File name: | pl2303-prolific_driverinstaller_v1200.exe |
Full analysis: | https://app.any.run/tasks/f65a5767-2c4a-40d9-acbc-67493e2ffab5 |
Verdict: | Malicious activity |
Analysis date: | March 30, 2020, 18:05:07 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | C9F13A9133E36C85F54C839A8F446EDA |
SHA1: | C5F4631F565FA59198F114915721108E0438F5C5 |
SHA256: | 111D35D221B83DBAA8B00DEBF77F9FC735918F58BC3C1D5DE8FF5565A4127FBD |
SSDEEP: | 98304:Esq3hY9FjOpKhKqLhbpPoAPNGNgzQQyB2C+oi54EX1bCjYwCe1SskEBKeYrz:EsuwI2/Cxo4EX1GzCoS3EBzYP |
.ax | | | DirectShow filter (36.7) |
---|---|---|
.exe | | | Win32 EXE PECompact compressed (v2.x) (10.7) |
.exe | | | InstallShield setup (7.8) |
.exe | | | Win32 EXE PECompact compressed (generic) (7.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2007:04:19 02:08:20+02:00 |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 294912 |
InitializedDataSize: | 73728 |
UninitializedDataSize: | - |
EntryPoint: | 0x22094 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
FileVersionNumber: | 14.0.0.162 |
ProductVersionNumber: | 14.0.0.0 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Windows NT 32-bit |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
CompanyName: | Macrovision Corporation |
FileDescription: | Setup.exe |
FileVersion: | 14.0.162 |
InternalName: | Setup |
OriginalFileName: | Setup.exe |
LegalCopyright: | Copyright (C) 2007 Macrovision Corporation |
ProductName: | InstallShield |
ProductVersion: | 14 |
InternalBuildNumber: | 62562 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 19-Apr-2007 00:08:20 |
Detected languages: |
|
CompanyName: | Macrovision Corporation |
FileDescription: | Setup.exe |
FileVersion: | 14.0.162 |
InternalName: | Setup |
OriginalFilename: | Setup.exe |
LegalCopyright: | Copyright (C) 2007 Macrovision Corporation |
ProductName: | InstallShield |
ProductVersion: | 14.0 |
Internal Build Number: | 62562 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000108 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 4 |
Time date stamp: | 19-Apr-2007 00:08:20 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00047A42 | 0x00048000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.58216 |
.rdata | 0x00049000 | 0x00009A70 | 0x0000A000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.5637 |
.data | 0x00053000 | 0x0000742C | 0x00006000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.27497 |
.rsrc | 0x0005B000 | 0x00001B58 | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.13215 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.03019 | 895 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
2 | 6.39652 | 1384 | Latin 1 / Western European | UNKNOWN | RT_ICON |
3 | 3.9625 | 744 | Latin 1 / Western European | UNKNOWN | RT_ICON |
4 | 6.67739 | 2216 | Latin 1 / Western European | UNKNOWN | RT_ICON |
100 | 2.64576 | 62 | Latin 1 / Western European | UNKNOWN | RT_GROUP_ICON |
108 | 2.34615 | 66 | Latin 1 / Western European | UNKNOWN | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
LZ32.dll |
OLEAUT32.dll |
RPCRT4.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3864 | "C:\Users\admin\AppData\Local\Temp\pl2303-prolific_driverinstaller_v1200.exe" | C:\Users\admin\AppData\Local\Temp\pl2303-prolific_driverinstaller_v1200.exe | — | explorer.exe |
User: admin Company: Macrovision Corporation Integrity Level: MEDIUM Description: Setup.exe Exit code: 3221226540 Version: 14.0.162 | ||||
3976 | "C:\Users\admin\AppData\Local\Temp\pl2303-prolific_driverinstaller_v1200.exe" | C:\Users\admin\AppData\Local\Temp\pl2303-prolific_driverinstaller_v1200.exe | explorer.exe | |
User: admin Company: Macrovision Corporation Integrity Level: HIGH Description: Setup.exe Version: 14.0.162 | ||||
3408 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2576 | C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3632 | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\dpinst32.exe /PATH C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\VISTA\ /SW /LM /SA | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\dpinst32.exe | pl2303-prolific_driverinstaller_v1200.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Driver Package Installer Exit code: 256 Version: 2.1 | ||||
3880 | DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{799b8e74-8837-17ac-fa50-5400d2ab727c}\ser2pl.inf" "0" "6ea3e6133" "00000060" "WinSta0\Default" "000005C8" "208" "c:\users\admin\appdata\local\temp\{ca28a8bf-de11-4816-abfc-1636fe204aef}\{ecc3713c-08a4-40e3-95f1-7d0704f1ce5e}\vista" | C:\Windows\system32\DrvInst.exe | svchost.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setu8749.rra | — | |
MD5:— | SHA256:— | |||
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Lice8759.rra | — | |
MD5:— | SHA256:— | |||
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\dpin8768.rra | — | |
MD5:— | SHA256:— | |||
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\dpin8787.rra | — | |
MD5:— | SHA256:— | |||
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Rele87c6.rra | — | |
MD5:— | SHA256:— | |||
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setu87c6.rra | — | |
MD5:— | SHA256:— | |||
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_ISU87d6.rra | — | |
MD5:— | SHA256:— | |||
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\core87d6.rra | — | |
MD5:— | SHA256:— | |||
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{CA28A8BF-DE11-4816-ABFC-1636FE204AEF}\dotn87e5.rra | — | |
MD5:— | SHA256:— | |||
3976 | pl2303-prolific_driverinstaller_v1200.exe | C:\Users\admin\AppData\Local\Temp\{6CD26440-62FB-4611-997A-FB52C7C347DC}\Disk1\data1.cab | compressed | |
MD5:517D6BAEAEBE4591AEE05433C949FF7D | SHA256:5FD2DF73C8971DA509E806EF17FEF02A6B31C25D11C2271F91AC4D8381019F48 |