Overview
overview
7Static
static
5PDF-XChang...4).zip
windows10-2004-x64
1PDF-XChang...4).zip
windows11-ltsc_2024-x64
1PDF-XChang...64.dll
windows10-2004-x64
7PDF-XChang...64.dll
windows10-2004-x64
7PDF-XChang...er.exe
windows10-2004-x64
1PDF-XChang...rL.exe
windows10-2004-x64
1PDF-XChang...86.exe
windows10-2004-x64
3PDF-XChang...er.exe
windows10-2004-x64
3PDF-XChang...rL.exe
windows10-2004-x64
3PDF-XChang...64.msi
windows10-2004-x64
7PDF-XChang...64.msi
windows11-ltsc_2024-x64
7Analysis
- max time kernel
149s - max time network
186s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 10:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PDF-XChange Pro 11.0.1 (x64).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
PDF-XChange Pro 11.0.1 (x64).zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/enhanced/PXCEditorCore.x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/golden/PXCEditorCore.x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x64/pdfSaver.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x64/pdfSaverL.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x86/HtmlToPdf2App.x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x86/pdfSaver.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
PDF-XChange Pro 11.0.1 (x64)/Crack/x86/pdfSaverL.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
PDF-XChange Pro 11.0.1 (x64)/Setup/ProV11.x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral11
Sample
PDF-XChange Pro 11.0.1 (x64)/Setup/ProV11.x64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target PDF-XChange Pro 11.0.1 (x64)/Crack/golden/PXCEditorCore.x64.dll
- Size 71.3MB
- Sample260730-mx4tmagb59
- SHA256 a095e9a0161652dd9285ba5f404a37c65a5fb2ff2751523cfa66ed00cce2e5b9
- MD5 0348d6f8f7fed18a916fea8e31d568cd
- SHA1 9cca3f15cb5b485a2a8dc2205ccf83f54a4d394f
- SHA512 4ee33e8ac4c52da3f5a26679f77cfdb914280acadf4f16e8ed42be17de895735857669bceea5dd93658b8f575a4df73638f512fab43aa184ca455a56f6db4458
- SSDEEP 393216:ee/emeSUFM2pq+Vxcv6k+VmkPWjlfeg8ekUZsSYdLCCq/m0FZT0mLJ+VcsPGZ8t1:MTEc9CvFfOc3OtfG9qjh
- TLSH T10BF77B47B1B541D8D06AD0788A6BAA17EBB13C46072096DF159059EA7F23FF06E7E330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1149909-4EDC-4421-B9E5-E93C25A000A1}\ = "PDF-XChange Editor ActiveX Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63375FB3-4F89-42F0-8090-209E954EBA1A}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D513F74-9FC7-4179-A268-92E62D4F03A7}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F007E7B-4910-40F1-9CD8-D012AC81B89D}\ = "IUIX_PulsingSpot" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A527388D-E382-4227-BDAA-D8278C7B1924}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{701DB470-B5AE-441C-B0DD-30EB08295310}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F25D53D5-5F88-4FDD-BB3F-88EFC7E7C2CE}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B55EFD3A-7639-45F0-A33E-12971B7DAAB7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{973BF60B-4CC6-4be0-B408-3D80E07FC2E6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Control.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{816CDC47-C3A9-4671-A17C-790D90CD38E5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{954F5C0B-D5DF-417F-BD09-60F5F7554CA0}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF68A980-B679-48CF-ADF3-951AD4BD343B}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41B1AADD-61EE-406C-A8C6-FC02BA66CA67}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79A56420-B280-448E-B2DC-9ECF68F82A34}\ = "IUIX_Layout" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3E2C472-5A54-4169-98DE-CED5FEDB39F2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F5231AB-AF92-4184-A361-5A3307A3464E}\ = "IAUX_Inst" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFE955F3-4ADE-4C79-B40A-8DD1955A328F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7561F214-CA2F-42C9-8F44-1110FCDA066D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237F6B6F-DAB7-4230-B2E9-49D5C6AB9243}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CCBAA52-8111-4806-B7EA-E0672F8382CD}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78874680-AE90-4F97-8236-5016AFFE6569} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB8E43A8-D47B-4C41-B39D-52DD8D17E77C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A31C9941-4A55-43F6-87BC-0738234B5CAB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{003C8BB8-63EB-4C7C-890A-B9704E02AB2A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7AE52AAD-8807-46DA-8EF6-C20E2E8AEF2D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7AE52AAD-8807-46DA-8EF6-C20E2E8AEF2D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3E2C472-5A54-4169-98DE-CED5FEDB39F2}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A48F242-109E-4BB0-BE84-A4B5A461CCDF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F114962-0BD3-46E4-9128-B8AE21D8BA5D}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F6F8356-1AB8-40AD-81E4-E1E3E71B4BCD}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09CAC0A6-B45E-4427-B5FD-55409587447E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C5CE95F-3FC4-4FE8-8159-21D550451AF8}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75751C77-316F-447E-BA46-79F098261F6E}\ = "IPXC_AnnotsList" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B539001-204C-4960-9AE6-9246D044961F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F114962-0BD3-46E4-9128-B8AE21D8BA5D}\ = "IPXV_DocViewsList" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{947ABC06-166A-4026-B1BC-FA2159F75D53}\ = "IPXV_MeasureUnitsCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{553CF597-98AA-41A3-B2F0-9C6101A6DFA6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EB96FB4-C2A5-43B6-BC92-7E1AEA8D9E88}\ = "IPXC_PDSElementList" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{081DC047-58D5-42E2-B263-2477CE37D502}\ = "IUIX_CmdRibbonTab" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3E2C472-5A54-4169-98DE-CED5FEDB39F2}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31BA7C6D-BDC2-46A3-AFDB-B49835E96E00}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A9134A9-20F7-4D8D-806D-8DEFDF70029F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2AC35BF5-05D2-4612-8B13-208CD612E587} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1CD8E0DB-0C08-4797-A518-34BDF033D11F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9764FFB4-99C8-4FE5-BF07-225580214F60}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7AE52AAD-8807-46DA-8EF6-C20E2E8AEF2D}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B27E7FF-6279-49DA-AE6B-8E13AD665B1F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3116D512-3C69-454E-9040-8EE1652886C8}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF68A980-B679-48CF-ADF3-951AD4BD343B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84B23B1A-25E5-46A4-90ED-E4C8B678F535}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40294E36-4581-49A9-9DA5-61B829DCEA7C}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{999A6C12-A602-4601-9866-0B9AE973B7F2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A48F242-109E-4BB0-BE84-A4B5A461CCDF}\TypeLib\ = "{0AAFF38C-CB91-4424-A8B9-F8B504ACBE0C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F6C77B-0FFF-43F5-8DE3-0715163D80DD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45BF8A5F-296C-44D4-9DB4-E04F04EF501B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6554EA2D-9436-4F25-8B11-A4CB7C2608DB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{443882E6-D69C-4E94-A9A6-F2D6D856CC16} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BD7FAFAA-9748-4CFC-B134-D3B2CA96B4F8}\ = "IUIX_Edit" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EBB31E2-2E6A-4463-B53B-EA7C502D564D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78874680-AE90-4F97-8236-5016AFFE6569}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0265291-1DFC-4377-B60D-7AE9CA536A73} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A910682A-8EC3-4AAA-8A6F-31952F527B06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFXEdit.PXV_Inst.1\CLSID\ = "{973BF60B-4CC6-4be0-B408-3D80E07FC2E6}" regsvr32.exe