Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe

Overview

General Information

Sample URL:http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe
Analysis ID:831172
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

  • System is w10x64
  • cmd.exe (PID: 5736 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe" > cmdline.out 2>&1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
    • conhost.exe (PID: 3520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • wget.exe (PID: 324 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: wget.exe, 00000002.00000002.241648904.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.drString found in binary or memory: http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3520:120:WilError_01
Source: C:\Windows\SysWOW64\wget.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\SysWOW64\wget.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\wget.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: classification engineClassification label: clean0.win@4/1@0/0
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\cmdline.outJump to behavior
Source: wget.exe, 00000002.00000002.241648904.0000000000D78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe" > cmdline.out 2>&1
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Command and Scripting Interpreter
Path Interception1
Process Injection
1
Masquerading
OS Credential Dumping1
Security Software Discovery
Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection
LSASS Memory1
System Information Discovery
Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager1
Remote System Discovery
SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 831172 URL: http://pdfconvertychrome.ss... Startdate: 21/03/2023 Architecture: WINDOWS Score: 0 5 cmd.exe 2 2->5         started        process3 7 wget.exe 1 5->7         started        9 conhost.exe 5->9         started       
SourceDetectionScannerLabelLink
http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe0%Avira URL Cloudsafe
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
Joe Sandbox Version:37.0.0 Beryl
Analysis ID:831172
Start date and time:2023-03-21 07:57:32 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 2m 20s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:urldownload.jbs
Sample URL:http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:3
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:CLEAN
Classification:clean0.win@4/1@0/0
EGA Information:Failed
HDC Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Unable to download file
  • Excluded IPs from analysis (whitelisted): 205.185.208.154
  • Excluded domains from analysis (whitelisted): pdfconvertychrome.ssl.hwcdn.net
  • Not all processes where analyzed, report is missing behavior information
No simulations
No context
No context
No context
No context
No context
Process:C:\Windows\SysWOW64\cmd.exe
File Type:ASCII text, with CRLF line terminators
Category:modified
Size (bytes):392
Entropy (8bit):5.047536204042369
Encrypted:false
SSDEEP:12:Htpp2HdG2f2cqUI2f2tUG1De5Rhh8froB3v:NppMcgdqUIgEUGxePP8sf
MD5:2E84C708A9A0E8A63D152466FA859A1F
SHA1:1D79D210CBF392A99447849838B5486CDEB53A1B
SHA-256:F681FC679BBB6601139BEBDB1AAB2B05D3FA200FFEAE2D738A26CE9877C199DA
SHA-512:35F1BB0031EAA45912302E5C4AEA74757D39A892692291DCAFEA44A75F9452F511D5248967B4DD11E58CE5AFB6001F451296C63A92D3B924976523EE304D7055
Malicious:false
Reputation:low
Preview:--2023-03-21 07:58:23-- http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe..Resolving pdfconvertychrome.ssl.hwcdn.net (pdfconvertychrome.ssl.hwcdn.net)... 205.185.208.154..Connecting to pdfconvertychrome.ssl.hwcdn.net (pdfconvertychrome.ssl.hwcdn.net)|205.185.208.154|:80... connected...HTTP request sent, awaiting response... 404 Not Found..2023-03-21 07:58:23 ERROR 404: Not Found.....
No static file info
Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

Click to jump to process

Click to jump to process

Click to dive into process behavior distribution

Click to jump to process

Target ID:0
Start time:07:58:22
Start date:21/03/2023
Path:C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):true
Commandline:C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe" > cmdline.out 2>&1
Imagebase:0xb0000
File size:232960 bytes
MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low

Target ID:1
Start time:07:58:23
Start date:21/03/2023
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff745070000
File size:625664 bytes
MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low

Target ID:2
Start time:07:58:23
Start date:21/03/2023
Path:C:\Windows\SysWOW64\wget.exe
Wow64 process (32bit):true
Commandline:wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://pdfconvertychrome.ssl.hwcdn.net/pdfconverty.exe"
Imagebase:0x400000
File size:3895184 bytes
MD5 hash:3DADB6E2ECE9C4B3E1E322E617658B60
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low

No disassembly