analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Project1.exe

Full analysis: https://app.any.run/tasks/2e67a0cc-507a-445b-8479-8a7c52a82029
Verdict: Malicious activity
Analysis date: August 25, 2019, 06:37:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C5D2480C37DFA380E71B206C857E510A

SHA1:

83433C8AD7BDB58DB8D348D169E42067F6F112B9

SHA256:

11C8865917C8DF4882262FDB4FD7DE46062B35302EC3737B8D01EC79A19FDE8C

SSDEEP:

12288:eEUMj5k/dRgupUgcQ2nIw7M8YyqnuFgUs2:eVFTg0CQ2Iccy+uPs2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Project1.exe (PID: 3352)

  • SUSPICIOUS

    • Reads the cookies of Mozilla Firefox

      • Project1.exe (PID: 3352)

    • Executable content was dropped or overwritten

      • Project1.exe (PID: 3352)

    • Changes the desktop background image

      • Project1.exe (PID: 3352)

    • Creates files in the user directory

      • notepad++.exe (PID: 2204)
      • Project1.exe (PID: 3352)

    • Creates files in the program directory

      • Project1.exe (PID: 3352)

  • INFO

    • Manual execution by user

      • notepad++.exe (PID: 2204)

    • Dropped object may contain Bitcoin addresses

      • Project1.exe (PID: 3352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (68.4)
.exe | Win32 Executable Borland Delphi 6 (27)
.exe | Win32 Executable Delphi generic (1.4)
.scr | Windows screen saver (1.3)
.dll | Win32 Dynamic Link Library (generic) (0.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
PEType: PE32
LinkerVersion: 2.25
CodeSize: 363520
InitializedDataSize: 86528
UninitializedDataSize: -
EntryPoint: 0x59b74
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Jun-1992 22:22:17
Detected languages:
  • Russian - Russia

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 19-Jun-1992 22:22:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
CODE
0x00001000
0x00058BBC
0x00058C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.55354
DATA
0x0005A000
0x00004530
0x00004600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.37528
BSS
0x0005F000
0x00000BA9
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00060000
0x00002136
0x00002200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.96702
.tls
0x00063000
0x00000010
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x00064000
0x00000018
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
0.20692
.reloc
0x00065000
0x000063D8
0x00006400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.6862
.rsrc
0x0006C000
0x00008400
0x00008400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
5.80868

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.85232
744
UNKNOWN
Russian - Russia
RT_ICON
2
2.80231
308
UNKNOWN
UNKNOWN
RT_CURSOR
3
3.00046
308
UNKNOWN
UNKNOWN
RT_CURSOR
4
2.56318
308
UNKNOWN
UNKNOWN
RT_CURSOR
5
2.6949
308
UNKNOWN
UNKNOWN
RT_CURSOR
6
2.62527
308
UNKNOWN
UNKNOWN
RT_CURSOR
7
2.91604
308
UNKNOWN
UNKNOWN
RT_CURSOR
4081
2.88322
336
UNKNOWN
UNKNOWN
RT_STRING
4082
3.35401
496
UNKNOWN
UNKNOWN
RT_STRING
4083
3.27601
456
UNKNOWN
UNKNOWN
RT_STRING

Imports

advapi32.dll
comctl32.dll
gdi32.dll
kernel32.dll
ole32.dll
oleaut32.dll
user32.dll
version.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start project1.exe notepad++.exe gup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3352"C:\Users\admin\Desktop\Project1.exe" C:\Users\admin\Desktop\Project1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
2204"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\citiesprocedures.rtf.lol"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
3468"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
Total events
91
Read events
74
Write events
17
Delete events
0

Modification events

(PID) Process:(3352) Project1.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:TileWallpaper
Value:
0
(PID) Process:(3352) Project1.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WallpaperStyle
Value:
10
(PID) Process:(3352) Project1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General
Operation:writeName:WallpaperSource
Value:
C:\vsworkdir\shantazh.jpg
(PID) Process:(2204) notepad++.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2204) notepad++.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2204) notepad++.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
54
Suspicious files
680
Text files
27
Unknown types
10

Dropped files

PID
Process
Filename
Type
3352Project1.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.lolbinary
MD5:F8D55B5DB691926AB45339DC83BE0C45
SHA256:5F1F18FD79AA26E87DDADD89DA03D08E68CFE2437A238488892C23E65F69FF3F
3352Project1.exeC:\Users\admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.lolbinary
MD5:936119BE19A1FB3C5FFCABA86E716AEF
SHA256:1B8E6F9C9A5F82832915BB728E253673E766129E6E97B12BAC080F7DD27094DA
3352Project1.exeC:\Users\admin\AppData\Local\FileZilla\default_dropdown12x12.png.lolbinary
MD5:C3115FC4F286F5B9CBB522794466260E
SHA256:2A0534A05BBAEC1B4BDE609A15F1CB6AF291EBA468D7AC5E2403DB70E4D3BD87
3352Project1.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.lolbinary
MD5:0822F99EAE97ACE01884A5A6CE15D09D
SHA256:59F522E8DE0767C88C3AA39AA1A08507EB8820B4ACAD7B2B69042106A6239BDB
3352Project1.exeC:\Users\admin\AppData\Local\CEF\User Data\Crashpad\settings.dat.lolbinary
MD5:06E8E8F1B62D00D981BFF72922925BFD
SHA256:E352909BFC95D80C7BF175BB6B727063AD27152F43B57FA39B0CC2BD73C3B71D
3352Project1.exeC:\Users\admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.lolbinary
MD5:BD9BA5162C1BDD95F1CFB393A335FF8D
SHA256:1CE5F6B53D05A344DCD3764923540912C027CAA6CD94A1160621953200D596FE
3352Project1.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.lolbinary
MD5:99B4336F32B8B638F80D9048157D3EEA
SHA256:D7AB80FB0190AFC84834401E1C45D76D6D49D22B7DD99B96DABF83F6CF3DD2D9
3352Project1.exeC:\Users\admin\AppData\Local\FileZilla\default_cancel24x24.png.lolbinary
MD5:57A414C327E728BD79781E3CCD684264
SHA256:B9AF8AC47025C07936080653FFEF7C0706DF5FE00BED8FB69B2DE8C706A4E291
3352Project1.exeC:\vsworkdir\CSCA1.DLLexecutable
MD5:B817A4C8CA2479BE0EA7E5DAB1CB4432
SHA256:567963838D1DAD2665C62EA7ACF29BB42A7887741F429C2650D51C81F96FA57B
3352Project1.exeC:\Users\admin\AppData\Local\FileZilla\default_compare20x20.png.lolbinary
MD5:79B2E5856EAD942DE283EC7D16B45BB6
SHA256:67139B31078A4F31FD46F0177F3E392F71F708EB7401F8A82C75B01ED02B5081
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
92.122.244.34:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
FR
der
1.37 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3468
gup.exe
37.59.28.236:443
notepad-plus-plus.org
OVH SAS
FR
whitelisted
—
—
92.122.244.34:80
isrg.trustid.ocsp.identrust.com
GTT Communications Inc.
FR
unknown

DNS requests

Domain
IP
Reputation
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
isrg.trustid.ocsp.identrust.com
  • 92.122.244.34
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Project1.exe