File name:

doc.pdf

Full analysis: https://app.any.run/tasks/8d977e55-e020-41a8-9a1d-54f0af68da69
Verdict: Malicious activity
Analysis date: April 09, 2018, 11:52:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
phishing
phish-onedrive
phish-pdf
Indicators:
MIME: application/pdf
File info: PDF document, version 1.7
MD5:

263E34EBBCAA1D1C28EEBBCBE5C3D6D0

SHA1:

D859D66E1487F5F4B94AAF2293C05DA4493E1190

SHA256:

F7A217727157B4F490FF9AA29E70F5A861E0C5E0655A0C445516E325831DB5C3

SSDEEP:

1536:MO5Z19sVqJegla4t+h0clwb1m6avHXj8VoWhIPdXD9+:15Z8XgQg+h0xArz8VovPdX0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts Internet Explorer

      • AcroRd32.exe (PID: 3140)

  • INFO

    • Dropped object may contain URL's

      • RdrCEF.exe (PID: 3096)
      • iexplore.exe (PID: 2152)
      • iexplore.exe (PID: 1420)
      • AcroRd32.exe (PID: 2300)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2152)

    • Creates files in the user directory

      • AcroRd32.exe (PID: 3140)
      • iexplore.exe (PID: 2152)

    • Changes internet zones settings

      • iexplore.exe (PID: 1420)

    • Application launched itself

      • RdrCEF.exe (PID: 3096)
      • iexplore.exe (PID: 1420)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2152)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

PDFVersion: 1.7
Linearized: No
PageCount: 1
Language: en-US
TaggedPDF: Yes
Author: User PC
Creator: Microsoft® Word 2016
CreateDate: 2018:04:06 06:50:28-04:00
ModifyDate: 2018:04:06 06:50:28-04:00
Producer: Microsoft® Word 2016

XMP

XMPToolkit: 3.1-701
Producer: Microsoft® Word 2016
Creator: User PC
CreatorTool: Microsoft® Word 2016
CreateDate: 2018:04:06 06:50:28-04:00
ModifyDate: 2018:04:06 06:50:28-04:00
DocumentID: uuid:25783695-2E8A-48C8-9A15-A4ACFF971326
InstanceID: uuid:25783695-2E8A-48C8-9A15-A4ACFF971326
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start acrord32.exe no specs acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs iexplore.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1420"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe—AcroRd32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2152"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1420 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2300"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --channel=3140.0.868388054 --type=renderer "C:\Users\admin\AppData\Local\Temp\doc.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
0
Version:
15.7.20033.133275
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrord32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2412"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-delegated-renderer --disable-desktop-notifications --disable-file-system --disable-shared-workers --disable-speech-input --disable-threaded-compositing --disable-webaudio --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.7.20033 Chrome/35.0.1916.138" --disable-accelerated-compositing --disable-accelerated-video-decode --enable-software-compositing --disable-gpu-compositing --channel="3096.0.1909653204\654722567" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.7.20033.133275
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3096"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.7.20033.133275
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3140"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Temp\doc.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
0
Version:
15.7.20033.133275
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrord32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
955
Read events
824
Write events
129
Delete events
2

Modification events

(PID) Process:(2300) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(3096) RdrCEF.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\91\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2300) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\TrustManager\cDefaultLaunchURLPerms
Operation:writeName:tHostPerms
Value:
version:2|ababilhajjgroupbd.com:2
(PID) Process:(1420) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1420) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1420) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1420) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(1420) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1420) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005D00000009000000000000000000000000000000040000000000000090CE7F108CAFD301000000000000000000000000020000001700000000000000FE80000000000000D45917EAB3ED3D860B000000000000001700000000000000FE80000000000000D45917EAB3ED3D860B000000000000001C00000000000000000000000000000000000000000000000000000000000000170000000000000000000000000000000000FFFFC0A8640B000000000000000002000000C0A864640000000000000000000000000000000000000000000000000C00000C37D0000010A73800D8703600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081F800009000230090002300380023000000000000702C000A00000000000000F8412C00
(PID) Process:(1420) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{854261ED-3BEC-11E8-B3BE-5254004AAD21}
Value:
0
Executable files
0
Suspicious files
17
Text files
25
Unknown types
17

Dropped files

PID
Process
Filename
Type
2300AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
3096RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3096_18603\index —
MD5:—
SHA256:—
3096RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3096_18603\data_0 —
MD5:—
SHA256:—
3096RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3096_18603\data_1 —
MD5:—
SHA256:—
3096RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3096_18603\data_2 —
MD5:—
SHA256:—
3096RdrCEF.exeC:\Users\admin\AppData\Local\Temp\scoped_dir3096_18603\data_3 —
MD5:—
SHA256:—
3096RdrCEF.exeC:\Users\admin\AppData\Local\Temp\Cab1E6E.tmp —
MD5:—
SHA256:—
3096RdrCEF.exeC:\Users\admin\AppData\Local\Temp\Tar1E6F.tmp —
MD5:—
SHA256:—
3096RdrCEF.exeC:\Users\admin\AppData\Local\Temp\Tar1EA0.tmp —
MD5:—
SHA256:—
3096RdrCEF.exeC:\Users\admin\AppData\Local\Temp\Cab3362.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
20
DNS requests
11
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
8.253.208.120:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
52.7 Kb
whitelisted
—
—
GET
200
184.154.67.178:80
http://ababilhajjgroupbd.com/doc/oned/xb/GGN.html
US
html
1.11 Kb
malicious
—
—
GET
200
172.217.18.14:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D
US
der
468 b
whitelisted
—
—
GET
200
184.154.67.178:80
http://ababilhajjgroupbd.com/doc/oned/xb/css/style.css
US
text
6.76 Kb
malicious
—
—
GET
200
184.154.67.178:80
http://ababilhajjgroupbd.com/doc/oned/xb/images/yahooMail.png
US
image
1.95 Kb
malicious
—
—
GET
200
184.154.67.178:80
http://ababilhajjgroupbd.com/doc/oned/xb/images/office.png
US
image
1.39 Kb
malicious
—
—
GET
200
184.154.67.178:80
http://ababilhajjgroupbd.com/doc/oned/xb/images/gmail.png
US
image
1.80 Kb
malicious
—
—
GET
200
184.154.67.178:80
http://ababilhajjgroupbd.com/doc/oned/xb/images/mail.png
US
image
1.65 Kb
malicious
—
—
GET
404
184.154.67.178:80
http://ababilhajjgroupbd.com/favicon.ico
US
html
328 b
malicious
—
—
GET
200
184.154.67.178:80
http://ababilhajjgroupbd.com/doc/oned/xb/images/aol.png
US
image
1.50 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
52.87.82.1:443
cloud.acrobat.com
Amazon.com, Inc.
US
unknown
—
—
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
184.154.67.178:80
ababilhajjgroupbd.com
SingleHop, Inc.
US
suspicious
—
—
172.217.18.10:443
fonts.googleapis.com
Google Inc.
US
whitelisted
—
—
172.217.18.14:80
ocsp.pki.goog
Google Inc.
US
whitelisted
—
—
8.253.208.120:80
www.download.windowsupdate.com
Level 3 Communications, Inc.
US
unknown
—
—
216.58.205.227:443
fonts.gstatic.com
Google Inc.
US
whitelisted
—
—
23.37.43.27:80
g.symcd.com
Akamai Technologies, Inc.
NL
whitelisted
—
—
23.37.37.163:80
crl.geotrust.com
Akamai Technologies, Inc.
NL
whitelisted

DNS requests

Domain
IP
Reputation
cloud.acrobat.com
  • 52.87.82.1
  • 52.205.65.96
whitelisted
www.download.windowsupdate.com
  • 8.253.208.120
  • 8.251.75.254
  • 8.249.209.254
  • 67.26.117.254
  • 67.26.83.254
whitelisted
ababilhajjgroupbd.com
  • 184.154.67.178
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
fonts.googleapis.com
  • 172.217.18.10
whitelisted
ocsp.pki.goog
  • 172.217.18.14
whitelisted
fonts.gstatic.com
  • 216.58.205.227
whitelisted
crl.geotrust.com
  • 23.37.37.163
whitelisted
g.symcd.com
  • 23.37.43.27
whitelisted
clients1.google.com
  • 172.217.18.14
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET CURRENT_EVENTS Generic Multi-Email Popupwnd Phishing Landing 2018-01-25
—
—
Potentially Bad Traffic
ET CURRENT_EVENTS OneDrive Phishing Landing 2018-02-12
—
—
Potentially Bad Traffic
ET CURRENT_EVENTS OneDrive Phishing Landing 2018-03-08
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
doc.pdf