File name: | Fubuki_Launcher_2.0.2.17.exe |
Full analysis: | https://app.any.run/tasks/328dea52-c7bf-4bc0-be32-8acbde4fc7dd |
Verdict: | Malicious activity |
Analysis date: | July 18, 2019, 08:01:45 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 28305B275DA372BA9E2F84A07B90D7E0 |
SHA1: | CD8356372B8BCD93135A98CECD084F0EA0BB5E37 |
SHA256: | 0B61C6864051119F10BD1D253852CEF55B3C391BDFA7A8CAAF9D971DDF977211 |
SSDEEP: | 196608:yPsCA3NxxaUkOe+IIZwMSt4H2ZaEGDq9bM8IoJsv:QAUoeZZECtM83sv |
.exe | | | Win64 Executable (generic) (76.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (12.4) |
.exe | | | Generic Win/DOS Executable (5.5) |
.exe | | | DOS Executable Generic (5.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2019:05:14 07:42:48+02:00 |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 4026368 |
InitializedDataSize: | 4210688 |
UninitializedDataSize: | - |
EntryPoint: | 0x10a2239 |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 14-May-2019 05:42:48 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000118 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 9 |
Time date stamp: | 14-May-2019 05:42:48 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0038304A | 0x00000000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 0 |
CODE | 0x00385000 | 0x00052B50 | 0x00000000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 0 |
.rdata | 0x003D8000 | 0x002E2CC6 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0 |
.data | 0x006BB000 | 0x000D23AA | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
DATA | 0x0078E000 | 0x00010E8C | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
BSS | 0x0079F000 | 0x000064B9 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.vmp0 | 0x007A6000 | 0x003D6E7F | 0x00000000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.vmp1 | 0x00B7D000 | 0x00767353 | 0x00768000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.91267 |
.rsrc | 0x012E5000 | 0x000317EB | 0x00032000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.22834 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.00766 | 1855 | UNKNOWN | UNKNOWN | RT_MANIFEST |
2 | 2.18858 | 296 | UNKNOWN | Chinese - PRC | RT_ICON |
3 | 4.33327 | 744 | UNKNOWN | UNKNOWN | RT_ICON |
4 | 3.61091 | 296 | UNKNOWN | UNKNOWN | RT_ICON |
5 | 5.975 | 3752 | UNKNOWN | UNKNOWN | RT_ICON |
6 | 6.41138 | 2216 | UNKNOWN | UNKNOWN | RT_ICON |
7 | 5.56072 | 1736 | UNKNOWN | UNKNOWN | RT_ICON |
8 | 4.19704 | 1384 | UNKNOWN | UNKNOWN | RT_ICON |
9 | 6.00037 | 67624 | UNKNOWN | UNKNOWN | RT_ICON |
10 | 5.90057 | 38056 | UNKNOWN | UNKNOWN | RT_ICON |
WS2_32.dll |
advapi32.dll |
comctl32.dll |
comdlg32.dll |
gdi32.dll |
gdiplus.dll |
imm32.dll |
kernel32.dll |
ole32.dll |
oleaut32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3592 | "C:\Users\admin\AppData\Local\Temp\Fubuki_Launcher_2.0.2.17.exe" | C:\Users\admin\AppData\Local\Temp\Fubuki_Launcher_2.0.2.17.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
3960 | "C:\Users\admin\AppData\Local\Temp\Fubuki_Launcher_2.0.2.17.exe" | C:\Users\admin\AppData\Local\Temp\Fubuki_Launcher_2.0.2.17.exe | explorer.exe | |
User: admin Integrity Level: HIGH | ||||
4004 | notepad "C:\Users\admin\AppData\Local\Temp\ʹÓÃÌõ¿îºÍÒþ˽Õþ²ßÐÒé.txt" | C:\Windows\system32\notepad.exe | — | Fubuki_Launcher_2.0.2.17.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1464 | notepad "C:\Users\admin\AppData\Local\Temp\ʹÓÃÌõ¿îºÍÒþ˽Õþ²ßÐÒé.txt" | C:\Windows\system32\notepad.exe | — | Fubuki_Launcher_2.0.2.17.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3960 | Fubuki_Launcher_2.0.2.17.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\FLCupdate[1].txt | text | |
MD5:032D277EDC5D5BBA022E1181C38D8EE3 | SHA256:9A48078443ED6910E6EC9C68209675F4A76879D76C48CA1A201CF40DF5A6D35E | |||
3960 | Fubuki_Launcher_2.0.2.17.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\ic[1].htm | html | |
MD5:4B4415F81AB33BD55E941ECAAC664905 | SHA256:59691A339F68FD327EA9CA7EE1A90D819C8CFE33C52BE618E2872090A3C48243 | |||
3960 | Fubuki_Launcher_2.0.2.17.exe | C:\Users\admin\AppData\Local\Temp\ʹÓÃÌõ¿îºÍÒþ˽Õþ²ßÐÒé.txt | text | |
MD5:084DA663B9A3FB6F1E71D65A4A7C9144 | SHA256:7502B75D300584EC5FB21C5394A07BDB151149FB0F20F9C140A5AE0E93F4984E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3960 | Fubuki_Launcher_2.0.2.17.exe | GET | 200 | 183.250.88.67:80 | http://2019.ip138.com/ic.asp | CN | html | 1.15 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3960 | Fubuki_Launcher_2.0.2.17.exe | 172.247.246.102:443 | alphaantileak.cn | CloudRadium L.L.C | US | unknown |
3960 | Fubuki_Launcher_2.0.2.17.exe | 183.136.132.173:45520 | dx.pfcraft.cn | No.31,Jin-rong Street | CN | unknown |
3960 | Fubuki_Launcher_2.0.2.17.exe | 183.250.88.67:80 | 2019.ip138.com | Guangdong Mobile Communication Co.Ltd. | CN | suspicious |
Domain | IP | Reputation |
---|---|---|
alphaantileak.cn |
| unknown |
dx.pfcraft.cn |
| unknown |
2019.ip138.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
3960 | Fubuki_Launcher_2.0.2.17.exe | Misc activity | SUSPICIOUS [PTsecurity] IP lookup service ip138.com |