ANYPDF, GREENBLOOD, and DYNOWIPER — ANY.RUN Threat Brief

TL;DR

ANYPDF: Highly obfuscated trojan disguised as a PDF viewer, distributed via signed MSI installers.
GREENBLOOD: Ransomware written in Go with data-theft capabilities.
DYNOWIPER: Wiper that completely destroys data by overwriting files with pseudorandom bytes, deletes shadow copies, and reboots the system.

1) ANYPDF (Windows)

Sample: ANY.RUN

ANYPDF is a highly obfuscated trojan disguised as a legitimate PDF viewer. It spreads through phishing campaigns and targeted attacks. Its primary goal is to steal credentials and intercept sensitive information from browsers and other applications. It is distributed via MSI installers signed with a digital certificate. It uses encryption modules and hidden loading of additional payloads, operating mostly in memory. It establishes persistence through the registry, autorun, and WMI scripts.

How to detect: Monitor cmd.exe executions containing the string ANYPDF and the URL https[:]//peedeef.com/openup/uptime/default, as well as the presence of mutexes FirefoxSurf or FirefoxSurfAutoUpdater.

Key facts:

DLL Side-Loading via trusted processes.
Selective Data Exfiltration with encryption of sensitive data.
Mutex Creation to prevent reinfection.
Obfuscated Payload and C2 Communication Obfuscation over HTTP/HTTPS.

Analytical note:

Detected	External sources	ANY.RUN Last Submission	Sandbox Evasion
2026-01-28	News	2026-02-03	24

Using the following TI Lookup query, you can search recent public sandbox analyses and identify ANYPDF activity.

TI Lookup: syncObjectName:"FirefoxSurf" OR syncObjectName:"FirefoxSurfAutoUpdater" OR commandLine:"ANYPDF https://peedeef.com/openup/uptime/default"

IOCs:

SHA256: ea09fb40963340b212833e796f229ff52e80c66c4354fbe1107cecc07d3c988a
SHA256: ad8322170e39cb1ace157e0bb0bbffd71cf7e11f602c29f273109acc7329b579
SHA256: 3e4c6a39e2302ee42a1d51ce6093d8325839581ff8b4ad77ce12d2e9326fc839
SHA256: 614104efb1c80099594f09c788b9ea5e03b65fa0405d60863baaa4b9dae20935
Domain: ANYPDF.com
Domain: anyprx.com
Domain: peedeef.com

MITRE:

Technique ID	Technique Name	Evidence
T1562.004	Impair Defenses: Disable or Modify System Firewall	Commands to disable/modify Windows Firewall to allow C2 traffic.
T1574.002	Hijack Execution Flow: DLL Side-Loading	Loading of malicious DLL via trusted processes.
T1027	Obfuscated Files or Information	Encryption and obfuscation of components, decrypted only at runtime.
T1056.001	Input Capture: Keylogging	Built-in keylogger for capturing passwords and other information.
T1071.001	Application Layer Protocol: Web Protocols	HTTP/HTTPS for hidden data transmission to C2.
T1105	Ingress Tool Transfer	Download of additional components via HTTP.
T1555.003	Steal Credentials from Web Browsers	Theft of passwords and session data from browsers.
T1204.002	User Execution: Malicious File	Distribution via fake MSI/EXE installers.
T1497.001	Virtualization/Sandbox Evasion: System Checks	Environment checks for signs of virtualization.
T1543.003	Create or Modify System Process: Windows Service	Installation of the malicious process as a Windows service.

2) GREENBLOOD (Windows/Go)

Sample: ANY.RUN

GREENBLOOD is ransomware that has its own leak site. It targets organizations in multiple countries. Written in Go, it has data-theft capabilities for subsequent extortion.

How to detect: Monitor anomalous file and command-line activity containing the string greenblood.

Key facts:

Ransomware + data-stealing capabilities.
Written in Go.
Own leak site.

Analytical note:

Detected	External sources	ANY.RUN Last Submission	Sandbox Evasion
2026-02-02	News	2026-02-03	0

Using the following TI Lookup query, you can search recent public sandbox analyses and identify GREENBLOOD activity.

TI Lookup: commandLine:"greenblood"

IOCs:

SHA256: 12bba7161d07efcb1b14d30054901ac9ffe5202972437b0c47c88d71e45c7176
SHA256: 5d234c382e0d8916bccbc5f50c8759e0fa62ac6740ae00f4923d4f2c03967d7a

MITRE:

Technique ID	Technique Name	Evidence
T1486	Data Encrypted for Impact	Encrypts files
T1047	Windows Management Instrumentation	Accesses WMI to obtain product unique identifier
T1059	Command and Scripting Interpreter: Windows Command Shell	Launches CMD.EXE for command execution
T1082	System Information Discovery	Collects system information
T1012	Query Registry	Reads various registry keys
T1518	Software Discovery: Security Software Discovery	Detects installed security software

3) DYNOWIPER (Windows)

Sample: ANY.RUN

DYNOWIPER is a wiper designed for complete data destruction on infected systems. It overwrites files with pseudorandom data, making recovery practically impossible. It traverses all fixed and removable drives, deletes shadow copies, and reboots the system.

How to detect: Triggering of the DYNOWIPER YARA rule (characteristic random-number-generator signatures and system directory exclusion strings).

Key facts:

Mass overwriting of files on all drives.
16-byte buffer, partial overwriting of large files, complete destruction of small files.

Analytical note:

Detected	External sources	ANY.RUN Last Submission	Sandbox Evasion
2026-01-30	TI	2026-02-03	10

Yara

rule DynoWiper
{
    meta:
        date = "2026-02-01"
        author = "ANY.RUN"
        threat = "dynowiper"
        tags = "dynowiper, wiper"
        sample = "https://app.any.run/tasks/0a8c15ef-adc3-42b2-89b3-d11e81afe3f8/"
        
    strings:
        $random_gen_lcg = { 69 c1 65 89 07 6c 03 c2 42 89 47 fc 81 fa 70 02 00 00 7c e2 }
        /*
           Random Number Generator (LCG)
           
           imul   ecx,ecx,0x6c078965   ; Multiply by magic number
           add    eax,edx               ; Add to previous value
           mov    [edi-0x4],eax         ; Save random byte
           cmp    edx,0x270            ; Check if 624 bytes done
           jl     <loop>               ; Continue if not finished
           
           Creates random data using math (0x6c078965 = MS C library constant).
           Generates 624 bytes at a time to overwrite and destroy files.
        */
        
        $random_tempering = { c1 e8 0b 23 86 ?? ?? 00 00 33 c8 8b c1 25 ad 58 3a ff c1 e0 07 }
        /*
           Random Quality Improvement (Mersenne Twister)
           
           shr    eax,0xb              ; Shift right 11 bits
           and    eax,[esi+offset]     ; Apply mask
           xor    ecx,eax               ; Mix with XOR
           mov    eax,ecx               ; Copy result
           and    eax,0xff3a58ad        ; Apply second mask
           shl    eax,0x7               ; Shift left 7 bits
           
           Makes random data better quality using bit operations.
           Wiped files become harder to recover because data looks truly random.
        */
        
        $s1 = "$recycle.bin" fullword wide
        $s2 = "program files(x86)" fullword wide
        $s3 = "perflogs" fullword wide
        $s4 = "windows" fullword wide
        $s5 = "Error opening file: " fullword wide
        
    condition:
        uint16(0) == 0x5A4D
        and any of ($random*) and all of ($s*)
}

MITRE:

Technique ID	Technique Name	Evidence
T1485	Data Destruction	Overwrites file contents with random data
T1490	Inhibit System Recovery	Deletes shadow copies and restore points
T1083	File and Directory Discovery	Enumerates files and directories on all available drives
T1106	Native API	Uses Windows API for direct file and disk operations
T1070.004	File Deletion	After overwriting, files remain corrupted or are deleted
T1529	System Shutdown/Reboot	Initiates system reboot after completing destructive actions

Conclusion

1) ANYPDF leaves clear artifacts in the form of specific mutexes FirefoxSurf/FirefoxSurfAutoUpdater and a command line containing the peedeef.com domain — a reliable indicator of presence despite DLL side-loading and obfuscation.

2) GREENBLOOD uses an easily detectable command line with the substring greenblood and leaves characteristic IOCs in the form of two known hashes — sufficient for quick searching in sandboxes and logs.

3) DYNOWIPER reveals itself through characteristic random-data generation algorithms (LCG + Mersenne Twister tempering) and system directory exclusion strings — the YARA rule allows reliable detection of the wiper.