Overview

overview

7

Static

static

5

PDF-XChang...4).zip

windows10-2004-x64

1

PDF-XChang...4).zip

windows11-ltsc_2024-x64

1

PDF-XChang...64.dll

windows10-2004-x64

7

PDF-XChang...64.dll

windows10-2004-x64

7

PDF-XChang...er.exe

windows10-2004-x64

1

PDF-XChang...rL.exe

windows10-2004-x64

1

PDF-XChang...86.exe

windows10-2004-x64

3

PDF-XChang...er.exe

windows10-2004-x64

3

PDF-XChang...rL.exe

windows10-2004-x64

3

PDF-XChang...64.msi

windows10-2004-x64

7

PDF-XChang...64.msi

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    201s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 10:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PDF-XChange Pro 11.0.1 (x64)/Setup/ProV11.x64.msi
  • Size 424.5MB
  • Sample260730-mx4tmagb59
  • SHA256 93e938b2a9a25216325a898ed87cf523e6718f8f3f5b6d56599314e6f6b1f47f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 30 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 33 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\PDF-XChange Pro 11.0.1 (x64)\Setup\ProV11.x64.msi"
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2320
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 8F27E03F495D956FD1AEEF547B08362B C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:5040
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5288
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 0B7A851AD8D2ADCA856F3BA3430FEF6D
        2⤵
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5376
        • C:\Windows\system32\regini.exe
          "C:\Windows\system32\regini.exe" "C:\Users\Admin\AppData\Local\Temp\{5E38F280-6CC6-4A5E-A167335D4C06305D}\fileassoc.ini" >NUL 2>&1
          3⤵
            PID:784
          • C:\Users\Admin\AppData\Local\Temp\{0C1489FA-EB2A-4066-BF7C046610CA958D}\regwrite.exe
            "C:\Users\Admin\AppData\Local\Temp\{0C1489FA-EB2A-4066-BF7C046610CA958D}\regwrite.exe" "C:\Users\Admin\AppData\Local\Temp\{36071C8E-9652-40B2-AA971CBBF978F9B0}\fileassoc.ini" >NUL 2>&1
            3⤵
            • Executes dropped EXE
            PID:1808
          • C:\Users\Admin\AppData\Local\Temp\{0C1489FA-EB2A-4066-BF7C046610CA958D}\regwrite.exe
            "C:\Users\Admin\AppData\Local\Temp\{0C1489FA-EB2A-4066-BF7C046610CA958D}\regwrite.exe" "C:\Users\Admin\AppData\Local\Temp\{7C336E9E-B022-44D7-B8C094BBCF9D67A2}\fileassoc.ini" >NUL 2>&1
            3⤵
            • Executes dropped EXE
            PID:3836
          • C:\Users\Admin\AppData\Local\Temp\{0C1489FA-EB2A-4066-BF7C046610CA958D}\regwrite.exe
            "C:\Users\Admin\AppData\Local\Temp\{0C1489FA-EB2A-4066-BF7C046610CA958D}\regwrite.exe" "C:\Users\Admin\AppData\Local\Temp\{D960681F-861A-453C-B596F35786520CC1}\fileassoc.ini" >NUL 2>&1
            3⤵
            • Executes dropped EXE
            PID:3920
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding CB6378C63E6F0B39925B323FC9006D89 E Global\MSI0000
          2⤵
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2480
        • C:\Program Files\PDF-XChange\PDF Printer Standard\Drivers\PrnInstaller.exe
          "C:\Program Files\PDF-XChange\PDF Printer Standard\Drivers\\PrnInstaller.exe" /L /I_D_R_M_P /Z /N "PDF-XChange Standard"
          2⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          PID:3008
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:1956
      • C:\Program Files\PDF-XChange\Updater\PXCUpdater.exe
        "C:\Program Files\PDF-XChange\Updater\PXCUpdater.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4320

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5ad6ea.rbs
            • Path C:\Config.Msi\e5ad6ea.rbs
            • Size 337KB
            • SHA256 be14871ef15f679f5281e76d7e32826b672cbdbbb6638e60428eb0c115a81ae7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Index.rseg
            • Path C:\Program Files\Common Files\PDF-XChange\ABBYY\12.4.7.6336\Data\Index.rseg
            • Size 266B
            • SHA256 811a7c1e74e0644843c4dd53cec812318362a0131a602bea106e7ffb0df5d8af
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PXCEditor.exe
            • Path C:\Program Files\PDF-XChange\PDF Editor\PXCEditor.exe
            • Size 1.6MB
            • SHA256 c714a69ca17e31e1c564ddcaec2f520340e59411490c508a4baecba483838d00
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PrnInst.inf
            • Path C:\Program Files\PDF-XChange\PDF Printer Standard\Drivers\PrnInst.inf
            • Size 718B
            • SHA256 ac4e00324b366eaf36b25d82e25fa5ef2d5a969b3661d57446b3a0a5ca880516
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PrnInstaller.exe
            • Path C:\Program Files\PDF-XChange\PDF Printer Standard\Drivers\PrnInstaller.exe
            • Size 1.6MB
            • SHA256 5933bb8b237eaa5797a137b253ab1f1b55f1f880d4e21d81930d04355f2ad237
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Office2PDF.exe
            • Path C:\Program Files\PDF-XChange\PDF Printer Standard\Office2PDF.exe
            • Size 11.2MB
            • SHA256 f94b8914c75102c194f955746f49f645c02c02b79eaf915bc1243e289ec1bd8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PXCLicense.pdf
            • Path C:\Program Files\PDF-XChange\PDF Tools\PXCLicense.pdf
            • Size 37KB
            • SHA256 bb595269581266ccc3ed4c443876829880fbd2e143cc2d2597df47cd3f22b33f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PXCTools.exe
            • Path C:\Program Files\PDF-XChange\PDF Tools\PXCTools.exe
            • Size 8.2MB
            • SHA256 a2483c26aca01678029479c02913ddef7b1e86e5597af1aaf356d8188127931b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PDFProperties.propdesc
            • Path C:\Program Files\PDF-XChange\Shell Extensions\PDFProperties.propdesc
            • Size 7KB
            • SHA256 a09aabc953daef0f5820a94f0540e10f0ba1079513bda9a717768ac056f0dd81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI24B0.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI24B0.tmp
            • Size 1.9MB
            • SHA256 afd8bfd3c7ceb3759f7154e175a9cf2c940660f17182f5f439018998f919d3f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIa0be8.LOG
            • Path C:\Users\Admin\AppData\Local\Temp\MSIa0be8.LOG
            • Size 104KB
            • SHA256 f8fde1d20caf291e510f6d3e65d615bca8a780a5c22a4a0d07029f5f6c46dfcb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prnInstaller.log
            • Path C:\Users\Admin\AppData\Local\Temp\prnInstaller.log
            • Size 1KB
            • SHA256 7e7d72ac8d89413227a02390dded549e50984ce2d1087b3f5c8521c48654b3be
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            regwrite.exe
            • Path C:\Users\Admin\AppData\Local\Temp\{0C1489FA-EB2A-4066-BF7C046610CA958D}\regwrite.exe
            • Size 68KB
            • SHA256 c587913fef5d6511df5f3aa23475873e5ae459bae59c05657f3308d546b4ff4d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            fileassoc.ini
            • Path C:\Users\Admin\AppData\Local\Temp\{5E38F280-6CC6-4A5E-A167335D4C06305D}\fileassoc.ini
            • Size 146B
            • SHA256 ca3c823a9ddaf824263db2ae7692b2087e9c4c53ad8a617f78b692306f99c990
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            fileassoc.ini
            • Path C:\Users\Admin\AppData\Local\Temp\{D960681F-861A-453C-B596F35786520CC1}\fileassoc.ini
            • Size 201B
            • SHA256 d5067b5e3a1facb338de437950fadc039cc384143854dc2789268d9dcadc00eb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 47e22e7e065329d223834438b5f8e0de4f2c0ed4cdda6cb82544a4e0413cafe7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {8684c35f-be28-410c-aebd-1979ee49118d}_OnDiskSnapshotProp
            • Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8684c35f-be28-410c-aebd-1979ee49118d}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 21d2ff123001ce35c08d70a67103701088b1737ef9d269bd01a355075b0e0b92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download