Analysis
- max time kernel
119s - max time network
134s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
29/10/2021, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe
- Size 297KB
- Sample211029-jnellahfbl
- SHA256 ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd
- MD5 ebc2661a409a3a743bba237ba1bfc4e8
- SHA1 1d9052ce97f4f127f2626b2ff2ee106b4f8b9a70
- SHA512 c7999fa0449fd98bd4869327189688942d3812d2d127d4e34173194af11dc2436dcd8a3fef025f5c6075372e0bccf45b859a5d2559d71c100f3281046d0ab1a6
- MD5 SHA1 SHA512
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark2x.png.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\export.svg.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforsignature.svg.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\blacklisted.certs.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\SkypeApp\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.TLB.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\info.png.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\Bin\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHIC.TTF.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-sl\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\ui-strings.js.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\ui-strings.js.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\message_to fmiint.log ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\ui-strings.js.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main.css.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview.png.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jni.h.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.fmiint-sqnsxris ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe