analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

V5jAdEyE.exe

Full analysis: https://app.any.run/tasks/192caad8-6f58-4c38-9f2f-66bb55711101
Verdict: Malicious activity
Analysis date: October 05, 2022, 07:44:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

4EAC4513EA45D765B56292697CB89A26

SHA1:

831B76EA4823867AC74CB9EB038305C2499083C7

SHA256:

016260D8F8BB92F7E3287A7FF06863931233F73FDA2FC9BF09976B39B660921D

SSDEEP:

12288:7z7hU5I5yuNHIgzSFKxWltRohBfSTso93Uxy1E:7f+iN57Gtene3z1E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Internet Settings

      • V5jAdEyE.exe (PID: 1124)

    • Reads the machine GUID from the registry

      • V5jAdEyE.exe (PID: 1124)

    • Checks Windows Trust Settings

      • V5jAdEyE.exe (PID: 1124)

    • Connects to the server without a host name

      • V5jAdEyE.exe (PID: 1124)

    • Reads security settings of Internet Explorer

      • V5jAdEyE.exe (PID: 1124)

    • Reads settings of System Certificates

      • V5jAdEyE.exe (PID: 1124)

  • INFO

    • Reads mouse settings

      • V5jAdEyE.exe (PID: 1124)

    • Reads the computer name

      • V5jAdEyE.exe (PID: 1124)

    • Process checks LSA protection

      • V5jAdEyE.exe (PID: 1124)

    • Checks supported languages

      • V5jAdEyE.exe (PID: 1124)

    • Creates files in the user directory

      • V5jAdEyE.exe (PID: 1124)

    • Reads the machine GUID from the registry

      • control.exe (PID: 3656)

    • Manual execution by user

      • explorer.exe (PID: 2772)
      • control.exe (PID: 3656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Sep-23 18:14:40
Detected languages:
  • English - United Kingdom

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 288

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2022-Sep-23 18:14:40
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
4096
618496
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1
622592
380928
379392
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93667
.rsrc
1003520
65536
61952
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.04684

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.66371
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
2
2.05883
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
3
2.25499
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
4
3.65355
744
Latin 1 / Western European
English - United Kingdom
RT_ICON
5
3.43704
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
6
4.16139
3752
Latin 1 / Western European
English - United Kingdom
RT_ICON
7
4.07494
2216
Latin 1 / Western European
English - United Kingdom
RT_ICON
8
2.18302
1384
Latin 1 / Western European
English - United Kingdom
RT_ICON
9
4.52312
9640
Latin 1 / Western European
English - United Kingdom
RT_ICON
10
4.65168
4264
Latin 1 / Western European
English - United Kingdom
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.DLL
MPR.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start v5jadeye.exe explorer.exe no specs control.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1124"C:\Users\admin\AppData\Local\Temp\V5jAdEyE.exe" C:\Users\admin\AppData\Local\Temp\V5jAdEyE.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\v5jadeye.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
2772"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3656"C:\Windows\System32\control.exe" SYSTEMC:\Windows\System32\control.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
5 178
Read events
5 143
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
1
Unknown types
4

Dropped files

PID
Process
Filename
Type
1124V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323binary
MD5:730B08227AEEFD00B60524714A19BFCA
SHA256:D8F3496B55C0E1AFF0B4220F761AAAAA62AFE85346BF2F737AAE8C9682B98043
1124V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:82077AE35F119FDABA6FDA2E851D4A35
SHA256:1FA1D34D01AB032AAF7EF18D5C63ED76F832CA4B00AABB85DE1E69F714CDC5F8
1124V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8binary
MD5:617DAF4A361EAB16A2EAD2B26F42075E
SHA256:49F80665905E7155E8583DD44EDC09D9A1ED510C975EAE9C9DFC6896B0F484E4
1124V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:047402C2F034D557AB41E613704991C1
SHA256:63B0950660723FA064B947D63A30A0B15BED17DA4E563F36DB021F796E372CC0
1124V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:D9566C3D312D3950EA9B838D831D0557
SHA256:0D52EDC4B520E6B100E1B3F49F5EB537FEAA3DA85CA46E94865AB2F5D528D5B8
1124V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:5A11C6099B9E5808DFB08C5C9570C92F
SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172
1124V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:730A4129BE3CEAF0FD2EABD552EFF5FE
SHA256:8D32F8D4B316C4B65C15BF0171D6AD826F590DBC842CE712897902B4ACA9448F
1124V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8der
MD5:29FB83C9FBB41EA2B8C5E2E627880B2D
SHA256:BF5DF67DD3F7A1F8533E25499EEFD50078A6A26DA774A70BAA36D4A9364D0EFA
1124V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323der
MD5:F936B953FDF91692463E6745F5151375
SHA256:21C4C1A25E3F41EA5D0262216D19CB081023A79500EAE7DAB8B8C1F5022AD18E
1124V5jAdEyE.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\ip[1].htmtext
MD5:2C5AA44AB7F1F9140827131ADF82CB3D
SHA256:0711B84853ABF11EE953A8AE94D7BE6694C0E3965C9A2CAA9FA505369C87EB95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1124
V5jAdEyE.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCgVmpFkizRxRLqxUFbbeRm
US
der
472 b
whitelisted
1124
V5jAdEyE.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
1124
V5jAdEyE.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECY%2B0YL3%2ByMOCtPdrqPffYg%3D
US
der
471 b
whitelisted
1124
V5jAdEyE.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
1124
V5jAdEyE.exe
GET
200
167.235.142.21:80
http://167.235.142.21/ip.php
DE
text
13 b
suspicious
1124
V5jAdEyE.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7d781aaeeaf1bcf9
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1124
V5jAdEyE.exe
23.216.77.80:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
1124
V5jAdEyE.exe
142.250.185.193:443
script.googleusercontent.com
GOOGLE
US
whitelisted
1124
V5jAdEyE.exe
142.250.186.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1124
V5jAdEyE.exe
142.250.185.110:443
script.google.com
GOOGLE
US
whitelisted
1124
V5jAdEyE.exe
167.235.142.21:80
—
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
script.google.com
  • 142.250.185.110
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.80
  • 23.216.77.69
whitelisted
ocsp.pki.goog
  • 142.250.186.131
whitelisted
script.googleusercontent.com
  • 142.250.185.193
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
V5jAdEyE.exe