| File name: | pdfelement-pro_setup_full5239.exe |
| Full analysis: | https://app.any.run/tasks/8d497227-7eaa-429e-a26b-b3711651f115 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | September 17, 2019, 06:56:30 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 523CB29000A6FFEFAB4E63270DE4FC99 |
| SHA1: | A31BD571075EFD90605E6D463E408194F090958E |
| SHA256: | DA261218CCBEC8B9E8C2AFC17A83FA04BF929A1788B89CBD9F9C21D493D70046 |
| SSDEEP: | 24576:lZo4MrcCejopIss0915fPHG04BgCz96ZzlwwcQ4sYw0WDmFUFvv+72ST:lZo4MrcCekpIwY0GUNmKk |
MALICIOUS
Application was dropped or rewritten from another process
- pdfelement-pro_full5239.exe (PID: 2080)
Downloads executable files from the Internet
- pdfelement-pro_setup_full5239.exe (PID: 2452)
SUSPICIOUS
Reads Windows owner or organization settings
- pdfelement-pro_full5239.tmp (PID: 2480)
Executable content was dropped or overwritten
- pdfelement-pro_full5239.exe (PID: 2080)
- pdfelement-pro_full5239.tmp (PID: 2480)
Reads Internet Cache Settings
- pdfelement-pro_setup_full5239.exe (PID: 2452)
Reads internet explorer settings
- pdfelement-pro_setup_full5239.exe (PID: 2452)
Low-level read access rights to disk partition
- pdfelement-pro_setup_full5239.exe (PID: 2452)
Uses TASKKILL.EXE to kill process
- pdfelement-pro_full5239.tmp (PID: 2480)
Reads the Windows organization settings
- pdfelement-pro_full5239.tmp (PID: 2480)
Creates files in the Windows directory
- pdfelement-pro_full5239.tmp (PID: 2480)
INFO
Application was dropped or rewritten from another process
- pdfelement-pro_full5239.tmp (PID: 2480)
Loads dropped or rewritten executable
- pdfelement-pro_full5239.tmp (PID: 2480)
Creates files in the program directory
- pdfelement-pro_full5239.tmp (PID: 2480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (16.3) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (14.5) |
| .dll | | | Win32 Dynamic Link Library (generic) (3.4) |
| .exe | | | Win32 Executable (generic) (2.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:06:20 09:19:57+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 432640 |
| InitializedDataSize: | 525312 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x4ea68 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.0.17.2 |
| ProductVersionNumber: | 2.0.17.2 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| FileDescription: | pdfelement-pro_setup_full5239.exe |
| FileVersion: | 2.0.17.2 |
| LegalCopyright: | Copyright©2017 Wondershare. All rights reserved. |
| ProductName: | PDFelement Pro |
| ProductVersion: | 7.0.2 |
Total processes
41
Monitored processes
5
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2080 | "C:\Users\Public\Documents\Wondershare\pdfelement-pro_full5239.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-PDFelement Pro.log" /installpath: "C:\Program Files\Wondershare\PDFelement Pro\" /DIR="C:\Program Files\Wondershare\PDFelement Pro\" | C:\Users\Public\Documents\Wondershare\pdfelement-pro_full5239.exe | pdfelement-pro_setup_full5239.exe | ||||||||||||
User: admin Company: Wondershare Software Co.,Ltd. Integrity Level: HIGH Description: Wondershare PDFelement 7 Pro Setup Exit code: 0 Version: 7.0.4.4383 Modules
| |||||||||||||||
| 2452 | "C:\Users\admin\AppData\Local\Temp\pdfelement-pro_setup_full5239.exe" | C:\Users\admin\AppData\Local\Temp\pdfelement-pro_setup_full5239.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: pdfelement-pro_setup_full5239.exe Exit code: 0 Version: 2.0.17.2 Modules
| |||||||||||||||
| 2480 | "C:\Users\admin\AppData\Local\Temp\is-3LJPU.tmp\pdfelement-pro_full5239.tmp" /SL5="$40128,55033356,548864,C:\Users\Public\Documents\Wondershare\pdfelement-pro_full5239.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-PDFelement Pro.log" /installpath: "C:\Program Files\Wondershare\PDFelement Pro\" /DIR="C:\Program Files\Wondershare\PDFelement Pro\" | C:\Users\admin\AppData\Local\Temp\is-3LJPU.tmp\pdfelement-pro_full5239.tmp | pdfelement-pro_full5239.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 3036 | "C:\Users\admin\AppData\Local\Temp\pdfelement-pro_setup_full5239.exe" | C:\Users\admin\AppData\Local\Temp\pdfelement-pro_setup_full5239.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: pdfelement-pro_setup_full5239.exe Exit code: 3221226540 Version: 2.0.17.2 Modules
| |||||||||||||||
| 4020 | "C:\Windows\System32\taskkill.exe" /F /T /IM BsSndRpt.exe /IM PDFSaveAsPrinter.exe | C:\Windows\System32\taskkill.exe | — | pdfelement-pro_full5239.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
323
Read events
284
Write events
38
Delete events
1
Modification events
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WafCX |
| Operation: | write | Name: | |
Value: sku-ween | |||
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WafCX |
| Operation: | write | Name: | 5239 |
Value: sku-ween | |||
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\Wondershare Helper Compact |
| Operation: | write | Name: | ClientSign |
Value: {C4BA3647-0000-0QM0-0001-5254004A04AF} | |||
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\WAF |
| Operation: | write | Name: | ClientSign |
Value: {C4BA3647-0000-0QM0-0001-5254004A04AF} | |||
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfelement-pro_setup_full5239_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfelement-pro_setup_full5239_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfelement-pro_setup_full5239_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2452) pdfelement-pro_setup_full5239.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pdfelement-pro_setup_full5239_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
Executable files
29
Suspicious files
0
Text files
30
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2452 | pdfelement-pro_setup_full5239.exe | C:\Users\Public\Documents\Wondershare\pdfelement-pro_full5239.exe.~P2S | — | |
MD5:— | SHA256:— | |||
| 2452 | pdfelement-pro_setup_full5239.exe | C:\Users\Public\Documents\Wondershare\pdfelement-pro_full5239.exe | — | |
MD5:— | SHA256:— | |||
| 2452 | pdfelement-pro_setup_full5239.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\5239-20190628180646[1].htm | html | |
MD5:— | SHA256:— | |||
| 2452 | pdfelement-pro_setup_full5239.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\5239-20190628180646[1].htm | html | |
MD5:— | SHA256:— | |||
| 2452 | pdfelement-pro_setup_full5239.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\professional-4[1].png | image | |
MD5:— | SHA256:— | |||
| 2452 | pdfelement-pro_setup_full5239.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\professional-5[1].png | image | |
MD5:— | SHA256:— | |||
| 2480 | pdfelement-pro_full5239.tmp | C:\Program Files\Wondershare\PDFelement Pro\is-G7GQ6.tmp | — | |
MD5:— | SHA256:— | |||
| 2452 | pdfelement-pro_setup_full5239.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\professional-3[1].png | image | |
MD5:— | SHA256:— | |||
| 2480 | pdfelement-pro_full5239.tmp | C:\Users\admin\AppData\Local\Temp\is-R0T9L.tmp\is-7UFT4.tmp | — | |
MD5:— | SHA256:— | |||
| 2452 | pdfelement-pro_setup_full5239.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\professional-2[1].png | image | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
22
DNS requests
3
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2452 | pdfelement-pro_setup_full5239.exe | HEAD | 200 | 2.16.186.83:80 | http://download.wondershare.com/cbs_down/pdfelement-pro_full5239.exe | unknown | — | — | whitelisted |
2452 | pdfelement-pro_setup_full5239.exe | HEAD | 200 | 2.16.186.90:80 | http://download.wondershare.com/cbs_down/pdfelement-pro_full5239.exe | unknown | — | — | whitelisted |
2452 | pdfelement-pro_setup_full5239.exe | GET | — | 2.16.186.83:80 | http://download.wondershare.com/cbs_down/pdfelement-pro_full5239.exe | unknown | — | — | whitelisted |
2452 | pdfelement-pro_setup_full5239.exe | GET | — | 63.159.217.165:80 | http://dlinst.wondershare.com/player/style/orbit-1.3.0.css | US | — | — | suspicious |
2452 | pdfelement-pro_setup_full5239.exe | GET | 200 | 63.159.217.165:80 | http://dlinst.wondershare.com/player/5239-20190628180646/professional-2.png?t=20190628180646 | US | image | 24.0 Kb | suspicious |
2452 | pdfelement-pro_setup_full5239.exe | GET | 206 | 2.16.186.90:80 | http://download.wondershare.com/cbs_down/pdfelement-pro_full5239.exe | unknown | binary | 8.87 Mb | whitelisted |
2452 | pdfelement-pro_setup_full5239.exe | GET | 200 | 63.159.217.165:80 | http://dlinst.wondershare.com/player/5239-20190628180646/professional-1.png?t=20190628180646 | US | image | 26.2 Kb | suspicious |
2452 | pdfelement-pro_setup_full5239.exe | GET | 200 | 63.159.217.165:80 | http://dlinst.wondershare.com/player/5239-20190628180646/professional-3.png?t=20190628180646 | US | image | 26.4 Kb | suspicious |
2452 | pdfelement-pro_setup_full5239.exe | GET | 200 | 47.91.67.36:80 | http://platform.wondershare.com/rest/v2/downloader/runtime/?client_sign={C4BA3647-0000-0QM0-0001-5254004A04AF}&product_id=5239 | US | xml | 1.51 Kb | suspicious |
2452 | pdfelement-pro_setup_full5239.exe | GET | 200 | 63.159.217.165:80 | http://dlinst.wondershare.com/player/5239-20190628180646.html | US | html | 916 b | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2452 | pdfelement-pro_setup_full5239.exe | 63.159.217.165:80 | dlinst.wondershare.com | QUANTIL, INC | US | unknown |
— | — | 47.91.67.36:80 | platform.wondershare.com | Alibaba (China) Technology Co., Ltd. | US | suspicious |
2452 | pdfelement-pro_setup_full5239.exe | 2.16.186.83:80 | download.wondershare.com | Akamai International B.V. | — | whitelisted |
2452 | pdfelement-pro_setup_full5239.exe | 2.16.186.90:80 | download.wondershare.com | Akamai International B.V. | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
platform.wondershare.com |
| suspicious |
download.wondershare.com |
| whitelisted |
dlinst.wondershare.com |
| suspicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2452 | pdfelement-pro_setup_full5239.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2452 | pdfelement-pro_setup_full5239.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |