File name:

HEUR-Trojan.Multi.Loader.exe

Full analysis: https://app.any.run/tasks/28a694b0-48c0-47ea-983d-227a0eb2e4af
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Malware Trends Tracker     >>>
Analysis date: April 09, 2025, 22:16:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
rhadamanthys
delphi
hijackloader
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, InstallShield self-extracting archive, 9 sections
MD5:

72EC64D0BC0B31F8842C9B5D488C11E7

SHA1:

85D81EDEAC18C67D6C8B73AB628347586A5039AD

SHA256:

019E368CDFE9E71959DFC32917463653DFA4C35C129F1FEB1FE492187D46A22A

SSDEEP:

98304:ESdDQsSdmtZCzmut3GKjKhoIYreG+ahB64Sw9jt9XWUw2YjWmj00M4b+QbSpfjFH:E5GX44OOiQM7+VWujI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RHADAMANTHYS has been found (auto)

      • HEUR-Trojan.Multi.Loader.exe (PID: 7544)

    • HIJACKLOADER has been detected (YARA)

      • WinX_DVD_Ripper_Platinum.exe (PID: 7904)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HEUR-Trojan.Multi.Loader.exe (PID: 7696)
      • HEUR-Trojan.Multi.Loader.exe (PID: 7544)
      • WinX_DVD_Ripper_Platinum.exe (PID: 7744)

    • Starts itself from another location

      • HEUR-Trojan.Multi.Loader.exe (PID: 7544)
      • WinX_DVD_Ripper_Platinum.exe (PID: 7744)

    • Process drops legitimate windows executable

      • HEUR-Trojan.Multi.Loader.exe (PID: 7696)

    • Executes application which crashes

      • HEUR-Trojan.Multi.Loader.exe (PID: 7696)

    • Starts CMD.EXE for commands execution

      • WinX_DVD_Ripper_Platinum.exe (PID: 7904)

  • INFO

    • Checks supported languages

      • HEUR-Trojan.Multi.Loader.exe (PID: 7696)
      • HEUR-Trojan.Multi.Loader.exe (PID: 7544)
      • WinX_DVD_Ripper_Platinum.exe (PID: 7744)
      • WinX_DVD_Ripper_Platinum.exe (PID: 7904)

    • Create files in a temporary directory

      • HEUR-Trojan.Multi.Loader.exe (PID: 7544)
      • HEUR-Trojan.Multi.Loader.exe (PID: 7696)
      • WinX_DVD_Ripper_Platinum.exe (PID: 7904)

    • The sample compiled with english language support

      • HEUR-Trojan.Multi.Loader.exe (PID: 7544)
      • HEUR-Trojan.Multi.Loader.exe (PID: 7696)
      • WinX_DVD_Ripper_Platinum.exe (PID: 7744)

    • Reads the computer name

      • WinX_DVD_Ripper_Platinum.exe (PID: 7744)
      • WinX_DVD_Ripper_Platinum.exe (PID: 7904)

    • Creates files or folders in the user directory

      • WinX_DVD_Ripper_Platinum.exe (PID: 7744)
      • WerFault.exe (PID: 7868)

    • Compiled with Borland Delphi (YARA)

      • WinX_DVD_Ripper_Platinum.exe (PID: 7904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:04:05 13:00:45+00:00
ImageFileCharacteristics: Executable, Large address aware, Removable run from swap, Net run from swap
PEType: PE32+
LinkerVersion: 14.34
CodeSize: 515584
InitializedDataSize: 267776
UninitializedDataSize: -
EntryPoint: 0x53dd0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.7.3.0
ProductVersionNumber: 1.7.3.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Nymphet
FileDescription: Aesthete
FileVersion: 1.7.3.0
InternalName: burn
OriginalFileName: spirograph.exe
ProductName: Aesthete
ProductVersion: 1.7.3.0
LegalCopyright: Copyright (c) Nymphet. All rights reserved.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start heur-trojan.multi.loader.exe heur-trojan.multi.loader.exe winx_dvd_ripper_platinum.exe werfault.exe no specs #HIJACKLOADER winx_dvd_ripper_platinum.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3156C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\estkmmcicb
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7544"C:\Users\admin\AppData\Local\Temp\HEUR-Trojan.Multi.Loader.exe" C:\Users\admin\AppData\Local\Temp\HEUR-Trojan.Multi.Loader.exe
explorer.exe
User:
admin
Company:
Nymphet
Integrity Level:
MEDIUM
Description:
Aesthete
Exit code:
3221225477
Version:
1.7.3.0
Modules
Images
c:\users\admin\appdata\local\temp\heur-trojan.multi.loader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7696"C:\Users\admin\AppData\Local\Temp\{F17ACEC3-E37A-4EC9-A7A8-E8CB7C6B00B8}\.cr\HEUR-Trojan.Multi.Loader.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\HEUR-Trojan.Multi.Loader.exe" -burn.filehandle.attached=696 -burn.filehandle.self=700C:\Users\admin\AppData\Local\Temp\{F17ACEC3-E37A-4EC9-A7A8-E8CB7C6B00B8}\.cr\HEUR-Trojan.Multi.Loader.exe
HEUR-Trojan.Multi.Loader.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\{f17acec3-e37a-4ec9-a7a8-e8cb7c6b00b8}\.cr\heur-trojan.multi.loader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7744C:\Users\admin\AppData\Local\Temp\{49D63430-1EFA-4E66-A54F-751AB9022FE1}\.ba\WinX_DVD_Ripper_Platinum.exeC:\Users\admin\AppData\Local\Temp\{49D63430-1EFA-4E66-A54F-751AB9022FE1}\.ba\WinX_DVD_Ripper_Platinum.exe
HEUR-Trojan.Multi.Loader.exe
User:
admin
Company:
Digiarty Software, Inc.
Integrity Level:
MEDIUM
Description:
WinX DVD Ripper Platinum
Exit code:
0
Version:
8.22.0.246
Modules
Images
c:\users\admin\appdata\local\temp\{49d63430-1efa-4e66-a54f-751ab9022fe1}\.ba\winx_dvd_ripper_platinum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7868C:\WINDOWS\system32\WerFault.exe -u -p 7696 -s 628C:\Windows\System32\WerFault.exe—HEUR-Trojan.Multi.Loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
7904C:\Users\admin\AppData\Roaming\Dn_explore_test\WinX_DVD_Ripper_Platinum.exeC:\Users\admin\AppData\Roaming\Dn_explore_test\WinX_DVD_Ripper_Platinum.exe
WinX_DVD_Ripper_Platinum.exe
User:
admin
Company:
Digiarty Software, Inc.
Integrity Level:
MEDIUM
Description:
WinX DVD Ripper Platinum
Exit code:
1
Version:
8.22.0.246
Modules
Images
c:\users\admin\appdata\roaming\dn_explore_test\winx_dvd_ripper_platinum.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7944C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe—WinX_DVD_Ripper_Platinum.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7952\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8064C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
8096"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 048
Read events
2 048
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
8
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7868WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HEUR-Trojan.Mult_a9e77233f19b89eb5f97c95d39fd3f572963fd37_389931ac_7e529d15-6201-41e1-af2a-e6c742876a46\Report.wer —
MD5:—
SHA256:—
7696HEUR-Trojan.Multi.Loader.exeC:\Users\admin\AppData\Local\Temp\{49D63430-1EFA-4E66-A54F-751AB9022FE1}\.ba\libeay32.dllexecutable
MD5:73A8CDC0BB5B95C1BA6DEB39D71F0349
SHA256:639980C48DD692E9FF3144F3D932AA07E501F12197D587EC47EB5EC8F6B7696A
7544HEUR-Trojan.Multi.Loader.exeC:\Users\admin\AppData\Local\Temp\{F17ACEC3-E37A-4EC9-A7A8-E8CB7C6B00B8}\.cr\HEUR-Trojan.Multi.Loader.exeexecutable
MD5:93860D60D2DF0F9DA732E45513E7BA5D
SHA256:9366725E71CF2999398B7B257286637B9FCB11D8B49A4AFB96649921DFB31B1B
7944cmd.exeC:\Users\admin\AppData\Local\Temp\estkmmcicb —
MD5:—
SHA256:—
7696HEUR-Trojan.Multi.Loader.exeC:\Users\admin\AppData\Local\Temp\{49D63430-1EFA-4E66-A54F-751AB9022FE1}\.ba\Serum.dllexecutable
MD5:20AA36C2CE87D64CB58E7E32F0546FB1
SHA256:72A8176B2F34EA46B763AB64763F4434D660BC36E487E50E6137489403DA42F8
7696HEUR-Trojan.Multi.Loader.exeC:\Users\admin\AppData\Local\Temp\{49D63430-1EFA-4E66-A54F-751AB9022FE1}\.ba\WinX_DVD_Ripper_Platinum.exeexecutable
MD5:3C64548B4AEDBD79411D69029BDAE67F
SHA256:1F7A9CF0F11E5D30538E7162AA69C9216839DDA3928B25368434F7E6E96EA0FB
7744WinX_DVD_Ripper_Platinum.exeC:\Users\admin\AppData\Roaming\Dn_explore_test\transform.aspbinary
MD5:63AFA5CDF59535A6EE3A44C29972F740
SHA256:CB2DDAAB3E74CE3DDD633F401668B67331E9A7FB7BF506712C7557C3B1DDBC02
7696HEUR-Trojan.Multi.Loader.exeC:\Users\admin\AppData\Local\Temp\{49D63430-1EFA-4E66-A54F-751AB9022FE1}\.ba\restart.msgbinary
MD5:D1F6010ADEEEB153FCBF492A2013176D
SHA256:EA3CCEFF70E25F5E4B809CC2E31C2FD6D32C7E8936D456E1D46371B69DCA311F
7744WinX_DVD_Ripper_Platinum.exeC:\Users\admin\AppData\Roaming\Dn_explore_test\WinX_DVD_Ripper_Platinum.exeexecutable
MD5:3C64548B4AEDBD79411D69029BDAE67F
SHA256:1F7A9CF0F11E5D30538E7162AA69C9216839DDA3928B25368434F7E6E96EA0FB
7744WinX_DVD_Ripper_Platinum.exeC:\Users\admin\AppData\Roaming\Dn_explore_test\profile.dllexecutable
MD5:A957F7E18D5493A99D151FF504214D09
SHA256:4E54F4D31BC41230F51A436613F00C893DFEBA11175667AF960E22E429849F3A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
15
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4208
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7356
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7356
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7356
SIHClient.exe
13.85.23.206:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.6
  • 23.216.77.28
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan.Multi.Loader.exe