Analysis
-
max time kernel
31s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2023 19:01
Static task
static1
Behavioral task
behavioral1
Sample
Adobe Acrobat DC OCR Fix.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
Adobe Acrobat DC OCR Fix.exe
-
Size
78.9MB
-
MD5
c79bd426892455c5940558ed35d1c31d
-
SHA1
c20cc903f5448ed529fdc432f76f292bb129da3f
-
SHA256
80b49468a65d7d697a82dfd8c1666c030b98b86d9b1ffe6e686dd44e2cb526ef
-
SHA512
281adf9b580a75be96d01da9944d8984154ab5a3ce270173ce2ba4daec427374787f80e333a745d942c5eb8a0ae9d7682e36ab83558ac996bc178b82ee68321d
-
SSDEEP
1572864:LMmL3wcNekRSholHx1c3l2HCqhNDerH4nV1hRCI5eCF6Ykqby:FL33ekbHxeEH/hVOu3zhpF68y
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 34 IoCs
description ioc Process File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_font_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_same_proba.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_bigrams.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_similar_characters_differentiation.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_features_fast.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_font_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_font_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_features_one_candidate.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_same_proba.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_similar_characters_differentiation.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_features_fast.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_features_fast.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_same_proba.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_features_fast.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_similar_characters_differentiation.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_similar_characters_differentiation.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_bigrams.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_features_one_candidate.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_features_one_candidate.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_words.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_bigrams.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_features_one_candidate.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_font_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional.bin Adobe Acrobat DC OCR Fix.exe File opened for modification C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\ Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_bigrams.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_same_proba.bin Adobe Acrobat DC OCR Fix.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1656 Adobe Acrobat DC OCR Fix.exe