File name:

Proxy Grabber and Checker.exe

Full analysis: https://app.any.run/tasks/3f067514-85ef-426f-90c6-328dc61129e9
Verdict: Malicious activity
Analysis date: August 11, 2023, 02:53:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

2A3854EB7CB7BCBEE20EC8C210C21A2E

SHA1:

B8ACE39768190B4BBFCF49D3C7CDEA3DD0B5147D

SHA256:

154E82B794F874FBDCED0D93CCDB4227F4D49018D51F6A473BAD994AA08AD7E1

SSDEEP:

12288:FY/BsGiBDniBD/iBDIgsgPuRZc+andMhV9mHviw30I0le+NPmTiBD:EqzqLq8SPkZc+LhLm6w30I00+0q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads settings of System Certificates

      • Proxy Grabber and Checker.exe (PID: 2968)

    • Reads the Internet Settings

      • Proxy Grabber and Checker.exe (PID: 2968)

  • INFO

    • Checks supported languages

      • Proxy Grabber and Checker.exe (PID: 2968)

    • The process checks LSA protection

      • Proxy Grabber and Checker.exe (PID: 2968)

    • Reads the machine GUID from the registry

      • Proxy Grabber and Checker.exe (PID: 2968)

    • Reads the computer name

      • Proxy Grabber and Checker.exe (PID: 2968)

    • Reads Environment values

      • Proxy Grabber and Checker.exe (PID: 2968)

    • Create files in a temporary directory

      • Proxy Grabber and Checker.exe (PID: 2968)

    • Creates files or folders in the user directory

      • Proxy Grabber and Checker.exe (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

AssemblyVersion: 3.1.11.2
ProductVersion: 3.1.11.2
ProductName: PGC
OriginalFileName: Proxy Grabber and Checker.exe
LegalTrademarks: wDude (LZT: БатькаВсеяРашн)
LegalCopyright: БатькаВсеяРашн © 2020
InternalName: Proxy Grabber and Checker.exe
FileVersion: 3.1.11.2
FileDescription: Proxy Grabber and Checker by wDude
CompanyName: wDude
Comments: Proxy Grabber and Checker by wDude
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 3.1.11.2
FileVersionNumber: 3.1.11.2
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 4
EntryPoint: 0xd0a3e
UninitializedDataSize: -
InitializedDataSize: 70144
CodeSize: 846848
LinkerVersion: 48
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2082:05:15 15:57:05+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-May-2082 15:57:05
Debug artifacts:
  • C:\Users\Artur\source\repos\PGC\PGC\obj\Release\Proxy Grabber and Checker.pdb
Comments: Proxy Grabber and Checker by wDude
CompanyName: wDude
FileDescription: Proxy Grabber and Checker by wDude
FileVersion: 3.1.11.2
InternalName: Proxy Grabber and Checker.exe
LegalCopyright: БатькаВсеяРашн © 2020
LegalTrademarks: wDude (LZT: БатькаВсеяРашн)
OriginalFilename: Proxy Grabber and Checker.exe
ProductName: PGC
ProductVersion: 3.1.11.2
Assembly Version: 3.1.11.2

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 15-May-2082 15:57:05
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x000CEA44
0x000CEC00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.31561
.rsrc
0x000D2000
0x00010F78
0x00011000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.18814
.reloc
0x000E4000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.0815394

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST
32512
1.98048
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start proxy grabber and checker.exe

Process information

PID
CMD
Path
Indicators
Parent process
2968"C:\Users\admin\AppData\Local\Temp\Proxy Grabber and Checker.exe" C:\Users\admin\AppData\Local\Temp\Proxy Grabber and Checker.exe
explorer.exe
User:
admin
Company:
wDude
Integrity Level:
MEDIUM
Description:
Proxy Grabber and Checker by wDude
Exit code:
0
Version:
3.1.11.2
Modules
Images
c:\users\admin\appdata\local\temp\proxy grabber and checker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\kernelbase.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
Total events
4 343
Read events
4 331
Write events
12
Delete events
0

Modification events

(PID) Process:(2968) Proxy Grabber and Checker.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2968Proxy Grabber and Checker.exeC:\Users\admin\AppData\Local\Temp\CabB3B6.tmpcompressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
2968Proxy Grabber and Checker.exeC:\Users\admin\AppData\Roaming\PGC\urlsHTTP.txttext
MD5:977DAC55DAAB50E52D1BF957F3339665
SHA256:8E279274A0226D3120473A47F7238EF5CBE24EBDEAB48B9F3AE8BCB3AA46E962
2968Proxy Grabber and Checker.exeC:\Users\admin\AppData\Local\Temp\TarB3B7.tmpbinary
MD5:4FF65AD929CD9A367680E0E5B1C08166
SHA256:C8733C93CC5AAF5CA206D06AF22EE8DBDEC764FB5085019A6A9181FEB9DFDEE6
2968Proxy Grabber and Checker.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
2968Proxy Grabber and Checker.exeC:\Users\admin\AppData\Roaming\PGC\urlsSOCKS5.txttext
MD5:A782A0FDAFEC670F77F0EBC94E9F151D
SHA256:216C945CD5A00DC06177D37E9050D7D9EC4E2C094A63AB0B8939043126270142
2968Proxy Grabber and Checker.exeC:\Users\admin\AppData\Roaming\PGC\urlsSOCKS4.txttext
MD5:2F9B0356AE5E008C2EF3F042E03BB68E
SHA256:1AADFAB2A6B3382AC1146098779326596AB6C918AA69437C463F0017681D1F2F
2968Proxy Grabber and Checker.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:5FA8C20AD5F36346DD23414D8AFD9457
SHA256:0676632AA2A612CE1D97516F10F161C49C9992B0D6CA48D4DAE9A56DD94F987A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
12
DNS requests
4
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2968
Proxy Grabber and Checker.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d9c1c8aff61f1cba
US
compressed
62.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2968
Proxy Grabber and Checker.exe
104.18.11.5:443
api.proxyscrape.com
CLOUDFLARENET
—
suspicious
2968
Proxy Grabber and Checker.exe
188.114.96.3:443
www.proxy-list.download
CLOUDFLARENET
NL
malicious
2968
Proxy Grabber and Checker.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2968
Proxy Grabber and Checker.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
malicious

DNS requests

Domain
IP
Reputation
api.proxyscrape.com
  • 104.18.11.5
  • 104.18.10.5
suspicious
www.proxy-list.download
  • 188.114.96.3
  • 188.114.97.3
malicious
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
shared

Threats

PID
Process
Class
Message
1088
svchost.exe
Potentially Bad Traffic
ET INFO Public Proxy Service Domain in DNS Lookup (api .proxyscrape .com)
2968
Proxy Grabber and Checker.exe
Potentially Bad Traffic
ET INFO Observed Public Proxy Service Domain (api .proxyscrape .com in TLS SNI)
2968
Proxy Grabber and Checker.exe
Potentially Bad Traffic
ET INFO Observed Public Proxy Service Domain (api .proxyscrape .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Proxy Grabber and Checker.exe