analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

V5jAdEyE.exe

Full analysis: https://app.any.run/tasks/6ad47ab5-7cc8-4a0c-93de-4b9893971208
Verdict: Malicious activity
Analysis date: October 05, 2022, 07:21:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

4EAC4513EA45D765B56292697CB89A26

SHA1:

831B76EA4823867AC74CB9EB038305C2499083C7

SHA256:

016260D8F8BB92F7E3287A7FF06863931233F73FDA2FC9BF09976B39B660921D

SSDEEP:

12288:7z7hU5I5yuNHIgzSFKxWltRohBfSTso93Uxy1E:7f+iN57Gtene3z1E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • V5jAdEyE.exe (PID: 3260)

    • Reads Internet Settings

      • V5jAdEyE.exe (PID: 3260)

    • Connects to the server without a host name

      • V5jAdEyE.exe (PID: 3260)

    • Reads security settings of Internet Explorer

      • V5jAdEyE.exe (PID: 3260)

    • Checks Windows Trust Settings

      • V5jAdEyE.exe (PID: 3260)

    • Reads settings of System Certificates

      • V5jAdEyE.exe (PID: 3260)

  • INFO

    • Reads the computer name

      • V5jAdEyE.exe (PID: 3260)

    • Checks supported languages

      • V5jAdEyE.exe (PID: 3260)

    • Process checks LSA protection

      • V5jAdEyE.exe (PID: 3260)

    • Reads mouse settings

      • V5jAdEyE.exe (PID: 3260)

    • Creates files in the user directory

      • V5jAdEyE.exe (PID: 3260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Sep-23 18:14:40
Detected languages:
  • English - United Kingdom

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 288

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2022-Sep-23 18:14:40
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
4096
618496
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1
622592
380928
379392
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93667
.rsrc
1003520
65536
61952
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.04684

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.66371
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
2
2.05883
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
3
2.25499
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
4
3.65355
744
Latin 1 / Western European
English - United Kingdom
RT_ICON
5
3.43704
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
6
4.16139
3752
Latin 1 / Western European
English - United Kingdom
RT_ICON
7
4.07494
2216
Latin 1 / Western European
English - United Kingdom
RT_ICON
8
2.18302
1384
Latin 1 / Western European
English - United Kingdom
RT_ICON
9
4.52312
9640
Latin 1 / Western European
English - United Kingdom
RT_ICON
10
4.65168
4264
Latin 1 / Western European
English - United Kingdom
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.DLL
MPR.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start v5jadeye.exe

Process information

PID
CMD
Path
Indicators
Parent process
3260"C:\Users\admin\AppData\Local\Temp\V5jAdEyE.exe" C:\Users\admin\AppData\Local\Temp\V5jAdEyE.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\v5jadeye.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
Total events
4 772
Read events
4 738
Write events
34
Delete events
0

Modification events

(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3260) V5jAdEyE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionReason
Value:
1
Executable files
0
Suspicious files
6
Text files
1
Unknown types
4

Dropped files

PID
Process
Filename
Type
3260V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8der
MD5:29FB83C9FBB41EA2B8C5E2E627880B2D
SHA256:BF5DF67DD3F7A1F8533E25499EEFD50078A6A26DA774A70BAA36D4A9364D0EFA
3260V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:BAAD6EE8579B95A164FB9238E19F033D
SHA256:74B09AD72008ED720E7CFC696BF9C4736D807C72C20385F7D5CEA43B26C05588
3260V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323der
MD5:F936B953FDF91692463E6745F5151375
SHA256:21C4C1A25E3F41EA5D0262216D19CB081023A79500EAE7DAB8B8C1F5022AD18E
3260V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:730A4129BE3CEAF0FD2EABD552EFF5FE
SHA256:8D32F8D4B316C4B65C15BF0171D6AD826F590DBC842CE712897902B4ACA9448F
3260V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:ADA8354250B1DE077247CB4A54E13E36
SHA256:E2758E65DCD91CB9699991F1CF877BB4E4A500E5714EDFAC9E2B55F6BA8858EF
3260V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:5A11C6099B9E5808DFB08C5C9570C92F
SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172
3260V5jAdEyE.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\ip[1].htmtext
MD5:C7B3037F63433B37F73B2B1189CB064F
SHA256:36B06CAD2E71DAAF33374E73A68C1DD194C9B47CE579A56E3B5DE6B9E7603814
3260V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323binary
MD5:A161F2E965204E83CD7639F828165B9C
SHA256:ACAD99662BC47C3B769147933758ED2A5B1E1152CB131EB70AAA5AC52F845A87
3260V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:7991F31E8FE94162879812D37D970306
SHA256:E7E55B4DCEB1C60CE95918828E952BE6A19761EA7CA4B3261F46230D5292AD0D
3260V5jAdEyE.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8binary
MD5:E122F7CB7095272B8EFB1DBEBDBDA2E1
SHA256:A1A83B4889C0C38182475C89F1ECCE2260B1CFEF8191895B53B871F95C7AA0E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
7
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3260
V5jAdEyE.exe
GET
200
167.235.142.21:80
http://167.235.142.21/ip.php
DE
text
15 b
suspicious
3260
V5jAdEyE.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3260
V5jAdEyE.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3260
V5jAdEyE.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCgVmpFkizRxRLqxUFbbeRm
US
der
472 b
whitelisted
3260
V5jAdEyE.exe
GET
200
8.241.11.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e387be4d1fd3d5a0
US
compressed
4.70 Kb
whitelisted
3260
V5jAdEyE.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECY%2B0YL3%2ByMOCtPdrqPffYg%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3260
V5jAdEyE.exe
142.250.185.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3260
V5jAdEyE.exe
167.235.142.21:80
—
Hetzner Online GmbH
DE
suspicious
3260
V5jAdEyE.exe
8.241.11.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3260
V5jAdEyE.exe
172.217.18.14:443
script.google.com
GOOGLE
US
whitelisted
3260
V5jAdEyE.exe
172.217.18.1:443
script.googleusercontent.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
script.google.com
  • 172.217.18.14
whitelisted
ctldl.windowsupdate.com
  • 8.241.11.254
  • 67.26.83.254
  • 67.26.139.254
  • 8.253.207.120
  • 67.27.233.254
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted
script.googleusercontent.com
  • 172.217.18.1
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
V5jAdEyE.exe