analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

phish_alert_sp2_2.0.0.0.eml

Full analysis: https://app.any.run/tasks/2c8f268b-c6ea-43ee-8aee-5f1187b922d5
Verdict: Malicious activity
Analysis date: October 04, 2022, 20:51:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators
MD5:

AE95B5BF5C1E7DF91F9AA1FF88925674

SHA1:

9B928CD1FD8CC72E88002C14F69D5765B438B3A2

SHA256:

EDA0CFCEA9F535E45821CE2DAED5B6A7A6BFC506B291A40156C9634C3C2E8267

SSDEEP:

96:EJeQtb7oVd+SwQRhjyYT/6k3WCrkNADJp+ImFqKDJpj+T1FdSIu0pvEYIPYIeVHb:0ekwVpFpkSJpcJpi/dvV1hoEYZzcH1H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • RdrCEF.exe (PID: 2612)

  • SUSPICIOUS

    • Reads the computer name

      • OUTLOOK.EXE (PID: 3048)
      • AdobeARM.exe (PID: 3952)

    • Checks supported languages

      • OUTLOOK.EXE (PID: 3048)
      • AdobeARM.exe (PID: 3952)
      • Reader_sl.exe (PID: 2700)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3048)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 3048)

    • Drops a file with a compile date too recent

      • RdrCEF.exe (PID: 2612)

  • INFO

    • Checks supported languages

      • AcroRd32.exe (PID: 3612)
      • AcroRd32.exe (PID: 4052)
      • RdrCEF.exe (PID: 3276)
      • RdrCEF.exe (PID: 2612)
      • RdrCEF.exe (PID: 3236)
      • RdrCEF.exe (PID: 3800)
      • RdrCEF.exe (PID: 3424)
      • RdrCEF.exe (PID: 2336)
      • RdrCEF.exe (PID: 2200)

    • Reads the computer name

      • AcroRd32.exe (PID: 3612)
      • AcroRd32.exe (PID: 4052)
      • RdrCEF.exe (PID: 2612)

    • Reads CPU info

      • AcroRd32.exe (PID: 4052)

    • Searches for installed software

      • AcroRd32.exe (PID: 3612)
      • AcroRd32.exe (PID: 4052)

    • Application launched itself

      • AcroRd32.exe (PID: 3612)
      • RdrCEF.exe (PID: 2612)

    • Reads the hosts file

      • RdrCEF.exe (PID: 2612)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3048)

    • Reads settings of System Certificates

      • AcroRd32.exe (PID: 3612)
      • RdrCEF.exe (PID: 2612)

    • Checks Windows Trust Settings

      • AcroRd32.exe (PID: 3612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
12
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start outlook.exe acrord32.exe acrord32.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs adobearm.exe no specs reader_sl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3048"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3612"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\6ABNHA3L\ORDER RECEIVE #487461564.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
OUTLOOK.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
20.13.20064.405839
4052"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\6ABNHA3L\ORDER RECEIVE #487461564.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
20.13.20064.405839
2612"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
20.13.20064.405839
3236"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1172,4570023789335117224,15597339115655396660,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14842047091869221401 --renderer-client-id=2 --mojo-platform-channel-handle=1180 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
20.13.20064.405839
3276"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1172,4570023789335117224,15597339115655396660,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=16812153816337713575 --mojo-platform-channel-handle=1220 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
3800"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1172,4570023789335117224,15597339115655396660,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=686019690645220972 --mojo-platform-channel-handle=1380 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
2336"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1172,4570023789335117224,15597339115655396660,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=3828426613812253010 --mojo-platform-channel-handle=1260 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
3424"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1172,4570023789335117224,15597339115655396660,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15079839931770445206 --renderer-client-id=6 --mojo-platform-channel-handle=1540 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
20.13.20064.405839
2200"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1172,4570023789335117224,15597339115655396660,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16689070487539874373 --renderer-client-id=7 --mojo-platform-channel-handle=1664 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
20.13.20064.405839
Total events
19 085
Read events
18 379
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
130
Text files
16
Unknown types
7

Dropped files

PID
Process
Filename
Type
3048OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR4E62.tmp.cvr —
MD5:—
SHA256:—
3048OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
3048OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DFA47C24162CEB77A4.TMPgmc
MD5:B5CFF0E37BFD65A4516B2FDA3BC5D2D2
SHA256:8A0591DE1476104D960B8EE35C25E3360C9912554D5DA379547F18C7B377E1EC
3048OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:D4B3D498170BBF95D22724FBFE36EA8A
SHA256:AC46B2619C8B2FE65CCF13B314562231A2DD010C8B847E010ECDA200E49CAE7E
2612RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0binary
MD5:69320FBB2EE558898F86F45F1D9440EC
SHA256:77D11524FD939945F9F9F1AB409511057AEC5D32E402ADC1D6F908FA6D19749A
3048OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:B7D173E9782CDF5C28815F0080F7F4C7
SHA256:D04C440BD62EDC2D88B3D58B5DAFF019BA4530D133F50F369A66501CB5598194
2612RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0binary
MD5:F88A4917863B0DE8C17984E7AB340C35
SHA256:E3FF0C7C8E87C1C1E65B2123EC3A1D62F032C88D3B70E71860734BEA6CAFB86F
2612RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0binary
MD5:136B68C5FFB7B2BEB4DAFADFD637BE6C
SHA256:1B07FFC77DDB7D4E295A53C9BA4E3FB20FB80860A771F1CFDA4CBF0C256E4142
2612RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0binary
MD5:ED1728EC74988B594472D9937D0A21CD
SHA256:83983E4D5A2F24DB772A03C2071C5A1F6F9C4F43BE20F3E07B0C10FA46E40380
3048OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_A8D134B2CF0A064D95338D2DA2F1CE24.datxml
MD5:57F30B1BCA811C2FCB81F4C13F6A927B
SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
11
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3048
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3612
AcroRd32.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
3612
AcroRd32.exe
GET
200
67.26.139.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7ffd476f308f4ab7
US
compressed
4.70 Kb
whitelisted
3612
AcroRd32.exe
GET
200
67.26.139.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8243db1c3ee167b3
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3612
AcroRd32.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3612
AcroRd32.exe
67.26.139.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3048
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2612
RdrCEF.exe
54.227.187.23:443
p13n.adobe.io
AMAZON-AES
US
suspicious
—
—
23.35.228.137:443
armmf.adobe.com
AKAMAI-AS
DE
suspicious
2612
RdrCEF.exe
23.210.252.251:443
geo2.adobe.com
AKAMAI-AS
DE
whitelisted
3612
AcroRd32.exe
2.16.106.203:443
acroipm2.adobe.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
geo2.adobe.com
  • 23.210.252.251
whitelisted
p13n.adobe.io
  • 54.227.187.23
  • 52.202.204.11
  • 52.5.13.197
  • 23.22.254.206
whitelisted
armmf.adobe.com
  • 23.210.252.251
  • 23.35.228.137
whitelisted
acroipm2.adobe.com
  • 2.16.106.203
  • 2.16.106.186
whitelisted
ctldl.windowsupdate.com
  • 67.26.139.254
  • 8.241.123.254
  • 67.27.235.254
  • 8.241.122.254
  • 8.241.9.126
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
phish_alert_sp2_2.0.0.0.eml