Overview
overview
7Static
static
5PDF-XChang...4).zip
windows10-2004-x64
1PDF-XChang...4).zip
windows11-ltsc_2024-x64
1PDF-XChang...64.dll
windows10-2004-x64
7PDF-XChang...64.dll
windows10-2004-x64
7PDF-XChang...er.exe
windows10-2004-x64
1PDF-XChang...rL.exe
windows10-2004-x64
1PDF-XChang...86.exe
windows10-2004-x64
3PDF-XChang...er.exe
windows10-2004-x64
3PDF-XChang...rL.exe
windows10-2004-x64
3PDF-XChang...64.msi
windows10-2004-x64
7PDF-XChang...64.msi
windows11-ltsc_2024-x64
7Analysis
- max time kernel
149s - max time network
188s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 10:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PDF-XChange Pro 11.0.1 (x64).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
PDF-XChange Pro 11.0.1 (x64).zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/enhanced/PXCEditorCore.x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/golden/PXCEditorCore.x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x64/pdfSaver.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x64/pdfSaverL.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x86/HtmlToPdf2App.x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x86/pdfSaver.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x86/pdfSaverL.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
PDF-XChange Pro 11.0.1 (x64)/Setup/ProV11.x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral11
Sample
PDF-XChange Pro 11.0.1 (x64)/Setup/ProV11.x64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target PDF-XChange Pro 11.0.1 (x64)/Crack/enhanced/PXCEditorCore.x64.dll
- Size 70.3MB
- Sample260730-mx4tmagb59
- SHA256 e4ef950abd9c1f4bcce88999f88d79d77fe13b9f1ed8edb03a479a57369d6d68
- MD5 1640d42ccf911a3c16a53e6b19df813c
- SHA1 cadbfa8c8e0f2a6a91499a2b88fcff8044303fd4
- SHA512 d07291c2cfe5f7c94b5ec66a2de72d983f7f7f1716765c924b31931c3b44928f1d166b4281d193dc021ac938eb42a39a1d77af6e246c0b0f882984adfc2270df
- SSDEEP 393216:Be/emeSUFM2pq+Vxcv6k+VmkPWjlfeg8ekUZsSYdLCCq/m0FZT0mLJ+VcsPGZ8tE:1TEc9CvFfOc3OtfG9qjY
- TLSH T1AEF77C47B1B541D8D06AD0788A6BA917EBB13C46072096DF159069E67F23FF0AE7E330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst\CLSID\ = "{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\ProgID\ = "PDFXEdit.PXV_Inst.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\ = "PDF-XChange Editor ActiveX Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst.1\CLSID\ = "{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control.1\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\VersionIndependentProgID\ = "PDFXEdit.PXV_Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\AppID = "{6D23F38C-5DD0-43B7-9775-8B4C8A3DCDA8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\ProgID\ = "PDFXEdit.PXV_Control.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\AppID = "{6D23F38C-5DD0-43B7-9775-8B4C8A3DCDA8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6D23F38C-5DD0-43B7-9775-8B4C8A3DCDA8}\ = "PDFXEdit" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst.1\ = "PDF-XChange Editor ActiveX Instance" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PDF-XChange Pro 11.0.1 (x64)\\Crack\\enhanced\\PXCEditorCore.x64.dll, 128" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PDF-XChange Pro 11.0.1 (x64)\\Crack\\enhanced\\PXCEditorCore.x64.dll, 128" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PXCEditorCore.x64.dll\AppID = "{6D23F38C-5DD0-43B7-9775-8B4C8A3DCDA8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\ = "PDF-XChange Editor ActiveX Instance" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\VersionIndependentProgID\ = "PDFXEdit.PXV_Inst" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control\CLSID\ = "{A1149909-4EDC-4421-B9E5-E93C25A000A1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control.1\Insertable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PDF-XChange Pro 11.0.1 (x64)\\Crack\\enhanced\\PXCEditorCore.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control\ = "PDF-XChange Editor ActiveX Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control.1\ = "PDF-XChange Editor ActiveX Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\DefaultIcon regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6D23F38C-5DD0-43B7-9775-8B4C8A3DCDA8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control.1\DefaultIcon regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\Insertable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PXCEditorCore.x64.dll regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control.1\CLSID\ = "{A1149909-4EDC-4421-B9E5-E93C25A000A1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst\CurVer\ = "PDFXEdit.PXV_Inst.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control\CurVer\ = "PDFXEdit.PXV_Control.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst\ = "PDF-XChange Editor ActiveX Instance" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\MiscStatus\1\ = "131473" regsvr32.exe