File name:

HelloFont_2.6.0.1.exe

Full analysis: https://app.any.run/tasks/a1881ef5-5821-4601-98c0-43e5faae27aa
Verdict: Malicious activity
Analysis date: February 19, 2024, 01:54:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
qrcode
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

54B88952728B70AEC1953745DFCE15F9

SHA1:

CA2F597712A7A8AF9DD6BFF44DBDE318B478FF43

SHA256:

035B603EBCB92EE106CFD7F1D768F6564B88660ABF8955C51FBD8680B652186F

SSDEEP:

98304:/V7fEEWqJzK00u0sFiGckYrLm+Y0PRD5Pz637kYIhdHDL1VEBqDqFrMCKibKY48r:/f33+60

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Changes the autorun value in the registry

      • HelloFont_2.6.0.1.exe (PID: 3672)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Reads Microsoft Outlook installation path

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Reads settings of System Certificates

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Reads the Internet Settings

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Checks Windows Trust Settings

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Changes Internet Explorer settings (feature browser emulation)

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Connects to the server without a host name

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Reads Internet Explorer settings

      • HelloFont_2.6.0.1.exe (PID: 3672)

  • INFO

    • Reads the computer name

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Checks supported languages

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Checks proxy server information

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Reads the software policy settings

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Creates files or folders in the user directory

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Reads Environment values

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Reads the machine GUID from the registry

      • HelloFont_2.6.0.1.exe (PID: 3672)

    • Manual execution by a user

      • verclsid.exe (PID: 3940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.1)
.exe | Win32 Executable MS Visual C++ (generic) (19.2)
.exe | Win64 Executable (generic) (17)
.scr | Windows screen saver (8)
.dll | Win32 Dynamic Link Library (generic) (4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:07:02 08:44:05+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 10869248
InitializedDataSize: 364032
UninitializedDataSize: -
EntryPoint: 0xa5f99e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.6.0.1
ProductVersionNumber: 2.6.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: 字由开发组
FileDescription: 字由
FileVersion: 2.6.0.1
InternalName: HelloFont.exe
LegalCopyright: Copyright © 字由开发组 2015
LegalTrademarks: -
OriginalFileName: HelloFont.exe
ProductName: HelloFont
ProductVersion: 2.6.0.1
AssemblyVersion: 2.6.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hellofont_2.6.0.1.exe verclsid.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3672"C:\Users\admin\AppData\Local\Temp\HelloFont_2.6.0.1.exe" C:\Users\admin\AppData\Local\Temp\HelloFont_2.6.0.1.exe
explorer.exe
User:
admin
Company:
字由开发组
Integrity Level:
MEDIUM
Description:
字由
Exit code:
0
Version:
2.6.0.1
Modules
Images
c:\users\admin\appdata\local\temp\hellofont_2.6.0.1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3940"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401C:\Windows\System32\verclsid.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extension CLSID Verification Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\verclsid.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
6 793
Read events
6 726
Write events
58
Delete events
9

Modification events

(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:HelloFont
Value:
C:\Users\admin\AppData\Local\Temp\HelloFont_2.6.0.1.exe
(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(3672) HelloFont_2.6.0.1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
Executable files
0
Suspicious files
5
Text files
20
Unknown types
4

Dropped files

PID
Process
Filename
Type
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\Roaming\HelloFont\ClientFont.cfg —
MD5:—
SHA256:—
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\Roaming\HelloFont\Config.cfgtext
MD5:33DEE2F5D30F07909532D6AF47F0A718
SHA256:0B7A625B8F86E190990E6F44CAAC953EA830703F3D406930CB4FBCB703B54983
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_81BBB1054A415F919CAAAA1A04E0952Ader
MD5:C4D691221C4DF09C3E16739DFB7C846D
SHA256:A3893A16C6AD0BA8065B8FED7A927046807BB43060E95BE3A35AF148B8F71770
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_81BBB1054A415F919CAAAA1A04E0952Abinary
MD5:77C63D9D14955F6BCBFBD8EBA8C30244
SHA256:BA6D0F16C41B6429309ADE10F866C29D670349966B2656452E3E160F65B4229D
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2Cbinary
MD5:74ACE0AD4E10ACAA3E77311267D27B4C
SHA256:7D6B4199F54DB1D2B315D899727EC910BE2F501054232DBFBCA6DA489667926C
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\qrconnect[1].htmhtml
MD5:7F4F3346C73B73E80051766F5B2CBFED
SHA256:3D398EA8E3D477D2C2507C6AB8360E15C0F8D38494F94C2DC3D48F28AC7E81D5
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_9B8670363F58B4643EB28A4A03EE9887binary
MD5:722863A7E9DE0ADD6C5AA2831AD4D75C
SHA256:C6F7BFFC64095700E63BC8BB501DA56550790844B6F9E5E5ADDEEE14D84D5900
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2Cbinary
MD5:FFF49F5E95FD4BD70378F58E6F892A59
SHA256:C8F27C449CEEB2B08309C35C3CCC546ABA392DF11735C4765BB6C61378355D6A
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:429DB78509B56B661F3A3EF47EC74773
SHA256:DA04E3AC103E2B88E3948D09734EEF32E7F9A0A2AC23692B6EAAABC563C6DB2D
3672HelloFont_2.6.0.1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_E651713E4557F0364906DDC1B2674A2Ebinary
MD5:6915EBD98D4056A3418876BC7BBD3725
SHA256:1B7E39ACC129A1BF53B4BFB56C920BCA3D82BDC34E8C16924307849905712A45
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
25
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3672
HelloFont_2.6.0.1.exe
GET
304
87.248.202.1:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3eb62bd5d68144a3
unknown
—
—
unknown
3672
HelloFont_2.6.0.1.exe
GET
200
59.110.185.14:80
http://hellofontpreview.oss-cn-beijing.aliyuncs.com/%E7%82%B9%E5%AD%97%E5%B0%86%E5%86%9B%E4%BB%A4/1.00/IdeaFonts%20JiangJunLing_S_B_32.png
unknown
image
2.24 Kb
unknown
3672
HelloFont_2.6.0.1.exe
GET
200
59.110.185.14:80
http://hellofontpreview.oss-cn-beijing.aliyuncs.com/%E7%99%BE%E5%AE%B6%E9%80%A0%E5%AD%97%E7%9F%A5%E5%AE%A5%E4%BD%93/1.000/%E7%99%BE%E5%AE%B6%E9%80%A0%E5%AD%97%E7%9F%A5%E5%AE%A5%E4%BD%93_S_B_32.png
unknown
image
2.26 Kb
unknown
3672
HelloFont_2.6.0.1.exe
GET
200
59.110.185.14:80
http://hellofontpreview.oss-cn-beijing.aliyuncs.com/Bondi%20Regular/1.000/Bondi_S_B_32.png
unknown
image
5.63 Kb
unknown
3672
HelloFont_2.6.0.1.exe
POST
200
47.93.163.171:80
http://back2.hellofont.cn/ziyou/MiscManagement/api/Url/UserCenterUrlList
unknown
binary
1.14 Kb
unknown
—
—
GET
200
163.181.131.227:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbJNRrm8KxusAb7DCqnMkE%3D
unknown
binary
471 b
unknown
—
—
GET
200
163.181.131.227:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAzveKgxR25ARAL57KqbI7E%3D
unknown
binary
471 b
unknown
3672
HelloFont_2.6.0.1.exe
POST
200
47.93.163.171:80
http://47.93.163.171/ziyou/ClientManagement20200608/api/Trial/Trial
unknown
binary
79 b
unknown
3672
HelloFont_2.6.0.1.exe
GET
200
163.181.131.227:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEApQk7nHM8Ze2%2F0DZfo83lU%3D
unknown
binary
471 b
unknown
3672
HelloFont_2.6.0.1.exe
GET
200
163.181.131.227:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEARG%2BkY12ZetlA459vQU5KE%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3672
HelloFont_2.6.0.1.exe
203.205.232.110:443
open.weixin.qq.com
Tencent Building, Kejizhongyi Avenue
HK
unknown
3672
HelloFont_2.6.0.1.exe
47.93.163.171:80
back2.hellofont.cn
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3672
HelloFont_2.6.0.1.exe
87.248.202.1:80
ctldl.windowsupdate.com
LLNW
NL
unknown
3672
HelloFont_2.6.0.1.exe
163.181.131.227:80
ocsp.digicert.cn
—
US
unknown
3672
HelloFont_2.6.0.1.exe
43.152.26.104:443
res.wx.qq.com
ACE
DE
unknown
3672
HelloFont_2.6.0.1.exe
109.244.216.15:443
lp.open.weixin.qq.com
Shenzhen Tencent Computer Systems Company Limited
CN
unknown
1080
svchost.exe
87.248.202.1:80
ctldl.windowsupdate.com
LLNW
NL
unknown

DNS requests

Domain
IP
Reputation
open.weixin.qq.com
  • 203.205.232.110
  • 203.205.239.154
unknown
ctldl.windowsupdate.com
  • 87.248.202.1
  • 178.79.208.1
whitelisted
ocsp.digicert.cn
  • 163.181.131.227
  • 163.181.131.234
  • 163.181.131.233
  • 163.181.131.231
  • 163.181.131.230
  • 163.181.131.232
  • 163.181.131.229
  • 163.181.131.228
whitelisted
res.wx.qq.com
  • 43.152.26.104
  • 43.152.26.151
  • 43.152.26.154
  • 43.152.44.160
  • 43.152.26.142
  • 43.152.26.221
  • 43.152.26.58
  • 43.152.26.197
whitelisted
lp.open.weixin.qq.com
  • 109.244.216.15
  • 109.244.217.35
unknown
back2.hellofont.cn
  • 47.93.163.171
unknown
hellofontpreview.oss-cn-beijing.aliyuncs.com
  • 59.110.185.14
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HelloFont_2.6.0.1.exe