| File name: | file |
| Full analysis: | https://app.any.run/tasks/21fc88d8-314c-4e2f-b3a0-46a664773e62 |
| Verdict: | Malicious activity |
| Threats: | GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools |
| Analysis date: | December 05, 2022, 17:52:14 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, InnoSetup self-extracting archive |
| MD5: | 2610418CAD563CA14226D8B67FE62F5F |
| SHA1: | B29BDAEADFAB42C1F0E8ECA55D93F0BAD6608DC0 |
| SHA256: | 12A51C02710FE981D4163B9F304391D2DB1DF0DE9632E3EC13151B40EC015D13 |
| SSDEEP: | 98304:UO/LpSD4phXlwyaCOsECggbHd1KjGhzbcY/7:xV3Vqdgb9oj+bcY/7 |
MALICIOUS
G-cleaner network activity is detected
- PrintFolders.exe (PID: 2628)
Application was dropped or rewritten from another process
- 3TjXB.exe (PID: 500)
SUSPICIOUS
Reads the Internet Settings
- PrintFolders.exe (PID: 2628)
Reads the Windows owner or organization settings
- is-LBTOE.tmp (PID: 1068)
Reads Microsoft Outlook installation path
- PrintFolders.exe (PID: 2628)
Starts CMD.EXE for commands execution
- PrintFolders.exe (PID: 2628)
Uses TASKKILL.EXE to terminate process
- cmd.exe (PID: 1728)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 1728)
Creates a directory in Program Files
- is-LBTOE.tmp (PID: 1068)
Connects to the server without a host name
- PrintFolders.exe (PID: 2628)
INFO
Checks supported languages
- is-LBTOE.tmp (PID: 1068)
- file.exe (PID: 3612)
- 3TjXB.exe (PID: 500)
- PrintFolders.exe (PID: 2628)
Reads the computer name
- is-LBTOE.tmp (PID: 1068)
- PrintFolders.exe (PID: 2628)
Creates a file in a temporary directory
- file.exe (PID: 3612)
- is-LBTOE.tmp (PID: 1068)
Creates files in the program directory
- is-LBTOE.tmp (PID: 1068)
Creates a software uninstall entry
- is-LBTOE.tmp (PID: 1068)
Loads dropped or rewritten executable
- is-LBTOE.tmp (PID: 1068)
Application was dropped or rewritten from another process
- is-LBTOE.tmp (PID: 1068)
Checks proxy server information
- PrintFolders.exe (PID: 2628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (82.8) |
|---|---|---|
| .exe | | | Win32 Executable Delphi generic (10.7) |
| .exe | | | Win32 Executable (generic) (3.4) |
| .exe | | | Generic Win/DOS Executable (1.5) |
| .exe | | | DOS Executable Generic (1.5) |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 1992-Jun-19 22:22:17 |
| Detected languages: |
|
| Comments: | This installation was built with Inno Setup: http://www.innosetup.com |
| CompanyName: | - |
| FileDescription: | PrintFolders Setup |
| FileVersion: | - |
| InternalName: | - |
| OriginalFilename: | - |
| ProductName: | - |
| ProductVersion: | - |
DOS Header
| e_magic: | MZ |
|---|---|
| e_cblp: | 80 |
| e_cp: | 2 |
| e_crlc: | - |
| e_cparhdr: | 4 |
| e_minalloc: | 15 |
| e_maxalloc: | 65535 |
| e_ss: | - |
| e_sp: | 184 |
| e_csum: | - |
| e_ip: | - |
| e_cs: | - |
| e_ovno: | 26 |
| e_oemid: | - |
| e_oeminfo: | - |
| e_lfanew: | 256 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| NumberofSections: | 8 |
| TimeDateStamp: | 1992-Jun-19 22:22:17 |
| PointerToSymbolTable: | - |
| NumberOfSymbols: | - |
| SizeOfOptionalHeader: | 224 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
CODE | 4096 | 36352 | 36352 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.60044 |
DATA | 40960 | 584 | 1024 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.72043 |
BSS | 45056 | 3684 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.idata | 49152 | 2248 | 2560 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.2508 |
.tls | 53248 | 8 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.rdata | 57344 | 24 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 0.199108 |
.reloc | 61440 | 2156 | 0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | |
.rsrc | 65536 | 167124 | 167424 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 5.27927 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.39383 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
2 | 5.94971 | 2440 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 5.5357 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 5.48577 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 5.25469 | 16936 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 5.46372 | 21640 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 5.3545 | 38056 | Latin 1 / Western European | English - United States | RT_ICON |
8 | 4.90318 | 67624 | Latin 1 / Western European | English - United States | RT_ICON |
4089 | 3.21823 | 754 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4090 | 3.31515 | 780 | Latin 1 / Western European | UNKNOWN | RT_STRING |
Imports
advapi32.dll |
advapi32.dll (#2) |
comctl32.dll |
kernel32.dll |
kernel32.dll (#2) |
oleaut32.dll |
user32.dll |
user32.dll (#2) |
Total processes
45
Monitored processes
7
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 500 | C:\Users\admin\AppData\Roaming\{e29ac6c0-7037-11de-816d-806e6f6e6963}\3TjXB.exe | — | PrintFolders.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1068 | "C:\Users\admin\AppData\Local\Temp\is-6QSEB.tmp\is-LBTOE.tmp" /SL4 $30138 "C:\Users\admin\AppData\Local\Temp\file.exe" 3740741 208896 | C:\Users\admin\AppData\Local\Temp\is-6QSEB.tmp\is-LBTOE.tmp | — | file.exe | |||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.42.0.0 Modules
| |||||||||||||||
| 1728 | "C:\Windows\System32\cmd.exe" /c taskkill /im "PrintFolders.exe" /f & erase "C:\Program Files\PrintFolders\PrintFolders.exe" & exit | C:\Windows\System32\cmd.exe | — | PrintFolders.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2628 | "C:\Program Files\PrintFolders\PrintFolders.exe" | C:\Program Files\PrintFolders\PrintFolders.exe | is-LBTOE.tmp | ||||||||||||
User: admin Company: Atr Software Integrity Level: HIGH Description: Data Recovery Exit code: 0 Version: 1.2.3.100 Modules
| |||||||||||||||
| 2756 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Integrity Level: MEDIUM Description: PrintFolders Setup Exit code: 3221226540 Version: Modules
| |||||||||||||||
| 3216 | taskkill /im "PrintFolders.exe" /f | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3612 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | Explorer.EXE | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: PrintFolders Setup Exit code: 0 Version: Modules
| |||||||||||||||
Total events
1 360
Read events
1 326
Write events
34
Delete events
0
Modification events
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_CURRENT_USER\Software\Atzpoint Software\PrintFolders |
| Operation: | write | Name: | Language |
Value: eng | |||
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2483D7A-78F2-476F-86FF-6B2EA9310854}}_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 5.1.2-beta | |||
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2483D7A-78F2-476F-86FF-6B2EA9310854}}_is1 |
| Operation: | write | Name: | Inno Setup: App Path |
Value: C:\Program Files\PrintFolders | |||
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2483D7A-78F2-476F-86FF-6B2EA9310854}}_is1 |
| Operation: | write | Name: | InstallLocation |
Value: C:\Program Files\PrintFolders\ | |||
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2483D7A-78F2-476F-86FF-6B2EA9310854}}_is1 |
| Operation: | write | Name: | Inno Setup: Icon Group |
Value: PrintFolders | |||
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2483D7A-78F2-476F-86FF-6B2EA9310854}}_is1 |
| Operation: | write | Name: | Inno Setup: User |
Value: admin | |||
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2483D7A-78F2-476F-86FF-6B2EA9310854}}_is1 |
| Operation: | write | Name: | DisplayName |
Value: PrintFolders 3.100 | |||
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2483D7A-78F2-476F-86FF-6B2EA9310854}}_is1 |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\PrintFolders\PrintFolders.exe | |||
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2483D7A-78F2-476F-86FF-6B2EA9310854}}_is1 |
| Operation: | write | Name: | UninstallString |
Value: "C:\Program Files\PrintFolders\unins000.exe" | |||
| (PID) Process: | (1068) is-LBTOE.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2483D7A-78F2-476F-86FF-6B2EA9310854}}_is1 |
| Operation: | write | Name: | QuietUninstallString |
Value: "C:\Program Files\PrintFolders\unins000.exe" /SILENT | |||
Executable files
8
Suspicious files
4
Text files
5
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1068 | is-LBTOE.tmp | C:\Program Files\PrintFolders\is-CLQTT.tmp | — | |
MD5:— | SHA256:— | |||
| 1068 | is-LBTOE.tmp | C:\Program Files\PrintFolders\PrintFolders.exe | — | |
MD5:— | SHA256:— | |||
| 1068 | is-LBTOE.tmp | C:\Program Files\PrintFolders\unins000.exe | executable | |
MD5:— | SHA256:— | |||
| 1068 | is-LBTOE.tmp | C:\Program Files\PrintFolders\is-C76RU.tmp | executable | |
MD5:— | SHA256:— | |||
| 1068 | is-LBTOE.tmp | C:\Program Files\PrintFolders\unins000.dat | dat | |
MD5:— | SHA256:— | |||
| 2628 | PrintFolders.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ping[1].htm | text | |
MD5:— | SHA256:— | |||
| 2628 | PrintFolders.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\fuckingdllENCR[1].dll | binary | |
MD5:— | SHA256:— | |||
| 3612 | file.exe | C:\Users\admin\AppData\Local\Temp\is-6QSEB.tmp\is-LBTOE.tmp | executable | |
MD5:— | SHA256:— | |||
| 1068 | is-LBTOE.tmp | C:\Users\admin\AppData\Local\Temp\is-L58HU.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
| 1068 | is-LBTOE.tmp | C:\Users\admin\AppData\Local\Temp\is-L58HU.tmp\_iscrypt.dll | executable | |
MD5:A69559718AB506675E907FE49DEB71E9 | SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
3
DNS requests
0
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2628 | PrintFolders.exe | GET | 200 | 107.182.129.235:80 | http://107.182.129.235/storage/extension.php | US | binary | 92.0 Kb | malicious |
2628 | PrintFolders.exe | GET | 200 | 107.182.129.235:80 | http://107.182.129.235/storage/ping.php | US | text | 17 b | malicious |
2628 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
2628 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
2628 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
2628 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
2628 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
2628 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
2628 | PrintFolders.exe | GET | 200 | 45.139.105.171:80 | http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte | BG | binary | 1 b | malicious |
2628 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2628 | PrintFolders.exe | 45.139.105.171:80 | — | Xdeer Limited | BG | malicious |
2628 | PrintFolders.exe | 107.182.129.235:80 | — | Delis LLC | US | malicious |
2628 | PrintFolders.exe | 171.22.30.106:80 | — | Delis LLC | US | malicious |