Analysis date (UTC): 22 July 2021, 03:45Analysis environment: Windows 7 Pro, build 7601, x86

Payment-updateid.pdf

MD5:4A2775EAE2EBEF41901A3F08D3B857C8

SHA1:8B3439F5EA2F20C6BE329C4C6B8EAA9CC439233B

SHA256:CC6F1A04B10BCB168AEEC8D870B97BD7C20FC161E8310B5BCE1AF8ED420E2C24

Analysis result

Threat level:Suspicious activity

Tags:

generated-doc

Full analysis:Analysis Payment-updateid.pdf (MD5: 4A2775EAE2EBEF41901A3F08D3B857C8) Suspicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Starts Internet Explorer

AcroRd32.exe (PID: 2088)

Checks supported languages

AdobeARM.exe (PID: 3812)
Reader_sl.exe (PID: 1324)

Reads Microsoft Outlook installation path

iexplore.exe (PID: 3004)
iexplore.exe (PID: 980)
iexplore.exe (PID: 3228)

Reads the computer name

AdobeARM.exe (PID: 3812)

Creates files in the program directory

AdobeARM.exe (PID: 3812)

Executable content was dropped or overwritten

AdobeARM.exe (PID: 3812)

INFO

Checks supported languages

AcroRd32.exe (PID: 3368)
RdrCEF.exe (PID: 384)
RdrCEF.exe (PID: 700)
RdrCEF.exe (PID: 2940)
RdrCEF.exe (PID: 2304)
AcroRd32.exe (PID: 2088)
RdrCEF.exe (PID: 2836)
RdrCEF.exe (PID: 3752)
RdrCEF.exe (PID: 3176)
RdrCEF.exe (PID: 2716)
RdrCEF.exe (PID: 3600)
iexplore.exe (PID: 1840)
iexplore.exe (PID: 3004)
iexplore.exe (PID: 980)
iexplore.exe (PID: 3228)

Reads the computer name

AcroRd32.exe (PID: 3368)
AcroRd32.exe (PID: 2088)
RdrCEF.exe (PID: 384)
iexplore.exe (PID: 3004)
iexplore.exe (PID: 1840)
iexplore.exe (PID: 980)
iexplore.exe (PID: 3228)

Application launched itself

AcroRd32.exe (PID: 2088)
RdrCEF.exe (PID: 384)
iexplore.exe (PID: 1840)

Searches for installed software

AcroRd32.exe (PID: 2088)
AcroRd32.exe (PID: 3368)

Reads CPU info

AcroRd32.exe (PID: 3368)

Reads the hosts file

RdrCEF.exe (PID: 384)

Checks Windows Trust Settings

AcroRd32.exe (PID: 2088)
iexplore.exe (PID: 3004)
iexplore.exe (PID: 1840)
iexplore.exe (PID: 980)
iexplore.exe (PID: 3228)
AdobeARM.exe (PID: 3812)

Reads settings of System Certificates

AcroRd32.exe (PID: 2088)
RdrCEF.exe (PID: 384)
iexplore.exe (PID: 3004)
iexplore.exe (PID: 1840)
iexplore.exe (PID: 980)
iexplore.exe (PID: 3228)
AdobeARM.exe (PID: 3812)

Changes internet zones settings

iexplore.exe (PID: 1840)

Reads internet explorer settings

iexplore.exe (PID: 3004)
iexplore.exe (PID: 980)
iexplore.exe (PID: 3228)

Creates files in the user directory

iexplore.exe (PID: 3228)

Threats

PID	Process	Class	Message
1776	svchost.exe	Potentially Bad Traffic	ET INFO TLS Handshake Failure