File name: | growtopia spam bot(fixed).rar |
Full analysis: | https://app.any.run/tasks/70cfd458-925c-4d85-9309-f9ca64f64659 |
Verdict: | Malicious activity |
Analysis date: | January 17, 2020, 18:42:17 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | image/jpeg |
File info: | JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 520x340, frames 3 |
MD5: | 951C6DA05D75F53D81854F71C2164AA5 |
SHA1: | 31332A3268F179802FA43DEFE06F4291537C0525 |
SHA256: | 04FB0B0C1AB59A4B9C4C6163E74D1BB05082806AC20E07D45E89E4F8B0BC92D4 |
SSDEEP: | 384:bbhVi+bNSNXMlZ/lKB1sk/F967ZRpCetibJDhskDJ9TDtp50oFmVVvNA:bbrns87/lIyeF87Hp/cHLl0qQA |
.jpg | | | JFIF-EXIF JPEG Bitmap (55.5) |
---|---|---|
.jpg | | | JPEG bitmap (33.3) |
.mp3 | | | MP3 audio (11.1) |
Megapixels: | 0.177 |
---|---|
ImageSize: | 520x340 |
ColorTransform: | YCbCr |
---|---|
APP14Flags1: | (none) |
APP14Flags0: | [14], Encoded with Blend=1 downsampling |
DCTEncodeVersion: | 100 |
Quality: | 60% |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2264 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\growtopia spam bot(fixed).rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2852 | "C:\Users\admin\Desktop\growtopia spammer.exe" | C:\Users\admin\Desktop\growtopia spammer.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: growtopia spammer Version: 1.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2264 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2264.6293\growtopia spammer.exe | — | |
MD5:— | SHA256:— |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2852 | growtopia spammer.exe | 64.233.184.109:587 | smtp.gmail.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
smtp.gmail.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
2852 | growtopia spammer.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2852 | growtopia spammer.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2852 | growtopia spammer.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |