| URL: | http://download-desktop-msi.pdfescape.com/pdfescape4/4.0.24.4617/x86/pdfescape-desktop-startup-4.0.24.4617-x86.msi |
| Full analysis: | https://app.any.run/tasks/d8a8737e-893a-419c-b9ef-d8ea66896dbc |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | September 24, 2019, 08:42:29 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | ADFD6BB4DDEE0198B3648F235D22B8F8 |
| SHA1: | A315BE0CBBE23BF1E1108C951365647C585097FB |
| SHA256: | E25518F99C5B0CFDE41DE81F7073A9B241B060284C45B5E53761E407F8BB8B06 |
| SSDEEP: | 3:N1KaKEmBAWOROIFBEVALRVBcyVARYviRKQyVAIBA2ILRAsLVriLIWMn:CazO5qLxqRYkyqR2MA3Y |
MALICIOUS
Downloads executable files from the Internet
- iexplore.exe (PID: 2852)
Loads dropped or rewritten executable
- ws.exe (PID: 2900)
- MsiExec.exe (PID: 3652)
- MsiExec.exe (PID: 3372)
- updater-ws.exe (PID: 3056)
- escape.exe (PID: 2972)
- MsiExec.exe (PID: 3388)
- updater-ws.exe (PID: 3288)
- ws.exe (PID: 2088)
- escape.exe (PID: 3632)
Application was dropped or rewritten from another process
- updater-ws.exe (PID: 3056)
- ws.exe (PID: 2900)
- escape.exe (PID: 2972)
- ws.exe (PID: 2088)
- updater-ws.exe (PID: 3288)
- escape.exe (PID: 3632)
SUSPICIOUS
Creates COM task schedule object
- MsiExec.exe (PID: 3388)
- MsiExec.exe (PID: 3372)
- MsiExec.exe (PID: 3652)
Executed as Windows Service
- vssvc.exe (PID: 3196)
- updater-ws.exe (PID: 3288)
- ws.exe (PID: 2088)
Starts Microsoft Installer
- iexplore.exe (PID: 2764)
Executed via COM
- DrvInst.exe (PID: 2976)
Creates files in the user directory
- msiexec.exe (PID: 1348)
- escape.exe (PID: 2972)
- updater-ws.exe (PID: 3288)
- ws.exe (PID: 2088)
- escape.exe (PID: 3632)
Modifies the open verb of a shell class
- msiexec.exe (PID: 1348)
Application launched itself
- escape.exe (PID: 2972)
Executable content was dropped or overwritten
- msiexec.exe (PID: 1348)
INFO
Application launched itself
- iexplore.exe (PID: 2764)
- msiexec.exe (PID: 1348)
Creates a software uninstall entry
- msiexec.exe (PID: 1348)
Dropped object may contain Bitcoin addresses
- msiexec.exe (PID: 1348)
Changes internet zones settings
- iexplore.exe (PID: 2764)
Searches for installed software
- msiexec.exe (PID: 1348)
Reads Internet Cache Settings
- iexplore.exe (PID: 2852)
- iexplore.exe (PID: 2764)
Manual execution by user
- escape.exe (PID: 2972)
Reads settings of System Certificates
- escape.exe (PID: 2972)
Low-level read access rights to disk partition
- vssvc.exe (PID: 3196)
Creates files in the program directory
- msiexec.exe (PID: 1348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
57
Monitored processes
16
Malicious processes
7
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1348 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2088 | "C:\Program Files\PDFescape Desktop\ws.exe" | C:\Program Files\PDFescape Desktop\ws.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Red Software Integrity Level: SYSTEM Description: PDFescape Desktop Exit code: 0 Version: 4.0.24.4617 Modules
| |||||||||||||||
| 2764 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://download-desktop-msi.pdfescape.com/pdfescape4/4.0.24.4617/x86/pdfescape-desktop-startup-4.0.24.4617-x86.msi" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2780 | C:\Windows\system32\MsiExec.exe -Embedding D94E81C92EF42727BA8118B203600E72 M Global\MSI0000 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2844 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\pdfescape-desktop-startup-4.0.24.4617-x86.msi" | C:\Windows\System32\msiexec.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2852 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2764 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2900 | "C:\Program Files\PDFescape Desktop\ws.exe" -service | C:\Program Files\PDFescape Desktop\ws.exe | — | msiexec.exe | |||||||||||
User: admin Company: Red Software Integrity Level: MEDIUM Description: PDFescape Desktop Exit code: 0 Version: 4.0.24.4617 Modules
| |||||||||||||||
| 2972 | "C:\Program Files\PDFescape Desktop\escape.exe" | C:\Program Files\PDFescape Desktop\escape.exe | — | explorer.exe | |||||||||||
User: admin Company: Red Software Integrity Level: MEDIUM Description: PDFescape Desktop Exit code: 0 Version: 4.0.24.4617 Modules
| |||||||||||||||
| 2976 | DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot22" "" "" "695c3f483" "00000000" "00000270" "000004B0" | C:\Windows\system32\DrvInst.exe | — | svchost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3056 | "C:\Program Files\PDFescape Desktop\updater-ws.exe" -service | C:\Program Files\PDFescape Desktop\updater-ws.exe | — | msiexec.exe | |||||||||||
User: admin Company: Red Software Integrity Level: MEDIUM Description: PDFescape Desktop Exit code: 0 Version: 4.0.24.4617 Modules
| |||||||||||||||
Total events
2 146
Read events
1 354
Write events
775
Delete events
17
Modification events
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
| Operation: | write | Name: | {47975CBF-DEA7-11E9-A363-5254004A04AF} |
Value: 0 | |||
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Type |
Value: 4 | |||
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Count |
Value: 2 | |||
| (PID) Process: | (2764) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Time |
Value: E30709000200180008002A002E005902 | |||
Executable files
75
Suspicious files
31
Text files
124
Unknown types
14
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2764 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFE1592BE7AED05AE8.TMP | — | |
MD5:— | SHA256:— | |||
| 2764 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2764 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2852 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\G6LF3ZDA\pdfescape-desktop-startup-4.0.24.4617-x86[1].msi | — | |
MD5:— | SHA256:— | |||
| 2764 | iexplore.exe | C:\Users\admin\Desktop\pdfescape-desktop-startup-4.0.24.4617-x86.msi | — | |
MD5:— | SHA256:— | |||
| 2764 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019092020190921\index.dat | — | |
MD5:— | SHA256:— | |||
| 2764 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF96A994B88E67B7FD.TMP | — | |
MD5:— | SHA256:— | |||
| 2764 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{47975CBF-DEA7-11E9-A363-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
| 1348 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
| 1348 | msiexec.exe | C:\Windows\Installer\106217.msi | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
3
DNS requests
3
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3288 | updater-ws.exe | POST | 200 | 198.72.111.203:80 | http://update.pdfescape.com/Service.asmx | CA | xml | 560 b | suspicious |
2852 | iexplore.exe | GET | 200 | 89.187.169.86:80 | http://download-desktop-msi.pdfescape.com/pdfescape4/4.0.24.4617/x86/pdfescape-desktop-startup-4.0.24.4617-x86.msi | CZ | executable | 32.6 Mb | suspicious |
2764 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3288 | updater-ws.exe | POST | 200 | 198.72.111.203:80 | http://update.pdfescape.com/Service.asmx | CA | xml | 571 b | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2764 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3288 | updater-ws.exe | 198.72.111.203:80 | update.pdfescape.com | iWeb Technologies Inc. | CA | suspicious |
2852 | iexplore.exe | 89.187.169.86:80 | download-desktop-msi.pdfescape.com | — | CZ | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
download-desktop-msi.pdfescape.com |
| suspicious |
www.bing.com |
| whitelisted |
update.pdfescape.com |
| suspicious |