File name: | paws-1.0.0.0-win32-setup.exe |
Full analysis: | https://app.any.run/tasks/0c7dea20-61f9-4c3a-b64e-8b311aca0fab |
Verdict: | Malicious activity |
Analysis date: | November 14, 2018, 07:00:43 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | 0D3D03DD3305DF7DDA07321EEB4B2CC1 |
SHA1: | EC5263CE9D245504C8D1B95C98E04239794E719F |
SHA256: | 17118A421433E6AF3905ED7DF7B67DC3FC53B2B8B059207837E9EC3A1443C932 |
SSDEEP: | 393216:KghlqGsu99QLWRhf8Dm0iOtDfbE2VPlcv2:Kghlbtj8WPEfrtDTOe |
.exe | | | NSIS - Nullsoft Scriptable Install System (91.9) |
---|---|---|
.exe | | | Win32 Executable MS Visual C++ (generic) (3.3) |
.exe | | | Win64 Executable (generic) (3) |
.dll | | | Win32 Dynamic Link Library (generic) (0.7) |
.exe | | | Win32 Executable (generic) (0.4) |
ProductVersion: | 1.0.0 |
---|---|
ProductName: | PAWS Core |
LegalCopyright: | - |
FileVersion: | 1.0.0 |
FileDescription: | - |
CompanyWebsite: | https://www.paws.org |
CompanyName: | PAWS Core project |
CharacterSet: | ASCII |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0000 |
ProductVersionNumber: | 1.0.0.0 |
FileVersionNumber: | 1.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | 6 |
OSVersion: | 4 |
EntryPoint: | 0x4377 |
UninitializedDataSize: | 110592 |
InitializedDataSize: | 34304 |
CodeSize: | 35328 |
LinkerVersion: | 2.24 |
PEType: | PE32 |
TimeStamp: | 2014:12:16 09:04:35+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 16-Dec-2014 08:04:35 |
Detected languages: |
|
CompanyName: | PAWS Core project |
CompanyWebsite: | https://www.paws.org |
FileDescription: | - |
FileVersion: | 1.0.0 |
LegalCopyright: | - |
ProductName: | PAWS Core |
ProductVersion: | 1.0.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 7 |
Time date stamp: | 16-Dec-2014 08:04:35 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0000884C | 0x00008A00 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.92753 |
.data | 0x0000A000 | 0x00000100 | 0x00000200 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.17347 |
.rdata | 0x0000B000 | 0x00005978 | 0x00005A00 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.17516 |
.bss | 0x00011000 | 0x0001AE80 | 0x00000000 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x0002C000 | 0x00001304 | 0x00001400 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.24409 |
.ndata | 0x0002E000 | 0x00015000 | 0x00000400 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00043000 | 0x0005B658 | 0x0005B800 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.28161 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.22735 | 957 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 4.64755 | 67624 | UNKNOWN | English - United States | RT_ICON |
3 | 5.19117 | 16936 | UNKNOWN | English - United States | RT_ICON |
4 | 5.4434 | 9640 | UNKNOWN | English - United States | RT_ICON |
5 | 5.87806 | 4264 | UNKNOWN | English - United States | RT_ICON |
6 | 6.30874 | 1128 | UNKNOWN | English - United States | RT_ICON |
7 | 0 | 296 | UNKNOWN | English - United States | RT_ICON |
103 | 2.70255 | 104 | UNKNOWN | English - United States | RT_GROUP_ICON |
105 | 2.69006 | 582 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.84976 | 260 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.DLL |
GDI32.dll |
KERNEL32.dll |
SHELL32.DLL |
USER32.dll |
VERSION.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2376 | "C:\Users\admin\AppData\Local\Temp\paws-1.0.0.0-win32-setup.exe" | C:\Users\admin\AppData\Local\Temp\paws-1.0.0.0-win32-setup.exe | — | explorer.exe |
User: admin Company: PAWS Core project Integrity Level: MEDIUM Exit code: 3221226540 Version: 1.0.0 | ||||
2404 | "C:\Users\admin\AppData\Local\Temp\paws-1.0.0.0-win32-setup.exe" | C:\Users\admin\AppData\Local\Temp\paws-1.0.0.0-win32-setup.exe | explorer.exe | |
User: admin Company: PAWS Core project Integrity Level: HIGH Exit code: 0 Version: 1.0.0 | ||||
3292 | "C:\Program Files\PAWS\paws-qt.exe" | C:\Program Files\PAWS\paws-qt.exe | paws-1.0.0.0-win32-setup.exe | |
User: admin Integrity Level: HIGH | ||||
4060 | C:\Windows\system32\wbem\WmiApSrv.exe | C:\Windows\system32\wbem\WmiApSrv.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Performance Reverse Adapter Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_CURRENT_USER\Software\PAWS Core (32-bit)\Components |
Operation: | write | Name: | Main |
Value: 1 | |||
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_CURRENT_USER\Software\PAWS Core (32-bit) |
Operation: | write | Name: | Path |
Value: C:\Program Files\PAWS | |||
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\PAWS Core (32-bit) |
Operation: | write | Name: | StartMenuGroup |
Value: PAWS Core | |||
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PAWS Core (32-bit) |
Operation: | write | Name: | DisplayName |
Value: PAWS Core (32-bit) | |||
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PAWS Core (32-bit) |
Operation: | write | Name: | DisplayVersion |
Value: 1.0.0 | |||
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PAWS Core (32-bit) |
Operation: | write | Name: | Publisher |
Value: PAWS Core project | |||
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PAWS Core (32-bit) |
Operation: | write | Name: | URLInfoAbout |
Value: https://www.paws.org | |||
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PAWS Core (32-bit) |
Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\PAWS\uninstall.exe | |||
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PAWS Core (32-bit) |
Operation: | write | Name: | UninstallString |
Value: C:\Program Files\PAWS\uninstall.exe | |||
(PID) Process: | (2404) paws-1.0.0.0-win32-setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PAWS Core (32-bit) |
Operation: | write | Name: | NoModify |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2404 | paws-1.0.0.0-win32-setup.exe | C:\Users\admin\AppData\Local\Temp\nsqC8BC.tmp\modern-header.bmp | image | |
MD5:BA6CEB853AA2C045E404E7C51FD77445 | SHA256:DD64DA5FFD18C968A529426EA69EA3128D3491A904187AE58ECCE40EE059AB36 | |||
2404 | paws-1.0.0.0-win32-setup.exe | C:\Program Files\PAWS\COPYING.txt | text | |
MD5:E8477E83F962518F5E6F702A9B40FB88 | SHA256:D06E0D389DD4C5987F45F7DA03134CAE4D8F1A0F4172C19594115848D0C6A60D | |||
2404 | paws-1.0.0.0-win32-setup.exe | C:\Users\admin\AppData\Local\Temp\nsqC8BC.tmp\StartMenu.dll | executable | |
MD5:2E42C14DB7CDE51422FA7324E96E3D06 | SHA256:E668B8967521D32D80DF1A409599BEFC9C460E214A7F061E5FC2BB29925CE976 | |||
2404 | paws-1.0.0.0-win32-setup.exe | C:\Program Files\PAWS\doc\build-osx.md | text | |
MD5:F2C9739ED3E463D3B0CAF52697ED24B6 | SHA256:5D3542DAE9E098813CDAE5E1F0D2EDF3064262C16D594A9CBB9F69BDCF994E10 | |||
2404 | paws-1.0.0.0-win32-setup.exe | C:\Program Files\PAWS\doc\README_osx.md | text | |
MD5:CEE75FAD49284535D6D58D370C8F9014 | SHA256:275E9861DBDE77BCBC4206E941368D490B7274D5137A943F138851ED5FB86132 | |||
2404 | paws-1.0.0.0-win32-setup.exe | C:\Program Files\PAWS\doc\REST-interface.md | html | |
MD5:0AF24379B479353C73420CE079CF87C5 | SHA256:7464FF07E0A1F939E85EC7E2183708D3E774D9CD1C5CD83C962FC639362EE89E | |||
2404 | paws-1.0.0.0-win32-setup.exe | C:\Program Files\PAWS\daemon\pawsd.exe | executable | |
MD5:D75F51F4D78AB635CFC6E7E654B5CA0E | SHA256:90767A0F1CCFC7522C7557180BF2955A2D37F798FD9937B5E8052F47AD1563A7 | |||
2404 | paws-1.0.0.0-win32-setup.exe | C:\Program Files\PAWS\paws-qt.exe | executable | |
MD5:828786AB11A35CB874929D46E7C247A2 | SHA256:D7B9332D3CA9124D8DEB26AB63B6EAC3FDB3DE1F32B214292428C744AE83976E | |||
2404 | paws-1.0.0.0-win32-setup.exe | C:\Program Files\PAWS\doc\README_windows.txt | text | |
MD5:57F550031DD04AA524FC3DE087443766 | SHA256:ECD4ACD04D05CF04885D56128A9A72D68917B93E5DA8B77100BA57AA6C462652 | |||
2404 | paws-1.0.0.0-win32-setup.exe | C:\Users\admin\AppData\Local\Temp\nsqC8BC.tmp\modern-wizard.bmp | image | |
MD5:E6E85AD7BD761F6BE00C2C91BB1D5225 | SHA256:C46B15B4702BC8E538FDB727F035D35AA072EC366404AE1E3E21D178113A1CB7 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3292 | paws-qt.exe | 104.207.130.217:34120 | — | Choopa, LLC | DE | unknown |
3292 | paws-qt.exe | 45.77.5.22:34120 | — | Choopa, LLC | US | unknown |
3292 | paws-qt.exe | 45.63.10.156:34120 | — | Choopa, LLC | US | unknown |
3292 | paws-qt.exe | 95.179.200.213:34120 | — | Cosmoline Telecommunication Services S.A. | GR | unknown |
3292 | paws-qt.exe | 144.202.53.246:34120 | — | Baltimore Technology Park, LLC | US | unknown |
3292 | paws-qt.exe | 45.32.145.142:34120 | — | Choopa, LLC | FR | unknown |
3292 | paws-qt.exe | 139.162.224.106:34120 | paws.fund | Linode, LLC | GB | unknown |
Domain | IP | Reputation |
---|---|---|
paws.fund |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
3292 | paws-qt.exe | Misc activity | SUSPICIOUS [PTsecurity] CoinWallet (PUA) |
Process | Message |
---|---|
paws-qt.exe | Invalid parameter passed to C runtime function.
|