analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://img.syrusdesign.com/light.png?bg=sp34&os=TWljcm9zb2Z0IFdpbmRvd3MgNyBFbnRlcnByaXNlIA0NCg0NCg0NCg0NCg==&av=TWNBZmVlIEVuZHBvaW50IFNlY3VyaXR5IChhbnRpLXZpcnVzKXwxfDE=

Full analysis: https://app.any.run/tasks/cd30f6ae-c8bf-4c82-9d36-7260b718ac1f
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: March 21, 2019, 09:30:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

884E890BF412CD070D2AEA92F18F3A37

SHA1:

4D99B778A6B04D3C203177728279CEB17B6D2A33

SHA256:

1103877BD9624253728F65972FF10A941E9F1538A9A3AB8CA8E197238014D741

SSDEEP:

3:N1KX/LzCsZ5M+LUMGEKxygHvGXxws1B1B1mzOEVT0Giu4TzMzG+dn:CvLWoS0UMGEKfvGXxx1B1B1mmT4Cwn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • npp.7.5.9.Installer.exe (PID: 3176)
      • npp.7.5.9.Installer.exe (PID: 2264)
    • Downloads executable files from the Internet

      • opera.exe (PID: 1520)
    • Loads dropped or rewritten executable

      • npp.7.5.9.Installer.exe (PID: 3176)
  • SUSPICIOUS

    • Creates files in the user directory

      • notepad++.exe (PID: 2132)
    • Executable content was dropped or overwritten

      • opera.exe (PID: 1520)
      • gup.exe (PID: 2824)
      • npp.7.5.9.Installer.exe (PID: 3176)
  • INFO

    • Creates files in the user directory

      • opera.exe (PID: 1520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
9
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start opera.exe notepad++.exe gup.exe npp.7.5.9.installer.exe no specs npp.7.5.9.installer.exe mspaint.exe no specs PhotoViewer.dll no specs rundll32.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1520"C:\Program Files\Opera\opera.exe" http://img.syrusdesign.com/light.png?bg=sp34&os=TWljcm9zb2Z0IFdpbmRvd3MgNyBFbnRlcnByaXNlIA0NCg0NCg0NCg0NCg==&av=TWNBZmVlIEVuZHBvaW50IFNlY3VyaXR5IChhbnRpLXZpcnVzKXwxfDE=C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
2132"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\light.png"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
2824"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
2264"C:\Users\admin\AppData\Local\Temp\npp.7.5.9.Installer.exe" C:\Users\admin\AppData\Local\Temp\npp.7.5.9.Installer.exegup.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
3221226540
Version:
7.5.9.0
3176"C:\Users\admin\AppData\Local\Temp\npp.7.5.9.Installer.exe" C:\Users\admin\AppData\Local\Temp\npp.7.5.9.Installer.exe
gup.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
1
Version:
7.5.9.0
3068"C:\Windows\system32\mspaint.exe" "C:\Users\admin\Desktop\light.png"C:\Windows\system32\mspaint.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2072C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1088"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\light.pngC:\Windows\system32\rundll32.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4084"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\light.pngC:\Windows\system32\NOTEPAD.EXErundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 463
Read events
1 162
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
48
Text files
111
Unknown types
6

Dropped files

PID
Process
Filename
Type
1520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr8E2D.tmp
MD5:
SHA256:
1520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr8E3E.tmp
MD5:
SHA256:
1520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr8E8D.tmp
MD5:
SHA256:
1520opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00003.tmp
MD5:
SHA256:
1520opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\78ATKZEOX0F8DO2E55F7.temp
MD5:
SHA256:
1520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprA003.tmp
MD5:
SHA256:
1520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprABCB.tmp
MD5:
SHA256:
1520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:1961AEA93DF7D5258F016BF007344429
SHA256:FD2FEC094BB5EF2435D28DCA81F669617747CEB8764A115D504CCBD168D088E3
1520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr38AB.tmp
MD5:
SHA256:
1520opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:5FDC20A011788BD10752C9EB37464193
SHA256:49098B9B431BCDCC3F0A41207417797B27533738E220F51C844C622DF19D44CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
12
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1520
opera.exe
GET
200
66.225.197.197:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
543 b
whitelisted
GET
200
2.16.106.50:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEAXk3DuUOKs7hZfLpqGYUOM%3D
unknown
der
727 b
whitelisted
1520
opera.exe
GET
200
216.120.232.36:80
http://img.syrusdesign.com/light.png?bg=sp34&os=TWljcm9zb2Z0IFdpbmRvd3MgNyBFbnRlcnByaXNlIA0NCg0NCg0NCg0NCg==&av=TWNBZmVlIEVuZHBvaW50IFNlY3VyaXR5IChhbnRpLXZpcnVzKXwxfDE=
US
executable
500 Kb
malicious
GET
200
2.16.106.50:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
unknown
der
471 b
whitelisted
1520
opera.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOXQPQlVpLtFek%2BmcpabOk%3D
US
der
471 b
whitelisted
1520
opera.exe
GET
400
185.26.182.93:80
http://sitecheck2.opera.com/?host=img.syrusdesign.com&hdn=eQzOo0cMElAFLteSmUc8Kw==
unknown
html
166 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2824
gup.exe
37.59.28.236:443
notepad-plus-plus.org
OVH SAS
FR
whitelisted
1520
opera.exe
66.225.197.197:80
crl4.digicert.com
CacheNetworks, Inc.
US
whitelisted
1520
opera.exe
216.120.232.36:80
img.syrusdesign.com
HostRocket.com, Inc.
US
malicious
2.16.106.50:80
ocsp.usertrust.com
Akamai International B.V.
whitelisted
1520
opera.exe
185.26.182.93:80
sitecheck2.opera.com
Opera Software AS
whitelisted
1520
opera.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1520
opera.exe
82.145.215.40:443
certs.opera.com
Opera Software AS
whitelisted
1520
opera.exe
185.26.182.93:443
sitecheck2.opera.com
Opera Software AS
whitelisted

DNS requests

Domain
IP
Reputation
img.syrusdesign.com
  • 216.120.232.36
malicious
sitecheck2.opera.com
  • 185.26.182.93
  • 185.26.182.94
  • 185.26.182.111
  • 185.26.182.112
whitelisted
certs.opera.com
  • 82.145.215.40
whitelisted
crl4.digicert.com
  • 66.225.197.197
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
ocsp.usertrust.com
  • 2.16.106.50
  • 2.16.106.80
whitelisted
dragonfly.opera.com
  • 185.26.182.93
  • 185.26.182.94
whitelisted

Threats

PID
Process
Class
Message
1520
opera.exe
Misc activity
ET INFO Packed Executable Download
1520
opera.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1520
opera.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
1520
opera.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093