File name:

vkontaktedj.exe

Full analysis: https://app.any.run/tasks/69c04cbe-5616-410f-8492-0bc0d99a9c81
Verdict: Malicious activity
Analysis date: March 25, 2019, 13:33:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0D6846636611D8DA1B0DE29CB46C5500

SHA1:

398381EEE1095700B063C454BB8301D22A544690

SHA256:

0CF297B8967C1B2C3CFE6D7C83234BF69B62FD08D73C29A4B7E785FACF931840

SSDEEP:

98304:HhEwQ5Vjeq2U6/KTNgPkDTOokIQvFRdyWExYfcmeuvN:HewQ5VjJ2U6/KTTDTOEQvFFESknuV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • vkontaktedj.exe (PID: 3232)

    • Loads dropped or rewritten executable

      • vkontaktedj.exe (PID: 3232)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • vkontaktedj.exe (PID: 3232)

    • Creates files in the user directory

      • vkontaktedj.exe (PID: 3232)
      • rundll32.exe (PID: 3196)

    • Uses RUNDLL32.EXE to load library

      • vkontaktedj.exe (PID: 3232)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 3196)
      • rundll32.exe (PID: 2828)
      • rundll32.exe (PID: 2516)

    • Modifies the open verb of a shell class

      • vkontaktedj.exe (PID: 3232)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (50)
.exe | InstallShield setup (19.6)
.exe | Win32 EXE PECompact compressed (generic) (18.9)
.exe | Win32 Executable Delphi generic (6.4)
.exe | Win32 Executable (generic) (2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
PEType: PE32
LinkerVersion: 2.25
CodeSize: 2511872
InitializedDataSize: 2669568
UninitializedDataSize: -
EntryPoint: 0x266164
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.76.0.0
ProductVersionNumber: 3.76.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: -
FileDescription: VKDJ, Player
FileVersion: 3.76.0.0
InternalName: -
LegalCopyright: Copyright (C) 2008. All rights reserved.
LegalTrademarks: -
OriginalFileName: VKontakte-DJ.exe
ProductName: VKontakte DJ
ProductVersion: 3.76
Comments: -

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Jun-1992 22:22:17
Detected languages:
  • Chinese - Hong Kong SAR
  • English - United States
  • German - Germany
  • Italian - Italy
  • Russian - Russia
  • Ukrainian - Ukraine
CompanyName: -
FileDescription: VKDJ, Player
FileVersion: 3.76.0.0
InternalName: -
LegalCopyright: Copyright (C) 2008. All rights reserved.
LegalTrademarks: -
OriginalFilename: VKontakte-DJ.exe
ProductName: VKontakte DJ
ProductVersion: 3.76
Comments: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 19-Jun-1992 22:22:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
CODE
0x00001000
0x00265260
0x00265400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.55382
DATA
0x00267000
0x00015CD0
0x00015E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.11088
BSS
0x0027D000
0x00002C95
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00280000
0x00003FE8
0x00004000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.06489
.tls
0x00284000
0x00000018
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x00285000
0x00000018
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
0.20692
.reloc
0x00286000
0x00025B54
0x00025C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.654
.rsrc
0x002AC000
0x0024C000
0x0024C000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
7.82998

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.06501
1377
UNKNOWN
Russian - Russia
RT_MANIFEST
2
5.05155
9640
UNKNOWN
Russian - Russia
RT_ICON
3
5.42398
3240
UNKNOWN
Russian - Russia
RT_ICON
4
5.28967
2440
UNKNOWN
Russian - Russia
RT_ICON
5
5.41649
1128
UNKNOWN
Russian - Russia
RT_ICON
6
2.62527
308
UNKNOWN
UNKNOWN
RT_CURSOR
7
2.91604
308
UNKNOWN
UNKNOWN
RT_CURSOR
8
1.49923
748
UNKNOWN
German - Germany
RT_CURSOR
9
1.45949
748
UNKNOWN
German - Germany
RT_CURSOR
10
1.81975
748
UNKNOWN
German - Germany
RT_CURSOR

Imports

GDI32.DLL
MSVCRT.DLL
advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
gdiplus.dll
kernel32.dll
ole32.dll
oleaut32.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vkontaktedj.exe rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2516"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\wininet.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—vkontaktedj.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2828"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\wininet.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—vkontaktedj.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3196"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\wininet.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—vkontaktedj.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3232"C:\Users\admin\AppData\Local\Temp\vkontaktedj.exe" C:\Users\admin\AppData\Local\Temp\vkontaktedj.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
VKDJ, Player
Exit code:
0
Version:
3.76.0.0
Modules
Images
c:\users\admin\appdata\local\temp\vkontaktedj.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
Total events
143
Read events
105
Write events
32
Delete events
6

Modification events

(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CURRENT_USER\Software\Vkontakte.dj
Operation:writeName:UniqID
Value:
{3AFDB90F-3F23-4D1C-8DC8-741D5E01E934}
(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:VkontakteDJ
Value:
C:\Users\admin\AppData\Local\Temp\vkontaktedj.exe /H
(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CLASSES_ROOT\VKDJFile\DefaultIcon
Operation:writeName:
Value:
C:\Users\admin\AppData\Local\Temp\vkontaktedj.exe, 0
(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CLASSES_ROOT\VKDJFile\shell\open\command
Operation:writeName:
Value:
"C:\Users\admin\AppData\Local\Temp\vkontaktedj.exe" "%l"
(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithProgids
Operation:delete keyName:
Value:
(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3
Operation:delete keyName:
Value:
(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithProgids
Operation:delete keyName:
Value:
(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4
Operation:delete keyName:
Value:
(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithProgids
Operation:delete keyName:
Value:
(PID) Process:(3232) vkontaktedj.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u
Operation:delete keyName:
Value:
Executable files
2
Suspicious files
0
Text files
8
Unknown types
6

Dropped files

PID
Process
Filename
Type
3196rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:—
SHA256:—
3232vkontaktedj.exeC:\Users\admin\AppData\Local\Temp\ssleay32.dllexecutable
MD5:D4C0D211332DEC5B8C11899E97F1D27C
SHA256:4906D6651D4C21E209F6E6AC781C5924AC18FACF099F8D3F1A9B5EB9498D7565
3232vkontaktedj.exeC:\Users\admin\AppData\Roaming\VKDJ\vvkp2.swfswf
MD5:1681CE9A5127E249E98F53CB9501694A
SHA256:42264D9ED7F066BE454D4E6A88FC3130782B49F5B02CF2DD88771D286E3B87B3
3196rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3196rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3232vkontaktedj.exeC:\Users\admin\AppData\Roaming\VKDJ\avkp2.swfswf
MD5:6979FED26D27015BBED50803F426E0B0
SHA256:5250550DA3932C2FEFDC1F27297AB3A040717FFBE0963A7171330C655C834932
3196rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\G3FOVZIA\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3196rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5TZK9KM2\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3196rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KTLISSW9\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3196rundll32.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
2
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3232
vkontaktedj.exe
GET
—
54.36.175.115:80
http://dj-updates.com/charts/vkdj.chart.utf.fast.json.zip
FR
—
—
suspicious
3232
vkontaktedj.exe
GET
302
87.240.182.224:80
http://vk.com/
RU
—
—
whitelisted
3232
vkontaktedj.exe
GET
200
54.36.175.115:80
http://dj-updates.com/download/VKontakteDJ-Updates.txt?version=3.76&bar=0&fr=absent&key={3AFDB90F-3F23-4D1C-8DC8-741D5E01E934}&newkey=019B9211963829E1145BBE092778F98B&newkey2=42366F19D5EEC1AF5206B46E735D4211-C4BA3647-60C53A74A89C1BE33548D917DD14E255&advert_key=ZWMwMDAxMDBiNDAwMDZlMTAwMDAwNmQzMDAwNmQzMDAwNmQzZDc4YzEzMDBjZA==k_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk_vk&ffclid=0&ieclid=0&chclid=0&opclid=0&browser=ie&setup=1
FR
html
6.62 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3232
vkontaktedj.exe
54.36.175.115:80
dj-updates.com
OVH SAS
FR
malicious
3232
vkontaktedj.exe
87.240.182.224:80
vk.com
VKontakte Ltd
RU
unknown
3232
vkontaktedj.exe
87.240.182.224:443
vk.com
VKontakte Ltd
RU
unknown

DNS requests

Domain
IP
Reputation
dj-updates.com
  • 54.36.175.115
suspicious
vk.com
  • 87.240.182.224
  • 87.240.190.67
  • 87.240.129.71
  • 87.240.129.72
  • 87.240.129.133
whitelisted

Threats

PID
Process
Class
Message
3232
vkontaktedj.exe
Generic Protocol Command Decode
SURICATA STREAM CLOSEWAIT FIN out of window
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vkontaktedj.exe