File name: | 02322509 |
Full analysis: | https://app.any.run/tasks/b6443478-ba00-40c9-a6b3-5bfe9a6482d5 |
Verdict: | Malicious activity |
Analysis date: | November 30, 2020, 05:37:54 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | FD69BBCA61BAF72A7AE1EE02B442FE78 |
SHA1: | FEFC4A3D904BC16409A6C6DDC9246BB0A5B23A60 |
SHA256: | 00861C357925FF0EE2B67788214402EAD3D6AEC5E542E5F532D6657849E4E365 |
SSDEEP: | 393216:3gaR/jij5SDKZM8QoQA+R5l0s3E0Lp5RwKJ5hjYSX:LFjij5g8OhR3znRwKFYSX |
.exe | | | Win64 Executable (generic) (76.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (12.4) |
.exe | | | Generic Win/DOS Executable (5.5) |
.exe | | | DOS Executable Generic (5.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2017:06:20 06:00:06+02:00 |
PEType: | PE32 |
LinkerVersion: | 14 |
CodeSize: | 336384 |
InitializedDataSize: | 549888 |
UninitializedDataSize: | - |
EntryPoint: | 0x2c230 |
OSVersion: | 5.1 |
ImageVersion: | - |
SubsystemVersion: | 5.1 |
Subsystem: | Windows GUI |
FileVersionNumber: | 6.22.0.0 |
ProductVersionNumber: | 6.22.0.0 |
FileFlagsMask: | 0x003f |
FileFlags: | Private build, Special build |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | Neutral |
CharacterSet: | Unicode |
Comments: | Self Extractable Archive by EXEpress Copyright (C) Web Technology Corp. http://www.webtech.co.jp/ |
FileDescription: | Self Extractable Archive |
FileVersion: | 6.22.0.0 |
InternalName: | EPSFX |
OriginalFileName: | EPSFX.EXE |
ProductVersion: | 6.22.0.0 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 20-Jun-2017 04:00:06 |
Detected languages: |
|
Debug artifacts: |
|
Comments: | Self Extractable Archive by EXEpress Copyright (C) Web Technology Corp. http://www.webtech.co.jp/ |
FileDescription: | 自己解凍実行ファイル |
FileVersion: | 6.22.0.0 |
InternalName: | EPSFX |
OriginalFilename: | EPSFX.EXE |
ProductVersion: | 6.22.0.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000128 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 7 |
Time date stamp: | 20-Jun-2017 04:00:06 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000520D3 | 0x00052200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.54794 |
.rdata | 0x00054000 | 0x00016010 | 0x00016200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.10091 |
.data | 0x0006B000 | 0x0003F408 | 0x00001C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.7349 |
.gfids | 0x000AB000 | 0x0000018C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.32731 |
.tls | 0x000AC000 | 0x00000009 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 0x000AD000 | 0x0002B260 | 0x0002B400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.31117 |
.reloc | 0x000D9000 | 0x00005294 | 0x00005400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.66211 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.18235 | 2114 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 5.27782 | 1592 | UNKNOWN | Japanese - Japan | RT_STRING |
3 | 5.33495 | 1694 | UNKNOWN | Japanese - Japan | RT_STRING |
4 | 5.31835 | 1038 | UNKNOWN | Japanese - Japan | RT_STRING |
5 | 4.67675 | 412 | UNKNOWN | Japanese - Japan | RT_STRING |
6 | 4.89732 | 9640 | UNKNOWN | UNKNOWN | RT_ICON |
7 | 5.3046 | 4264 | UNKNOWN | UNKNOWN | RT_ICON |
101 | 4.35811 | 444 | UNKNOWN | Japanese - Japan | RT_DIALOG |
102 | 2.79015 | 436 | UNKNOWN | Japanese - Japan | RT_DIALOG |
104 | 3.92404 | 310 | UNKNOWN | Japanese - Japan | RT_DIALOG |
KERNEL32.dll |
USER32.dll (delay-loaded) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2840 | "C:\Users\admin\AppData\Local\Temp\02322509.exe" | C:\Users\admin\AppData\Local\Temp\02322509.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Description: Self Extractable Archive Exit code: 3221226540 Version: 6.22.0.0 | ||||
1880 | "C:\Users\admin\AppData\Local\Temp\02322509.exe" | C:\Users\admin\AppData\Local\Temp\02322509.exe | explorer.exe | |
User: admin Integrity Level: HIGH Description: Self Extractable Archive Exit code: 0 Version: 6.22.0.0 |
(PID) Process: | (1880) 02322509.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (1880) 02322509.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 |
Operation: | write | Name: | Blob |
Value: 040000000100000010000000CB17E431673EE209FE455793F30AFA1C0F0000000100000014000000E91E1E972B8F467AB4E0598FA92285387DEE94C90300000001000000140000004EB6D578499B1CCF5F581EAD56BE3D9B6744A5E57E00000001000000080000000040D0D1B0FFD4017F000000010000000C000000300A06082B060105050703011D0000000100000010000000C6CBCAFA17955C4CFD41ECA0C654C3610B000000010000001200000056006500720069005300690067006E0000001400000001000000140000007FD365A7C2DDECBBF03009F34339FA02AF3331336200000001000000200000009ACFAB7E43C8D880D06B262A94DEEEE4B4659989C3D0CAF19BAF6405E41AB7DF09000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000004600000030443021060B6086480186F8450107170630123010060A2B0601040182373C0101030200C0301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0190000000100000010000000D8B5FB368468620275D142FFD2AADE372000000001000000D7040000308204D3308203BBA003020102021018DAD19E267DE8BB4A2158CDCC6B3B4A300D06092A864886F70D01010505003081CA310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E311F301D060355040B1316566572695369676E205472757374204E6574776F726B313A3038060355040B1331286329203230303620566572695369676E2C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79314530430603550403133C566572695369676E20436C6173732033205075626C6963205072696D6172792043657274696669636174696F6E20417574686F72697479202D204735301E170D3036313130383030303030305A170D3336303731363233353935395A3081CA310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E311F301D060355040B1316566572695369676E205472757374204E6574776F726B313A3038060355040B1331286329203230303620566572695369676E2C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79314530430603550403133C566572695369676E20436C6173732033205075626C6963205072696D6172792043657274696669636174696F6E20417574686F72697479202D20473530820122300D06092A864886F70D01010105000382010F003082010A0282010100AF240808297A359E600CAAE74B3B4EDC7CBC3C451CBB2BE0FE2902F95708A364851527F5F1ADC831895D22E82AAAA642B38FF8B955B7B1B74BB3FE8F7E0757ECEF43DB66621561CF600DA4D8DEF8E0C362083D5413EB49CA59548526E52B8F1B9FEBF5A191C23349D843636A524BD28FE870514DD189697BC770F6B3DC1274DB7B5D4B56D396BF1577A1B0F4A225F2AF1C926718E5F40604EF90B9E400E4DD3AB519FF02BAF43CEEE08BEB378BECF4D7ACF2F6F03DAFDD759133191D1C40CB7424192193D914FEAC2A52C78FD50449E48D6347883C6983CBFE47BD2B7E4FC595AE0E9DD4D143C06773E314087EE53F9F73B8330ACF5D3F3487968AEE53E825150203010001A381B23081AF300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106306D06082B0601050507010C0461305FA15DA05B3059305730551609696D6167652F6769663021301F300706052B0E03021A04148FE5D31A86AC8D8E6BC3CF806AD448182C7B192E30251623687474703A2F2F6C6F676F2E766572697369676E2E636F6D2F76736C6F676F2E676966301D0603551D0E041604147FD365A7C2DDECBBF03009F34339FA02AF333133300D06092A864886F70D0101050500038201010093244A305F62CFD81A982F3DEADC992DBD77F6A5792238ECC4A7A07812AD620E457064C5E797662D98097E5FAFD6CC2865F201AA081A47DEF9F97C925A0869200DD93E6D6E3C0D6ED8E606914018B9F8C1EDDFDB41AAE09620C9CD64153881C994EEA284290B136F8EDB0CDD2502DBA48B1944D2417A05694A584F60CA7E826A0B02AA251739B5DB7FE784652A958ABD86DE5E8116832D10CCDEFDA8822A6D281F0D0BC4E5E71A2619E1F4116F10B595FCE7420532DBCE9D515E28B69E85D35BEFA57D4540728EB70E6B0E06FB33354871B89D278BC4655F0D86769C447AF6955CF65D320833A454B6183F685CF2424A853854835FD1E82CF2AC11D6A8ED636A | |||
(PID) Process: | (1880) 02322509.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 |
Operation: | write | Name: | Blob |
Value: 04000000010000001000000087CE0B7B2A0E4900E158719B37A893720F00000001000000140000006DCA5BD00DCF1C0F327059D374B29CA6E3C50AA60300000001000000140000000563B8630D62D75ABBC8AB1E4BDFB5A899B24D431D00000001000000100000004F5F106930398D09107B40C3C7CA8F1C0B000000010000001200000044006900670069004300650072007400000014000000010000001400000045EBA2AFF492CB82312D518BA7A7219DF36DC80F6200000001000000200000003E9099B5015E8F486C00BCEA9D111EE721FABA355A89BCF1DF69561E3DC6325C5300000001000000230000003021301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0090000000100000034000000303206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B06010505070308190000000100000010000000749966CECC95C1874194CA7203F9B6202000000001000000BB030000308203B73082029FA00302010202100CE7E0E517D846FE8FE560FC1BF03039300D06092A864886F70D01010505003065310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D312430220603550403131B4469676943657274204173737572656420494420526F6F74204341301E170D3036313131303030303030305A170D3331313131303030303030305A3065310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D312430220603550403131B4469676943657274204173737572656420494420526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100AD0E15CEE443805CB187F3B760F97112A5AEDC269488AAF4CEF520392858600CF880DAA9159532613CB5B128848A8ADC9F0A0C83177A8F90AC8AE779535C31842AF60F98323676CCDEDD3CA8A2EF6AFB21F25261DF9F20D71FE2B1D9FE1864D2125B5FF9581835BC47CDA136F96B7FD4B0383EC11BC38C33D9D82F18FE280FB3A783D6C36E44C061359616FE599C8B766DD7F1A24B0D2BFF0B72DA9E60D08E9035C678558720A1CFE56D0AC8497C3198336C22E987D0325AA2BA138211ED39179D993A72A1E6FAA4D9D5173175AE857D22AE3F014686F62879C8B1DAE45717C47E1C0EB0B492A656B3BDB297EDAAA7F0B7C5A83F9516D0FFA196EB085F18774F0203010001A3633061300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E0416041445EBA2AFF492CB82312D518BA7A7219DF36DC80F301F0603551D2304183016801445EBA2AFF492CB82312D518BA7A7219DF36DC80F300D06092A864886F70D01010505000382010100A20EBCDFE2EDF0E372737A6494BFF77266D832E4427562AE87EBF2D5D9DE56B39FCCCE1428B90D97605C124C58E4D33D834945589735691AA847EA56C679AB12D8678184DF7F093C94E6B8262C20BD3DB32889F75FFF22E297841FE965EF87E0DFC16749B35DEBB2092AEB26ED78BE7D3F2BF3B726356D5F8901B6495B9F01059BAB3D25C1CCB67FC2F16F86C6FA6468EB812D94EB42B7FA8C1EDD62F1BE5067B76CBDF3F11F6B0C3607167F377CA95B6D7AF112466083D72704BE4BCE97BEC3672A6811DF80E70C3366BF130D146EF37F1F63101EFA8D1B256D6C8FA5B76101B1D2A326A110719DADE2C3F9C39951B72B0708CE2EE650B2A7FA0A452FA2F0F2 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\HNP17S_JP\hlp\manual\jp\HTML\common\img\_print.gif | image | |
MD5:BB332A61AF4002C7814F2672C0C813F5 | SHA256:654E34FEF7295C72A0B3EAF104B715A696C00383C6F806AA9413A8CD79C6969C | |||
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\autorun4.exe | executable | |
MD5:DB712CA8F79DA790D9EB60A6F9EE0597 | SHA256:E67D366B0870F940F3C0D0EF4BF6FCF44809A01735AAD9D3566C2EA0A527AB27 | |||
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\HNP17S_JP\hlp\manual\jp\HTML\common\img\_HideOptions.gif | image | |
MD5:6E8CB0489FD3FFBD18C6C11B8C32F32D | SHA256:31C3FB5B324023EA843BD96EA8C1FEC0D1D2D862F28CB657BD2E5E867A18ACC9 | |||
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\HNP17S_JP\hlp\manual\jp\HTML\common\img\mnode.gif | image | |
MD5:6318FE288FE653A242184AE6DC7C3FD5 | SHA256:91AFDE536F7C1C03F9DDD462686BF009BA6F0A147BC0CE5964587F43C9EF567A | |||
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\autorun.inf | inf | |
MD5:FBE77B150F4E021601275B941CF43C01 | SHA256:8B14B199727FD80D1C11F4455E3A6E02A3C21245E7A0B14F9498802CA2DF08F9 | |||
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\HNP17S_JP\hlp\manual\jp\HTML\common\img\_help.gif | image | |
MD5:70A50583B3A90437C8148C6663C1B4E2 | SHA256:B0B435BDADAFC50A0FACE02AA516025C8C6E575538A96E5D28CF71F587B17895 | |||
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\HNP17S_JP\hlp\manual\jp\HTML\BB-HNP17_OI.htm | html | |
MD5:7BF8EAFF696C7AEA426144119B391B16 | SHA256:984319E5D1E02A5A4E6AA5069F9B2832BA74675725B8E67713C5D6FC3474D397 | |||
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\autorun.ico | image | |
MD5:DE5A55509822712C7057D3AD6DA09D45 | SHA256:074470963C1635E3EE0A89DE287FB9FDD5C84B9E27E0830D176551431A5339FA | |||
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\HNP17S_JP\hlp\manual\jp\HTML\BB-HNP17_GS.htm | html | |
MD5:056E00579DEED47FAB097DDF6D0710C7 | SHA256:F7BCFE4A1CBB204C50F3898D3427832C04AF42F005B1ECA0CE4393727D1EF60C | |||
1880 | 02322509.exe | C:\Users\admin\AppData\Local\Temp\ncr_viewing_only_v406R02jp\HNP17S_JP\hlp\manual\jp\HTML\common\img\_info.gif | image | |
MD5:806C46F5CFB6078B70B35A55B757B82A | SHA256:F5C17CFC9A0C670D94A725F20BC2C465AD521F6E6DC6FC5E970A815A6FF7F7CF |