File name:

mingw-w64-install.exe

Full analysis: https://app.any.run/tasks/965f20c8-ab6b-41d3-9b5a-60a7b7c2f2ee
Verdict: Malicious activity
Analysis date: February 09, 2021, 16:26:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9670C3701F0B546CA63A3E6D7749E59E

SHA1:

224AF96CE7B76C4D27C8D44061B1BF633CDD4EB1

SHA256:

19B9A267A5B79913BF6A3A53CDA83C3F7711CB6C879D48CCB97B4ED15C21FCF1

SSDEEP:

24576:QQ9odX6E2ccOgz/HVdwpCdgyB7UqI5BuKmQn2:QQG6E2cRM/EpAgyWqI5BuKk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • mingw-w64-install.exe (PID: 2164)

    • Drops executable file immediately after starts

      • mingw-w64-install.exe (PID: 2164)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • mingw-w64-install.exe (PID: 2164)

    • Reads Windows owner or organization settings

      • mingw-w64-install.exe (PID: 2164)

    • Reads the Windows organization settings

      • mingw-w64-install.exe (PID: 2164)

    • Creates a directory in Program Files

      • mingw-w64-install.exe (PID: 2164)

    • Creates files in the program directory

      • mingw-w64-install.exe (PID: 2164)

    • Drops a file that was compiled in debug mode

      • mingw-w64-install.exe (PID: 2164)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:01:31 18:44:13+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 4096
InitializedDataSize: 950272
UninitializedDataSize: -
EntryPoint: 0x1d20
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 31-Jan-2011 17:44:13
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 31-Jan-2011 17:44:13
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00000EAC
0x00001000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.942
.rdata
0x00002000
0x00000488
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.73994
.data
0x00003000
0x00000560
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.01054
.gentee
0x00004000
0x000DE591
0x000DF000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.99874
.rsrc
0x000E3000
0x00006804
0x00007000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.28972

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.0664
1910
Latin 1 / Western European
English - United States
RT_MANIFEST
1000
2.23119
54
Latin 1 / Western European
English - United States
RT_DIALOG
IDD_DLGFIN2
2.60838
472
Latin 1 / Western European
English - United States
RT_DIALOG
IDD_DLGPATH
2.68908
544
Latin 1 / Western European
English - United States
RT_DIALOG
IDD_DLGPOPUP
2.77068
140
Latin 1 / Western European
UNKNOWN
RT_DIALOG
IDD_DLGPROG
2.78207
600
Latin 1 / Western European
English - United States
RT_DIALOG
IDD_DLGSETS
2.73533
504
Latin 1 / Western European
English - United States
RT_DIALOG
IDD_DLGUCONF2
2.48111
312
Latin 1 / Western European
English - United States
RT_DIALOG
IDD_DLGUFIN2
2.57141
440
Latin 1 / Western European
UNKNOWN
RT_DIALOG
IDD_DLGUNDEL
2.66424
408
Latin 1 / Western European
UNKNOWN
RT_DIALOG

Imports

KERNEL32.dll
MSVCRT.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mingw-w64-install.exe mingw-w64-install.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
556"C:\Users\admin\AppData\Local\Temp\mingw-w64-install.exe" C:\Users\admin\AppData\Local\Temp\mingw-w64-install.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\mingw-w64-install.exe
c:\systemroot\system32\ntdll.dll
2164"C:\Users\admin\AppData\Local\Temp\mingw-w64-install.exe" C:\Users\admin\AppData\Local\Temp\mingw-w64-install.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\mingw-w64-install.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
148
Read events
147
Write events
0
Delete events
1

Modification events

(PID) Process:(2164) mingw-w64-install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\tmp
Operation:delete keyName:(default)
Value:
Executable files
5
Suspicious files
0
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteert.dllexecutable
MD5:6CE814FD1AD7AE07A9E462C26B3A0F69
SHA256:54C0DA1735BB1CB02B60C321DE938488345F8D1D26BF389C8CB2ACAD5D01B831
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteeB9\setup_temp.geabs
MD5:07DF5BAE522F97C31637B4CE9C0430EC
SHA256:641F335F40CFC53FC3E908F9282A9272906C21BD97A44A3E1513B8B35FEBA4A5
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteeB9\4default - 1.bmpimage
MD5:14A455E9EEF9FE7FEA4DE14D579A3E84
SHA256:B666E6BD71EFF3547FB2F5580AC61C64527F6F9BE6A2178FA00F80E32431460A
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteeB9\guig.dllexecutable
MD5:D3F8C0334C19198A109E44D074DAC5FD
SHA256:005C251C21D6A5BA1C3281E7B9F3B4F684D007E0C3486B34A545BB370D8420AA
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteeB9\repository.txttext
MD5:669DA4EEF058E4A7531249B00436D185
SHA256:A713225C5E0312AE8EC2353C1EB2AAA34A857CEB47A1E0D0773A8048153F597E
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteeB9\ssleay32.dllexecutable
MD5:CD850E46537054218D53EBE74A896500
SHA256:3275B53A5F3A39AA9348ACCD4B5F488A243F69C739A63FE34E947CE321BE903D
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteeB9\7zci.dllexecutable
MD5:AF3801F29002D8FA68ED44E0C7C4182D
SHA256:65F7A03AB6775E08A89C595486EBE18E7EBF61705103A251F1BD5272956A3720
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteeB9\2install - 1.bmpimage
MD5:E168634D6C44995C14608F16C2E28693
SHA256:06263008AB7AB756D1254CE744B389F71B0DFFB186EBFA8BB0D2603271E9C6DA
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteeB9\libeay32.dllexecutable
MD5:246C1AA481FA369115E6F7BB1E460CED
SHA256:0C43B5100DD5823A163A385F020AF9EB3EEA53B5F78DAE4F03F2FF0A24535C5C
2164mingw-w64-install.exeC:\Users\admin\AppData\Local\Temp\genteeB9\index.htmlhtml
MD5:3E1B1F7A239C77A530745249FFD82616
SHA256:A4D0C52F4EEB9FA3BBC5A0B7A17393E5DC4925B5994CDD2E8CE00F85BC494396
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
4
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2164
mingw-w64-install.exe
GET
301
216.105.38.13:80
http://sourceforge.net/projects/mingw-w64/files/Toolchains%20targetting%20Win32/Personal%20Builds/mingw-builds/8.1.0/threads-posix/dwarf/i686-8.1.0-release-posix-dwarf-rt_v6-rev0.7z
US
html
178 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2164
mingw-w64-install.exe
87.121.121.2:80
netix.dl.sourceforge.net
NetIX Communications Ltd.
BG
suspicious
2164
mingw-w64-install.exe
216.105.38.13:80
sourceforge.net
American Internet Services, LLC.
US
malicious
2164
mingw-w64-install.exe
216.105.38.13:443
sourceforge.net
American Internet Services, LLC.
US
malicious
2164
mingw-w64-install.exe
5.10.152.194:443
vorboss.dl.sourceforge.net
Vorboss Limited
GB
suspicious

DNS requests

Domain
IP
Reputation
netix.dl.sourceforge.net
  • 87.121.121.2
suspicious
sourceforge.net
  • 216.105.38.13
whitelisted
downloads.sourceforge.net
  • 216.105.38.13
whitelisted
vorboss.dl.sourceforge.net
  • 5.10.152.194
suspicious

Threats

PID
Process
Class
Message
2164
mingw-w64-install.exe
Potential Corporate Privacy Violation
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
2164
mingw-w64-install.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.
2164
mingw-w64-install.exe
Potential Corporate Privacy Violation
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
2164
mingw-w64-install.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mingw-w64-install.exe