File name: | FaturaEletronica-FT-G-45783265de2019-08_21.zip |
Full analysis: | https://app.any.run/tasks/7ab101d1-7cb6-487f-9691-f61408ef0775 |
Verdict: | Malicious activity |
Analysis date: | September 18, 2019, 15:26:12 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | B11B868982155A25414FADA4B2D31251 |
SHA1: | D0EBDA1FD606D9611B38FE4AF97D08BD91A7F790 |
SHA256: | C0D1802F3C9B26F6F9C211A854B782007FFE853FF0D6AEB0BAEF47DFAC10FF10 |
SSDEEP: | 1536:8ChIuVIy3qWSK9H6V7VqETgL43OrVNcJsdICmBx99bZGjp69xEqQRmL3o:8Sm3WT6V7VqETgaWVmaAk69xDQRmM |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | None |
ZipModifyDate: | 2019:09:16 17:01:11 |
ZipCRC: | 0x00000000 |
ZipCompressedSize: | - |
ZipUncompressedSize: | - |
ZipFileName: | FaturaEletronica-FT-G-45783265de2019-08_21/ |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2992 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FaturaEletronica-FT-G-45783265de2019-08_21.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3992 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\FaturaEletronica-FT-G-45783265de2019-08_21.vbs" | C:\Windows\System32\WScript.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
4052 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\FaturaEletronica-FT-G-45783265de2019-08_21.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | explorer.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 | ||||
3536 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Desktop\FaturaEletronica-FT-G-45783265de2019-08_21.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 | ||||
2820 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe RdrCEF Exit code: 3221225547 Version: 15.23.20053.211670 | ||||
2704 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2820.0.674514566\14471188" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 0 Version: 15.23.20053.211670 | ||||
2672 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2820.1.1179557288\257502380" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 0 Version: 15.23.20053.211670 | ||||
2880 | wscript.exe C:\Users\admin\AppData\Roaming\ntfnxkufvwa.vbs | C:\Windows\System32\wscript.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3536 | AcroRd32.exe | C:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal | — | |
MD5:— | SHA256:— | |||
3536 | AcroRd32.exe | C:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.3536 | — | |
MD5:— | SHA256:— | |||
3536 | AcroRd32.exe | C:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.3536 | — | |
MD5:— | SHA256:— | |||
3992 | WScript.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\P18[1].dll | — | |
MD5:— | SHA256:— | |||
3992 | WScript.exe | C:\Users\admin\AppData\Roaming\36054158151149\xbryinezyymoasnur81389974474906.exe | — | |
MD5:— | SHA256:— | |||
2992 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2992.40715\FaturaEletronica-FT-G-45783265de2019-08_21\Poltica de PROTECAO DE DADOS PESSOAIS - SGPS, S.A.-21 | text | |
MD5:102D5B31EFAD22F2C67F6E116C3D44D1 | SHA256:F6C213962C021358912F240CCF78D55069D1A6757436DD96BCDCF8B72493A620 | |||
2992 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2992.40715\FaturaEletronica-FT-G-45783265de2019-08_21\FaturaEletronica-FT-G-45783265de2019-08_21.pdf | ||
MD5:9716FDA7EE146E9C495D823A68E4AECC | SHA256:752A7593DC459BFAB82D267952B217A8C4655DD19462EFF3896739DCA6BA4BFB | |||
4052 | AcroRd32.exe | C:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt15.lst | ps | |
MD5:76C993D6E29FBE12DA4525151364653B | SHA256:F1CBECC2D9952366CE231E4B651EC8354C17288AEB1908B4A01B6E5A29F6270E | |||
4052 | AcroRd32.exe | C:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt15.lst | ps | |
MD5:25E48F152F9DB94DD9AAE6C296E3C98D | SHA256:A26C91DE905EBB8932CA931DBB68D589D058E7DEDFFAD02039FC8740E9E7BEB5 | |||
3536 | AcroRd32.exe | C:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages | sqlite | |
MD5:0B8BDBB076B08E5036ED7E9D59564860 | SHA256:60E1FE70C2C455F22D9BE3E19CAB4FF36C4D12D92B5058EE5CE71A8C8373E3EB |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3992 | WScript.exe | 52.216.18.16:443 | vaidapt.s3.amazonaws.com | Amazon.com, Inc. | US | shared |
3992 | WScript.exe | 52.216.112.35:443 | pt-hg8438fdg87-18.s3.amazonaws.com | Amazon.com, Inc. | US | shared |
Domain | IP | Reputation |
---|---|---|
vaidapt.s3.amazonaws.com |
| shared |
pt-hg8438fdg87-18.s3.amazonaws.com |
| shared |