File name: | SFVIP-Player-x86.7z |
Full analysis: | https://app.any.run/tasks/64cfd542-b32a-4101-9cc1-01cc89e9f3c5 |
Verdict: | Malicious activity |
Analysis date: | January 30, 2021, 21:19:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-7z-compressed |
File info: | 7-zip archive data, version 0.4 |
MD5: | C41519CE03916D79B05EDEF12649B6FB |
SHA1: | DF490299B0535EB79E596793649D7087D4F3B129 |
SHA256: | 0AEF810A9D455AAE233ED8B970486F3A1533338A412631800DA8429D9F8DB367 |
SSDEEP: | 3072:3JwUUXikcqOmlmqA0U7ERT3IsjJAnnlRJ5vGmwotb6AMOEAdOjdQG8TWAewJx8O4:WRW0KZNZt63jdQFTje4iw6c5+ |
.7z | | | 7-Zip compressed archive (v0.4) (57.1) |
---|---|---|
.7z | | | 7-Zip compressed archive (gen) (42.8) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2712 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SFVIP-Player-x86.7z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3360 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
3296 | "C:\Users\admin\Desktop\Updater.exe" | C:\Users\admin\Desktop\Updater.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: SFVIP Player Updater Exit code: 0 Version: 1.0.0.0 | ||||
1152 | "C:\Users\admin\AppData\Local\Temp\Updater.exe" -Update "C:\Users\admin\Desktop\Updater.exe" | C:\Users\admin\AppData\Local\Temp\Updater.exe | Updater.exe | |
User: admin Integrity Level: MEDIUM Description: SFVIP Player Updater Exit code: 3762504530 Version: 1.0.0.0 | ||||
3784 | "C:\Users\admin\Desktop\sfvip player.exe" | C:\Users\admin\Desktop\sfvip player.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: sfvip player Version: 1.2.1.33 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2712 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2712.43582\sfvip player.exe.config | — | |
MD5:— | SHA256:— | |||
2712 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2712.43582\libmpv.dll | — | |
MD5:— | SHA256:— | |||
2712 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2712.43582\sfvip player.exe | — | |
MD5:— | SHA256:— | |||
2712 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2712.43582\Updater.exe | — | |
MD5:— | SHA256:— | |||
1152 | Updater.exe | C:\Users\admin\Desktop\adminTest.iptv | — | |
MD5:— | SHA256:— | |||
1152 | Updater.exe | C:\Users\admin\AppData\Local\Temp\Update.zip | — | |
MD5:— | SHA256:— | |||
1152 | Updater.exe | C:\Users\admin\Desktop\sfvip player.exe | executable | |
MD5:A183A3D8883B48A103AEE9B7F6897380 | SHA256:EB53CF433CF65A28EDB185AADDAD9CED72102E82B72DE7FAC23DCF5249F02FB3 | |||
3296 | Updater.exe | C:\Users\admin\AppData\Local\Temp\Updater.exe | executable | |
MD5:34F723E2021166D0E31847B15448D8E6 | SHA256:215D056A528D213807FC1CCB7061D7B07ADC8CF931FE33A17C27BC1BB0A3B0E0 | |||
1152 | Updater.exe | C:\Users\admin\Desktop\Updater.exe | executable | |
MD5:07388014E99FCF1E96B1677906E9BD45 | SHA256:53863DCB6225DDAB26B49A10EF855856BF82561829AC59775F0948EABB44D4DB | |||
3784 | sfvip player.exe | C:\Users\admin\AppData\Roaming\SFVIP-Player\Config.json | text | |
MD5:F7F060770BF8309EC1AD192BA021DB11 | SHA256:095FF421E131A76970A0C1BDCAD5F7ED0D2327E10CC68BBEBE109FB4120D6D18 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3784 | sfvip player.exe | GET | 302 | 64.233.185.103:80 | http://www.google.com/ | US | html | 231 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3784 | sfvip player.exe | 151.101.0.133:443 | raw.githubusercontent.com | Fastly | US | malicious |
3784 | sfvip player.exe | 64.233.185.103:443 | www.google.com | Google Inc. | US | whitelisted |
1152 | Updater.exe | 151.101.0.133:443 | raw.githubusercontent.com | Fastly | US | malicious |
3784 | sfvip player.exe | 64.233.185.103:80 | www.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
raw.githubusercontent.com |
| shared |
www.google.com |
| whitelisted |