File name:

122e9453d8424952667d1fbac82b31ccf2ab4076d14f306d1d97d675bc6fe213

Full analysis: https://app.any.run/tasks/2b154c30-b676-4f55-8072-2699d18e56ac
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: January 10, 2025, 18:00:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
reflection
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

D29C88C314347EB87810E85E1E90A1F1

SHA1:

37082BCCBDE394171014C6A23BA59867FD0DB181

SHA256:

122E9453D8424952667D1FBAC82B31CCF2AB4076D14F306D1D97D675BC6FE213

SSDEEP:

49152:3nKJUS39a9yAEj51U1rvTWPvHpmhHTtf1r5YCr+6Mu1S9mxzoEY5fHZf2DAnEvLw:WUBEwBrqvJmBTbrWCy6R1SkxzoNfH96s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6224)
  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • 122e9453d8424952667d1fbac82b31ccf2ab4076d14f306d1d97d675bc6fe213.exe (PID: 3832)
    • Detects reflection assembly loader (YARA)

      • powershell.exe (PID: 6224)
    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 6224)
    • Executable content was dropped or overwritten

      • 122e9453d8424952667d1fbac82b31ccf2ab4076d14f306d1d97d675bc6fe213.exe (PID: 3832)
  • INFO

    • Reads the computer name

      • 122e9453d8424952667d1fbac82b31ccf2ab4076d14f306d1d97d675bc6fe213.exe (PID: 3832)
    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 6224)
    • The sample compiled with english language support

      • 122e9453d8424952667d1fbac82b31ccf2ab4076d14f306d1d97d675bc6fe213.exe (PID: 3832)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6224)
    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6224)
    • Checks supported languages

      • 122e9453d8424952667d1fbac82b31ccf2ab4076d14f306d1d97d675bc6fe213.exe (PID: 3832)
    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6224)
    • The process uses the downloaded file

      • powershell.exe (PID: 6224)
    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:30 16:55:21+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 161792
UninitializedDataSize: 1024
EntryPoint: 0x33d8
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.2.0.0
ProductVersionNumber: 3.2.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: circumspheral ubetvivlelig
FileDescription: pelsdyrsygdomme sms
InternalName: unarmoureds navigatrerne.exe
OriginalFileName: unarmoureds navigatrerne.exe
ProductName: levevejenes transkontinental omrres
ProductVersion: 3.2.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
2 417
Monitored processes
2 292
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 122e9453d8424952667d1fbac82b31ccf2ab4076d14f306d1d97d675bc6fe213.exe powershell.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs dxdiag.exe no specs dxdiag.exe no specs dxdiag.exe no specs dxdiag.exe no specs dxdiag.exe no specs dxdiag.exe no specs dxdiag.exe no specs dxdiag.exe no specs dxdiag.exe no specs dxdiag.exe no specs dxdiag.exe no specs