Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

PDFixers.exe

PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy:	7.9781740953081055
Filename:	PDFixers.exe
Filesize:	8507584
MD5:	b4440eea7367c3fb04a89225df4022a6
SHA1:	5a6c01f821f10f6ed1f1283ecba36c5bacfb5838
SHA256:	a024a18e27707738adcd7b5a740c5a93534b4b8c9d3b947f6d85740af19d17d0
SHA512:	69c3a0339aa6d060845570527205136d4aa04b2f13b983e1e84a0d2d9a90e99ec827999a20c57e27a4c27d36e633bb264ddd95a43c03e47cfa3d9f6377e57e76
SSDEEP:	196608:qn1PLvFtljMRfLjjL4/Y8261NG9HTta83vm:qnZFtlIP4/Y7pO8/m
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....~............"...P.................. .....@..... ....................................`...@......@............... .....

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Drops PE files	Persistence and Installation Behavior
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
PE file does not import any functions	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Searches for the Microsoft Outlook file path	System Summary	Email Collection
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary	Windows Service
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
Creates a software uninstall entry	Compliance, System Summary	Windows Service
PE / OLE file has a valid certificate	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
PE file has a high image base, often used for DLLs	System Summary
Submission file is bigger than most known malware samples	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\email-decode.min[1].js

HTML document, ASCII text, with very long lines (1238)

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\email-decode.min[1].js
Category:	dropped
Dump:	email-decode.min[1].js.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\PDFixers.exe
Type:	HTML document, ASCII text, with very long lines (1238)
Entropy:	5.068464054671174
Encrypted:	false
Size:	1239
Whitelisted:	false

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\css2[1].css

ASCII text

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\css2[1].css
Category:	dropped
Dump:	css2[1].css.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\PDFixers.exe
Type:	ASCII text
Entropy:	5.565724594514051
Encrypted:	false
Size:	306
Whitelisted:	false

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\VZF1B155.htm

HTML document, ASCII text, with very long lines (10298), with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\VZF1B155.htm
Category:	dropped
Dump:	VZF1B155.htm.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\PDFixers.exe
Type:	HTML document, ASCII text, with very long lines (10298), with CRLF line terminators
Entropy:	5.605054113368966
Encrypted:	false
Size:	33684
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\C7S8M5VS\font[1].eot

Embedded OpenType (EOT), Nunito Sans 12pt Light family

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\C7S8M5VS\font[1].eot
Category:	dropped
Dump:	font[1].eot.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\PDFixers.exe
Type:	Embedded OpenType (EOT), Nunito Sans 12pt Light family
Entropy:	7.965514187975993
Encrypted:	false
Size:	43569
Whitelisted:	false

C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe

PE32+ executable (GUI) x86-64, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe
Category:	dropped
Dump:	SumatraPDF-3.5.2-64.exe.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Users\user\Desktop\PDFixers.exe
Type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	7.0278259579196165
Encrypted:	false
Size:	16065496
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Contains capabilities to detect virtual machines	Malware Analysis System Evasion	Security Software Discovery Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries information about the installed CPU (vendor, model number etc)	Language, Device and Operating System Detection	System Information Discovery
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Searches for user specific document files	Stealing of Sensitive Information	Data from Local System File and Directory Discovery
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading
Found window with many clickable UI elements (buttons, textforms, scrollbars etc)	System Summary
Executable creates window controls seldom found in malware	System Summary
Uses Rich Edit Controls	System Summary

C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-settings.txt

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-settings.txt
Category:	dropped
Dump:	SumatraPDF-settings.txt.3.dr
ID:	dr_7
Target ID:	3
Process:	C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.182086908460794
Encrypted:	false
Size:	1900
Whitelisted:	false

C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF.zip

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

Details

File:	C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF.zip
Category:	dropped
Dump:	SumatraPDF.zip.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Users\user\Desktop\PDFixers.exe
Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy:	7.998709533933773
Encrypted:	true
Size:	8243933
Whitelisted:	false

C:\Users\user\Desktop\SumatraPDF.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Apr 19 14:53:08 2024, mtime=Fri Apr 19 14:53:08 2024, atime=Wed Oct 25 05:17:54 2023, length=16065496, window=hide

dropped

Details

File:	C:\Users\user\Desktop\SumatraPDF.lnk
Category:	dropped
Dump:	SumatraPDF.lnk.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Users\user\Desktop\PDFixers.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Apr 19 14:53:08 2024, mtime=Fri Apr 19 14:53:08 2024, atime=Wed Oct 25 05:17:54 2023, length=16065496, window=hide
Entropy:	5.022193932090157
Encrypted:	false
Size:	960
Whitelisted:	false

Domains

Name

Malicious

pixel.pdfixers.com

104.21.11.17

Details

Name:	pixel.pdfixers.com
IP:	104.21.11.17
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

104.21.11.17

pixel.pdfixers.com

United States

Details

IP:	104.21.11.17
TargetID:	0
Current Path:	C:\Users\user\Desktop\PDFixers.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	pixel.pdfixers.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

64.233.185.94

unknown

United States

172.217.215.95

unknown

United States

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
PDFixers.exe

Files

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportPDFixers.exe

Files

Domains

IPs

IOC Report
PDFixers.exe