File name:

February commision statement.pdf.zip

Full analysis: https://app.any.run/tasks/543446a6-4ff8-4adf-ae28-e36ae7957cb8
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: March 14, 2019, 11:07:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

FBF71BA9DCAF74A3E4259A02DF3FA520

SHA1:

7B3FF449736169B4C366B817336C02C23389B932

SHA256:

FE31AA6B097BD06FA403D53BE4752622D4248C6FA5106A33F96146241FEDAE51

SSDEEP:

6144:x/MScAdo6mKDaC6O0MBVerV0Dd6S2So8GSlLp2TbRZCoa/oFgq1JdHYJ4y59wA3:ZMiW6mKrHBcGnvoall0+ozFgqnHDyrH3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • February commision statement.pdf.exe (PID: 2440)
      • RegAsm.exe (PID: 2760)
      • RegAsm.exe (PID: 4084)
      • RegAsm.exe (PID: 3352)
      • RegAsm.exe (PID: 4012)
      • RegAsm.exe (PID: 2716)
      • RegAsm.exe (PID: 3448)
      • RegAsm.exe (PID: 2152)
      • RegAsm.exe (PID: 3012)

    • Application was dropped or rewritten from another process

      • RegAsm.exe (PID: 2760)
      • February commision statement.pdf.exe (PID: 2440)
      • RegAsm.exe (PID: 4084)
      • RegAsm.exe (PID: 2564)
      • RegAsm.exe (PID: 3352)
      • RegAsm.exe (PID: 3216)
      • RegAsm.exe (PID: 3856)
      • RegAsm.exe (PID: 4012)
      • RegAsm.exe (PID: 2484)
      • RegAsm.exe (PID: 2716)
      • RegAsm.exe (PID: 3268)
      • RegAsm.exe (PID: 3448)
      • RegAsm.exe (PID: 3932)
      • RegAsm.exe (PID: 2828)
      • RegAsm.exe (PID: 2152)
      • RegAsm.exe (PID: 3012)
      • RegAsm.exe (PID: 3560)
      • RegAsm.exe (PID: 3712)

  • SUSPICIOUS

    • Creates files in the user directory

      • RegAsm.exe (PID: 4084)
      • RegAsm.exe (PID: 2760)
      • RegAsm.exe (PID: 3352)
      • RegAsm.exe (PID: 4012)
      • RegAsm.exe (PID: 2716)
      • RegAsm.exe (PID: 3448)
      • RegAsm.exe (PID: 2152)
      • RegAsm.exe (PID: 3012)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2852)
      • February commision statement.pdf.exe (PID: 2440)
      • RegAsm.exe (PID: 4084)
      • RegAsm.exe (PID: 2760)
      • RegAsm.exe (PID: 3352)
      • RegAsm.exe (PID: 4012)
      • RegAsm.exe (PID: 2716)
      • RegAsm.exe (PID: 3448)
      • RegAsm.exe (PID: 2152)
      • RegAsm.exe (PID: 3012)

    • Checks for external IP

      • RegAsm.exe (PID: 2760)
      • RegAsm.exe (PID: 4084)
      • RegAsm.exe (PID: 3352)
      • RegAsm.exe (PID: 2716)
      • RegAsm.exe (PID: 4012)
      • RegAsm.exe (PID: 3448)
      • RegAsm.exe (PID: 2152)
      • RegAsm.exe (PID: 3012)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:03:14 08:36:16
ZipCRC: 0xfd400fc8
ZipCompressedSize: 390282
ZipUncompressedSize: 436224
ZipFileName: February commision statement.pdf.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
19
Malicious processes
4
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start start winrar.exe february commision statement.pdf.exe regasm.exe regasm.exe no specs regasm.exe regasm.exe no specs regasm.exe regasm.exe no specs regasm.exe regasm.exe no specs regasm.exe regasm.exe no specs regasm.exe regasm.exe no specs regasm.exe regasm.exe no specs regasm.exe regasm.exe no specs regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2152"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
February commision statement.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
2148734214
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2440"C:\Users\admin\AppData\Local\Temp\Rar$EXa2852.15135\February commision statement.pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2852.15135\February commision statement.pdf.exe
WinRAR.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
72.0.3626.121
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2852.15135\february commision statement.pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2484"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—February commision statement.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
4294967295
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
2564"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—February commision statement.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
4294967295
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
2716"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
February commision statement.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
2148734214
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2760"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
February commision statement.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
2148734214
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2828"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—February commision statement.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
4294967295
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
2852"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\February commision statement.pdf.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3012"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
February commision statement.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
2148734214
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3216"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—February commision statement.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
4294967295
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
Total events
747
Read events
714
Write events
33
Delete events
0

Modification events

(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2852) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\February commision statement.pdf.zip
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
10
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2440February commision statement.pdf.exeC:\Users\admin\filename.exeexecutable
MD5:—
SHA256:—
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2852.15135\February commision statement.pdf.exeexecutable
MD5:—
SHA256:—
2760RegAsm.exeC:\Users\admin\AppData\Roaming\server\server.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
4012RegAsm.exeC:\Users\admin\AppData\Roaming\server\server.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
2152RegAsm.exeC:\Users\admin\AppData\Roaming\server\server.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
3012RegAsm.exeC:\Users\admin\AppData\Roaming\server\server.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
4084RegAsm.exeC:\Users\admin\AppData\Roaming\server\server.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
2716RegAsm.exeC:\Users\admin\AppData\Roaming\server\server.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
3448RegAsm.exeC:\Users\admin\AppData\Roaming\server\server.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
3352RegAsm.exeC:\Users\admin\AppData\Roaming\server\server.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
8
DNS requests
1
Threats
33

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2760
RegAsm.exe
GET
301
104.26.14.73:80
http://freegeoip.net/json/
US
—
—
malicious
4084
RegAsm.exe
GET
301
104.26.14.73:80
http://freegeoip.net/json/
US
—
—
malicious
3352
RegAsm.exe
GET
301
104.26.14.73:80
http://freegeoip.net/json/
US
—
—
malicious
4012
RegAsm.exe
GET
301
104.26.14.73:80
http://freegeoip.net/json/
US
—
—
malicious
3448
RegAsm.exe
GET
301
104.26.14.73:80
http://freegeoip.net/json/
US
—
—
malicious
2152
RegAsm.exe
GET
301
104.26.14.73:80
http://freegeoip.net/json/
US
—
—
malicious
3012
RegAsm.exe
GET
301
104.26.14.73:80
http://freegeoip.net/json/
US
—
—
malicious
3352
RegAsm.exe
GET
403
104.26.14.73:80
http://freegeoip.net/shutdown
US
text
1.51 Kb
malicious
4084
RegAsm.exe
GET
403
104.26.14.73:80
http://freegeoip.net/shutdown
US
text
1.51 Kb
malicious
2760
RegAsm.exe
GET
403
104.26.14.73:80
http://freegeoip.net/shutdown
US
text
1.51 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4084
RegAsm.exe
104.26.14.73:80
freegeoip.net
Cloudflare Inc
US
shared
2760
RegAsm.exe
104.26.14.73:80
freegeoip.net
Cloudflare Inc
US
shared
4012
RegAsm.exe
104.26.14.73:80
freegeoip.net
Cloudflare Inc
US
shared
3352
RegAsm.exe
104.26.14.73:80
freegeoip.net
Cloudflare Inc
US
shared
2716
RegAsm.exe
104.26.14.73:80
freegeoip.net
Cloudflare Inc
US
shared
3448
RegAsm.exe
104.26.14.73:80
freegeoip.net
Cloudflare Inc
US
shared
2152
RegAsm.exe
104.26.14.73:80
freegeoip.net
Cloudflare Inc
US
shared
3012
RegAsm.exe
104.26.14.73:80
freegeoip.net
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
freegeoip.net
  • 104.26.14.73
  • 104.26.15.73
malicious

Threats

PID
Process
Class
Message
4084
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] TR/Spy.Gen IP Check freegeoip.net (Imminent Monitor)
4084
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Imminent Monitor Syle IP Check (freegeoip.net)
2760
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] TR/Spy.Gen IP Check freegeoip.net (Imminent Monitor)
2760
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Imminent Monitor Syle IP Check (freegeoip.net)
3352
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] TR/Spy.Gen IP Check freegeoip.net (Imminent Monitor)
3352
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Imminent Monitor Syle IP Check (freegeoip.net)
4012
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] TR/Spy.Gen IP Check freegeoip.net (Imminent Monitor)
4012
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Imminent Monitor Syle IP Check (freegeoip.net)
2716
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] TR/Spy.Gen IP Check freegeoip.net (Imminent Monitor)
2716
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Imminent Monitor Syle IP Check (freegeoip.net)
17 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
February commision statement.pdf.zip