Windows Analysis Report
PDFast.exe

Overview

General Information

Sample name: PDFast.exe
Analysis ID: 1645051
MD5: df9250db84bb91c51c01284e71705710
SHA1: 171c570f2bae325dd287efeb5a4c8dfc21fbf15d
SHA256: dd2e85178324cfc704c801aa81e758ffce7c98aec4c00649d44d82ecf383968d
Tags: exeHOTELFATAZPRIVATELIMITEDuser-SquiblydooBlog
Infos:

Detection

Score: 36
Range: 0 - 100
Confidence: 60%

Signatures

Multi AV Scanner detection for submitted file
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: PDFast.exe Virustotal: Detection: 51% Perma Link
Source: PDFast.exe ReversingLabs: Detection: 33%
Source: PDFast.exe Static PE information: certificate valid
Source: PDFast.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mscorlib.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.Core.pdbL0'w# source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.ni.pdbRSDS source: WER5F93.tmp.dmp.3.dr
Source: Binary string: mscorlib.ni.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: D:\a\pdf-ize-software\pdf-ize-software\PDFast\obj\Release\PDFast.pdb source: PDFast.exe
Source: Binary string: System.pdb4 source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.Core.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: C:\Windows\SYSTEM32\CRYPTBASE.dlldll\PDFast\obj\Release\PDFast.pdb source: PDFast.exe, 00000000.00000002.1349269710.00000000017E3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER5F93.tmp.dmp.3.dr
Source: Binary string: PDFast.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.ni.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.Core.ni.pdb source: WER5F93.tmp.dmp.3.dr
Source: PDFast.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PDFast.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PDFast.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PDFast.exe String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: PDFast.exe String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: PDFast.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PDFast.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PDFast.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PDFast.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: PDFast.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: PDFast.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: PDFast.exe String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: PDFast.exe String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: PDFast.exe String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: PDFast.exe String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Amcache.hve.3.dr String found in binary or memory: http://upx.sf.net
Source: PDFast.exe String found in binary or memory: http://www.google.com1PDF.Properties.Resources
Source: PDFast.exe String found in binary or memory: http://www.marksimonson.comProxima
Source: PDFast.exe String found in binary or memory: https://www.globalsign.com/repository/0
One or more processes crash
Source: C:\Users\user\Desktop\PDFast.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8888 -s 904
Sample file is different than original file name gathered from version info
Source: PDFast.exe, 00000000.00000002.1349269710.00000000017AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PDFast.exe
Source: PDFast.exe, InstallerClass.cs Task registration methods: 'CreateScheduleUpdaterTask'
Source: PDFast.exe, JREDownload.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: PDFast.exe, JREDownload.cs Security API names: System.IO.DirectoryInfo.GetAccessControl()
Source: PDFast.exe, JREDownload.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: PDFast.exe, InstallerClass.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: sus36.winEXE@2/5@0/0
Source: C:\Users\user\Desktop\PDFast.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8888
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\7343f83d-d77c-4686-98da-16d17cd36e01 Jump to behavior
Source: PDFast.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PDFast.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\PDFast.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PDFast.exe Virustotal: Detection: 51%
Source: PDFast.exe ReversingLabs: Detection: 33%
Source: C:\Users\user\Desktop\PDFast.exe File read: C:\Users\user\Desktop\PDFast.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PDFast.exe "C:\Users\user\Desktop\PDFast.exe"
Source: C:\Users\user\Desktop\PDFast.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8888 -s 904
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: PDFast.exe Static PE information: certificate valid
Source: PDFast.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PDFast.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: PDFast.exe Static file information: File size 2990488 > 1048576
Source: PDFast.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x294c00
Source: PDFast.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: PDFast.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mscorlib.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.Core.pdbL0'w# source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.ni.pdbRSDS source: WER5F93.tmp.dmp.3.dr
Source: Binary string: mscorlib.ni.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: D:\a\pdf-ize-software\pdf-ize-software\PDFast\obj\Release\PDFast.pdb source: PDFast.exe
Source: Binary string: System.pdb4 source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.Core.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: C:\Windows\SYSTEM32\CRYPTBASE.dlldll\PDFast\obj\Release\PDFast.pdb source: PDFast.exe, 00000000.00000002.1349269710.00000000017E3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER5F93.tmp.dmp.3.dr
Source: Binary string: PDFast.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.ni.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.pdb source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER5F93.tmp.dmp.3.dr
Source: Binary string: System.Core.ni.pdb source: WER5F93.tmp.dmp.3.dr
Binary contains a suspicious time stamp
Source: PDFast.exe Static PE information: 0xC4BD2F4C [Sun Aug 5 22:12:28 2074 UTC]
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\PDFast.exe Memory allocated: 16D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Memory allocated: 33C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Memory allocated: 53C0000 memory reserve | memory write watch Jump to behavior
Source: Amcache.hve.3.dr Binary or memory string: VMware
Source: Amcache.hve.3.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr Binary or memory string: VMware Virtual RAMX
Source: Amcache.hve.3.dr Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr Binary or memory string: VMware-42 27 d9 2e dc 89 72 dd-92 e8 86 9f a5 a6 64 93
Source: Amcache.hve.3.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.24224532.B64.2408191502,BiosReleaseDate:08/19/2024,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\PDFast.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PDFast.exe Queries volume information: C:\Users\user\Desktop\PDFast.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PDFast.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.3.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr Binary or memory string: MsMpEng.exe
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1645051 Sample: PDFast.exe Startdate: 21/03/2025 Architecture: WINDOWS Score: 36 13 Multi AV Scanner detection for submitted file 2->13 6 PDFast.exe 2->6         started        process3 process4 8 WerFault.exe 22 16 6->8         started        file5 11 C:\ProgramData\Microsoft\...\Report.wer, Unicode 8->11 dropped
⊘No contacted IP infos