| File name: | CuteWriter.exe |
| Full analysis: | https://app.any.run/tasks/aba71018-d74b-4adf-9ff2-213b07ed67e7 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | November 03, 2020, 05:40:15 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | FF842EB7C3533C069A03E8ACCFE6C79B |
| SHA1: | FDF1F3F2A83D62B15C6BF84095FE3AE2EF8E4C38 |
| SHA256: | DC0E49348AEA174F45EF38B49E3A65A805CDF4FC159C451F01639B8E4CD943C7 |
| SSDEEP: | 49152:s9pvP23tHqlxN8xdmWQKm/5/1Es63/q1NsrZS6gwR/BcqAeeZy+ragl:mpvPYF2CxdmWRKlVKZ3Zcqor2gl |
MALICIOUS
Actions looks like stealing of personal data
- converter.exe (PID: 3500)
- CuteWriter.tmp (PID: 1516)
Loads dropped or rewritten executable
- spoolsv.exe (PID: 1188)
- WINWORD.EXE (PID: 3568)
Application was dropped or rewritten from another process
- converter.exe (PID: 3500)
- Setup.exe (PID: 872)
- CPWSave.exe (PID: 2512)
- CPWRIT~1.EXE (PID: 2768)
- CPWSave.exe (PID: 492)
- CPWSave.exe (PID: 3508)
- gswin32c.exe (PID: 2692)
- CUTEPD~1.EXE (PID: 3340)
Downloads executable files from the Internet
- Setup.exe (PID: 3400)
SUSPICIOUS
Executable content was dropped or overwritten
- CuteWriter.exe (PID: 3148)
- converter.exe (PID: 3500)
- CuteWriter.tmp (PID: 1516)
- CuteWriter.exe (PID: 3644)
- Setup.exe (PID: 3400)
- Setup.exe (PID: 872)
- spoolsv.exe (PID: 1188)
Creates files in the Windows directory
- Setup.exe (PID: 3400)
- spoolsv.exe (PID: 1188)
Reads Internet Cache Settings
- Setup.exe (PID: 3400)
Removes files from Windows directory
- spoolsv.exe (PID: 1188)
Starts Internet Explorer
- CuteWriter.tmp (PID: 1516)
Creates files in the program directory
- Setup.exe (PID: 872)
Application launched itself
- CPWSave.exe (PID: 492)
INFO
Application was dropped or rewritten from another process
- CuteWriter.tmp (PID: 2612)
- Setup.exe (PID: 3400)
- CuteWriter.tmp (PID: 1516)
Loads dropped or rewritten executable
- Setup.exe (PID: 3400)
- CuteWriter.tmp (PID: 1516)
Creates files in the program directory
- Setup.exe (PID: 3400)
Creates a software uninstall entry
- Setup.exe (PID: 3400)
Reads Internet Cache Settings
- iexplore.exe (PID: 2584)
- iexplore.exe (PID: 2948)
Application launched itself
- iexplore.exe (PID: 2584)
Changes internet zones settings
- iexplore.exe (PID: 2584)
Reads settings of System Certificates
- iexplore.exe (PID: 2948)
- iexplore.exe (PID: 2584)
Creates files in the user directory
- WINWORD.EXE (PID: 3568)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2948)
- iexplore.exe (PID: 2584)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 3568)
Changes settings of System certificates
- iexplore.exe (PID: 2948)
- iexplore.exe (PID: 2584)
Reads internet explorer settings
- iexplore.exe (PID: 2948)
Manual execution by user
- WINWORD.EXE (PID: 3568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (77.7) |
|---|---|---|
| .exe | | | Win32 Executable Delphi generic (10) |
| .dll | | | Win32 Dynamic Link Library (generic) (4.6) |
| .exe | | | Win32 Executable (generic) (3.1) |
| .exe | | | Win16/32 Executable Delphi generic (1.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1992:06:20 00:22:17+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 40448 |
| InitializedDataSize: | 17920 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa5f8 |
| OSVersion: | 1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 4.0.0.4 |
| ProductVersionNumber: | 4.0.0.4 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | CutePDF Setup |
| CompanyName: | Acro Software Inc. |
| FileDescription: | CutePDF Writer Setup |
| FileVersion: | 4.0.0.4 |
| LegalCopyright: | Copyright © 2003-2020 Acro Software Inc. |
| ProductName: | CutePDF Writer |
| ProductVersion: | 4.0.0.4 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 19-Jun-1992 22:22:17 |
| Detected languages: |
|
| Comments: | CutePDF Setup |
| CompanyName: | Acro Software Inc. |
| FileDescription: | CutePDF Writer Setup |
| FileVersion: | 4.0.0.4 |
| LegalCopyright: | Copyright © 2003-2020 Acro Software Inc. |
| ProductName: | CutePDF Writer |
| ProductVersion: | 4.0.0.4 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0050 |
| Pages in file: | 0x0002 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x000F |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x001A |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000100 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 8 |
| Time date stamp: | 19-Jun-1992 22:22:17 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
CODE | 0x00001000 | 0x00009D30 | 0x00009E00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.63175 |
DATA | 0x0000B000 | 0x00000250 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.75472 |
BSS | 0x0000C000 | 0x00000E90 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x0000D000 | 0x00000950 | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.43073 |
.tls | 0x0000E000 | 0x00000008 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x0000F000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 0.204488 |
.reloc | 0x00010000 | 0x000008C4 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 0 |
.rsrc | 0x00011000 | 0x00002C00 | 0x00002C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 4.59046 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.13965 | 1580 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 3.47151 | 1384 | UNKNOWN | Dutch - Netherlands | RT_ICON |
3 | 3.91708 | 744 | UNKNOWN | Dutch - Netherlands | RT_ICON |
4 | 3.91366 | 2216 | UNKNOWN | Dutch - Netherlands | RT_ICON |
4089 | 3.21823 | 754 | UNKNOWN | UNKNOWN | RT_STRING |
4090 | 3.31515 | 780 | UNKNOWN | UNKNOWN | RT_STRING |
4091 | 3.25024 | 718 | UNKNOWN | UNKNOWN | RT_STRING |
4093 | 2.86149 | 104 | UNKNOWN | UNKNOWN | RT_STRING |
4094 | 3.20731 | 180 | UNKNOWN | UNKNOWN | RT_STRING |
4095 | 3.04592 | 174 | UNKNOWN | UNKNOWN | RT_STRING |
Imports
advapi32.dll |
comctl32.dll |
kernel32.dll |
oleaut32.dll |
user32.dll |
Total processes
58
Monitored processes
17
Malicious processes
4
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 492 | C:\PROGRA~1\CUTEPD~1\CPWSave.exe /Automation /pt S-1-5-21-1302019708-1500728564-335382590-1000 "CutePDF Writer" "C:\Users\admin\AppData\Local\Temp\CutePDF Writer v4.0\PWD236.tmp" "Microsoft Word - expresslarge.rtf" | C:\PROGRA~1\CUTEPD~1\CPWSave.exe | — | spoolsv.exe | |||||||||||
User: admin Company: Acro Software Inc. Integrity Level: MEDIUM Description: CutePDF Writer Exit code: 0 Version: 4, 0, 0, 4 Modules
| |||||||||||||||
| 872 | Setup.exe | C:\Users\admin\AppData\Local\Temp\WZSE0.TMP\Setup.exe | converter.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1188 | C:\Windows\System32\spoolsv.exe | C:\Windows\System32\spoolsv.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Spooler SubSystem App Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1516 | "C:\Users\admin\AppData\Local\Temp\is-FVD2T.tmp\CuteWriter.tmp" /SL5="$30132,3022890,56832,C:\Users\admin\AppData\Local\Temp\CuteWriter.exe" /SPAWNWND=$40130 /NOTIFYWND=$20138 | C:\Users\admin\AppData\Local\Temp\is-FVD2T.tmp\CuteWriter.tmp | CuteWriter.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
| 2512 | C:\PROGRA~1\CUTEPD~1\CPWSave.exe /pt S-1-5-21-1302019708-1500728564-335382590-1000 "CutePDF Writer" | C:\PROGRA~1\CUTEPD~1\CPWSave.exe | — | spoolsv.exe | |||||||||||
User: admin Company: Acro Software Inc. Integrity Level: MEDIUM Description: CutePDF Writer Exit code: 0 Version: 4, 0, 0, 4 Modules
| |||||||||||||||
| 2584 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.cutepdf-editor.com/support/writer.asp | C:\Program Files\Internet Explorer\iexplore.exe | CuteWriter.tmp | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2612 | "C:\Users\admin\AppData\Local\Temp\is-ACIH9.tmp\CuteWriter.tmp" /SL5="$20138,3022890,56832,C:\Users\admin\AppData\Local\Temp\CuteWriter.exe" | C:\Users\admin\AppData\Local\Temp\is-ACIH9.tmp\CuteWriter.tmp | — | CuteWriter.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
| 2692 | C:\PROGRA~1\GPLGS\gswin32c.exe @"C:\PROGRA~1\CUTEPD~1\pdfwrite.rsp" "-IC:\Program Files\GPLGS" -sOutputFile="C:\Users\admin\AppData\Local\Temp\CutePDF Writer v4.0\PWD236.tmp" -c save pop -f "C:\Users\admin\AppData\Local\Temp\CutePDF Writer v4.0\PWD236.tmp.PS" | C:\PROGRA~1\GPLGS\gswin32c.exe | — | CPWSave.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2768 | "C:\PROGRA~1\CUTEPD~1\CPWRIT~1.EXE" -f"C:\Users\admin\AppData\Local\Temp\CutePDF Writer v4.0\PWD236.tmp" -p"CutePDF Writer" -s"S-1-5-21-1302019708-1500728564-335382590-1000" | C:\PROGRA~1\CUTEPD~1\CPWRIT~1.EXE | — | spoolsv.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2948 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2584 CREDAT:275457 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
Total events
3 901
Read events
2 644
Write events
1 036
Delete events
221
Modification events
| (PID) Process: | (1516) CuteWriter.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: EC050000FECD16DBA3B1D601 | |||
| (PID) Process: | (1516) CuteWriter.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: BAC45157B96217833544B50F35615E197C1B1C9B11D2FBBCA5B243F19AB4C6A6 | |||
| (PID) Process: | (1516) CuteWriter.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (1516) CuteWriter.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFiles0000 |
Value: C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\cpwmon32_v40.dll | |||
| (PID) Process: | (1516) CuteWriter.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFilesHash |
Value: 319DF6CB949E8E17B24BD1E7BBA5FAB0A9B26D3EBD89462D53465AE4E40C5F04 | |||
| (PID) Process: | (3400) Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Acro Software Inc\CutePDF Writer |
| Operation: | write | Name: | Port Name |
Value: CPW4: | |||
| (PID) Process: | (3400) Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Acro Software Inc\CutePDF Writer |
| Operation: | write | Name: | Printer Name |
Value: CutePDF Writer | |||
| (PID) Process: | (3400) Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Acro Software Inc\CutePDF Writer |
| Operation: | write | Name: | Destination Folder |
Value: C:\Program Files\CutePDF Writer | |||
| (PID) Process: | (3400) Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Acro Software Inc\CutePDF Writer |
| Operation: | write | Name: | Programmatic Access |
Value: 0 | |||
| (PID) Process: | (3400) Setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
Executable files
34
Suspicious files
26
Text files
497
Unknown types
68
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-O4E6L.tmp | — | |
MD5:— | SHA256:— | |||
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-A00DP.tmp | — | |
MD5:— | SHA256:— | |||
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-NDLBJ.tmp | — | |
MD5:— | SHA256:— | |||
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-N773S.tmp | — | |
MD5:— | SHA256:— | |||
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-5SLDI.tmp | — | |
MD5:— | SHA256:— | |||
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-7CGFA.tmp | — | |
MD5:— | SHA256:— | |||
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-0C1E7.tmp | — | |
MD5:— | SHA256:— | |||
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-OPEO1.tmp | — | |
MD5:— | SHA256:— | |||
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-O2JLC.tmp | — | |
MD5:— | SHA256:— | |||
| 1516 | CuteWriter.tmp | C:\Users\admin\AppData\Local\Temp\is-TDT69.tmp\is-13059.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
27
DNS requests
15
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2948 | iexplore.exe | GET | 200 | 216.58.206.3:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEBHHklXGCJy8AgAAAAB9mX8%3D | US | der | 471 b | whitelisted |
2584 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
2584 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
2584 | iexplore.exe | GET | 200 | 104.18.24.243:80 | http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIGkp0%2Fv9GUvNUu1EP06Tu7%2BChyAQUkZ47RGw9V5xCdyo010%2FRzEqXLNoCExwAFF8jA2u85i8%2FLFYAAAAUXyM%3D | US | der | 1.75 Kb | whitelisted |
2948 | iexplore.exe | GET | 200 | 192.124.249.23:80 | http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D | US | der | 1.69 Kb | whitelisted |
2948 | iexplore.exe | GET | 200 | 192.124.249.24:80 | http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D | US | der | 1.69 Kb | whitelisted |
2948 | iexplore.exe | GET | 200 | 216.58.206.3:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEBHHklXGCJy8AgAAAAB9mX8%3D | US | der | 471 b | whitelisted |
2948 | iexplore.exe | GET | 200 | 216.58.206.3:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDopzvCvNaHRggAAAAAXcGw | US | der | 472 b | whitelisted |
3400 | Setup.exe | GET | 200 | 64.34.201.145:80 | http://download.cutepdf.com/download/gplgs.exe | US | executable | 7.73 Mb | whitelisted |
2584 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3400 | Setup.exe | 64.34.201.145:80 | download.cutepdf.com | Peer 1 Network (USA) Inc. | US | suspicious |
2948 | iexplore.exe | 192.124.249.24:80 | ocsp.godaddy.com | Sucuri | US | suspicious |
2948 | iexplore.exe | 64.34.201.144:443 | www.cutepdf-editor.com | Peer 1 Network (USA) Inc. | US | unknown |
2948 | iexplore.exe | 192.124.249.23:80 | ocsp.godaddy.com | Sucuri | US | suspicious |
2948 | iexplore.exe | 172.217.16.194:443 | pagead2.googlesyndication.com | Google Inc. | US | whitelisted |
2584 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2948 | iexplore.exe | 216.58.206.3:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
2948 | iexplore.exe | 216.58.212.168:443 | www.googletagmanager.com | Google Inc. | US | whitelisted |
2948 | iexplore.exe | 142.250.74.194:443 | googleads.g.doubleclick.net | Google Inc. | US | suspicious |
2584 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
download.cutepdf.com |
| whitelisted |
www.cutepdf-editor.com |
| suspicious |
ocsp.godaddy.com |
| whitelisted |
pagead2.googlesyndication.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
googleads.g.doubleclick.net |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3400 | Setup.exe | Misc activity | APP [PTsecurity] CutePDF |
3400 | Setup.exe | Misc activity | APP [PTsecurity] CutePDF |
3400 | Setup.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |