File name:

Gift Card Code Generator by amboss.zip

Full analysis: https://app.any.run/tasks/eceb3cf8-1f70-483d-8efb-5dc3ea92953a
Verdict: Malicious activity
Analysis date: June 13, 2020, 19:06:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

EDE842989A4FA3934A73CF9CDF929FCB

SHA1:

82206657AC1B6CF34E5C573F58F9A459D1267FA1

SHA256:

052116BD4E077247116A0DD22CB059A0516E7B5C137FD24BDD50B2F382CD97C5

SSDEEP:

6144:ah/Mur0tf+GP3rlIe6oLCFKoCO6K3uOKzgC9YnTajms0s5YO0b0N:aCRtfdPJHremO6HrSTaZY9k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Gift Card Code Generator.exe (PID: 1744)

    • Loads dropped or rewritten executable

      • Gift Card Code Generator.exe (PID: 1744)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 940)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:05:06 02:05:01
ZipCRC: 0xa0521664
ZipCompressedSize: 5565
ZipUncompressedSize: 13824
ZipFileName: Gift Card Code Generator.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe gift card code generator.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
940"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Gift Card Code Generator by amboss.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1608"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa940.9079\s.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1744"C:\Users\admin\AppData\Local\Temp\Rar$EXa940.5779\Gift Card Code Generator.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa940.5779\Gift Card Code Generator.exe
WinRAR.exe
User:
admin
Company:
amboss
Integrity Level:
MEDIUM
Description:
Gift Card Code Generator by amboss
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa940.5779\gift card code generator.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
574
Read events
537
Write events
37
Delete events
0

Modification events

(PID) Process:(940) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(940) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(940) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(940) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(940) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Gift Card Code Generator by amboss.zip
(PID) Process:(940) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(940) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(940) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(940) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(940) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
3
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
940WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_940.8945 —
MD5:—
SHA256:—
940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa940.5779\README.txttext
MD5:—
SHA256:—
940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Gift Card Code Generator by amboss.zipcompressed
MD5:—
SHA256:—
940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa940.9079\s.txttext
MD5:—
SHA256:—
1744Gift Card Code Generator.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa940.5779\s.txttext
MD5:—
SHA256:—
940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa940.5779\Newtonsoft.Json.dllexecutable
MD5:4DF6C8781E70C3A4912B5BE796E6D337
SHA256:3598CCCAD5B535FEA6F93662107A4183BFD6167BF1D0F80260436093EDC2E3AF
940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa940.5779\Gift Card Code Generator.exeexecutable
MD5:A4DAF8C556CDE15F0B149346FE72B6E8
SHA256:98238166595D1096E590609E854E311CFF45BF3F90E8690B16222016D9B509DD
940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa940.5779\Leaf.xNet.dllexecutable
MD5:4D31626E5B7D07DEE2375E49B4671C99
SHA256:06E2EEC80A75C45CC1CA63ABC7D3DA907E49AC60FA1A24E94520DA6E61F44FE5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1744
Gift Card Code Generator.exe
104.26.6.55:443
cracked.to
Cloudflare Inc
US
suspicious

DNS requests

Domain
IP
Reputation
cracked.to
  • 104.26.6.55
  • 104.26.7.55
  • 172.67.74.216
whitelisted

Threats

PID
Process
Class
Message
1072
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Gift Card Code Generator by amboss.zip