.8
whitelisted
apis.google.com
  • 142.250.185.206
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://clawpdf.findmysoft.com