File name: | BootstrapperFinobe.exe |
Full analysis: | https://app.any.run/tasks/0d0d6e2f-47b1-4989-b10c-7d20f6df8158 |
Verdict: | Malicious activity |
Analysis date: | October 20, 2020, 03:55:53 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | C0B092FB6F0C796E20AD2DB65CA8206F |
SHA1: | EE0E06817AC6C71C5951288BDB95CD755EFEC43F |
SHA256: | 1A3C813C6760886A8ED1472BF86FC7E8A09F92DD95EE3C7E84BD11F6F43DA0AE |
SSDEEP: | 49152:JAfLaF/Gaoe42UXJXphJHe3MfJo1cWE1/s/dkcrp3kTufOk4XUI8UrDh:/dGCfU5XfJH8MfJBWE1/s1kcrp3Ok4XJ |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
ConfigurationName: | Release |
---|---|
ProductVersion: | 1.0.0.0 |
ProductName: | Finobe Bootstrapper |
LegalCopyright: | (C) 2018 Finobe |
FileVersion: | 1.0.0.105 |
FileDescription: | Finobe |
CompanyName: | Finobe |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0017 |
ProductVersionNumber: | 1.0.0.0 |
FileVersionNumber: | 1.0.0.105 |
Subsystem: | Windows GUI |
SubsystemVersion: | 6 |
ImageVersion: | - |
OSVersion: | 6 |
EntryPoint: | 0x16f46b |
UninitializedDataSize: | - |
InitializedDataSize: | 1040896 |
CodeSize: | 1750528 |
LinkerVersion: | 14 |
PEType: | PE32 |
TimeStamp: | 2019:02:20 23:47:18+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 20-Feb-2019 22:47:18 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | Finobe |
FileDescription: | Finobe |
FileVersion: | 1.0.0.105 |
LegalCopyright: | (C) 2018 Finobe |
ProductName: | Finobe Bootstrapper |
ProductVersion: | 1.0.0.0 |
ConfigurationName: | Release |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000130 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 8 |
Time date stamp: | 20-Feb-2019 22:47:18 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x001AB599 | 0x001AB600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.5747 |
.rdata | 0x001AD000 | 0x0006B428 | 0x0006B600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.2472 |
.data | 0x00219000 | 0x0000DA50 | 0x00007200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.83575 |
.gfids | 0x00227000 | 0x00019FE8 | 0x0001A000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.24525 |
.giats | 0x00241000 | 0x00000010 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.155178 |
.tls | 0x00242000 | 0x00000009 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 0x00243000 | 0x0004F304 | 0x0004F400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.69553 |
.reloc | 0x00293000 | 0x000220D8 | 0x00022200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.51252 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.07176 | 640 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 2.79908 | 90 | Latin 1 / Western European | English - United States | RT_GROUP_ICON |
3 | 3.30928 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 3.1503 | 16936 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 2.7351 | 67624 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 7.95737 | 24372 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 2.37372 | 96 | Latin 1 / Western European | English - United States | RT_STRING |
130 | 3.12274 | 254 | Latin 1 / Western European | English - United States | RT_DIALOG |
131 | 2 | 8 | Latin 1 / Western European | English - United States | RT_ACCELERATOR |
157 | 2.27496 | 17290 | Latin 1 / Western European | English - United States | RT_BITMAP |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
IMM32.dll |
IPHLPAPI.DLL |
KERNEL32.dll |
MSIMG32.dll |
OLEACC.dll |
OLEAUT32.dll |
PSAPI.DLL |
Title | Ordinal | Address |
---|---|---|
?StartGame@SharedLauncher@@YAJAAV?$simple_logger@_W@@PA_W11ABU_GUID@@_N131W4LaunchMode@1@@Z | 1 | 0x000142E0 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2988 | "C:\Users\admin\AppData\Local\Temp\BootstrapperFinobe.exe" | C:\Users\admin\AppData\Local\Temp\BootstrapperFinobe.exe | explorer.exe | |
User: admin Company: Finobe Integrity Level: MEDIUM Description: Finobe Exit code: 0 Version: 1.0.0.105 | ||||
2864 | "C:\Users\admin\AppData\Local\Temp\RBX-052D5F4E.tmp" | C:\Users\admin\AppData\Local\Temp\RBX-052D5F4E.tmp | BootstrapperFinobe.exe | |
User: admin Company: Finobe Integrity Level: MEDIUM Description: Finobe Version: 1.1.0.79 | ||||
2404 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
3220 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6f5aa9d0,0x6f5aa9e0,0x6f5aa9ec | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
2848 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2412 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
2260 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,4586159893275633482,17591086839513595664,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=4988853548630610674 --mojo-platform-channel-handle=1060 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 | ||||
2512 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1056,4586159893275633482,17591086839513595664,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=7769035236633169305 --mojo-platform-channel-handle=1540 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
3032 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,4586159893275633482,17591086839513595664,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3241107580162641168 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 | ||||
3812 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,4586159893275633482,17591086839513595664,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14231195245965639405 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2488 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 | ||||
184 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,4586159893275633482,17591086839513595664,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10508733794987469509 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2532 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2988 | BootstrapperFinobe.exe | C:\Users\admin\AppData\Local\Temp\Cab73EC.tmp | — | |
MD5:— | SHA256:— | |||
2988 | BootstrapperFinobe.exe | C:\Users\admin\AppData\Local\Temp\Tar73ED.tmp | — | |
MD5:— | SHA256:— | |||
2988 | BootstrapperFinobe.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\5VVG2959.txt | — | |
MD5:— | SHA256:— | |||
2988 | BootstrapperFinobe.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\8XWNWLIF.txt | — | |
MD5:— | SHA256:— | |||
2864 | RBX-052D5F4E.tmp | C:\Users\admin\AppData\Local\Temp\Cab8AA1.tmp | — | |
MD5:— | SHA256:— | |||
2864 | RBX-052D5F4E.tmp | C:\Users\admin\AppData\Local\Temp\Tar8AA2.tmp | — | |
MD5:— | SHA256:— | |||
2864 | RBX-052D5F4E.tmp | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\EO739WQY.txt | — | |
MD5:— | SHA256:— | |||
2988 | BootstrapperFinobe.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\version-96610f8a17d139d5-BootstrapperQTStudioVersion[1].txt | text | |
MD5:5DDF490CB958D575F121601B57E93CEA | SHA256:BC2CEF65727467642C15FE848D19C646BF89C04DB345C9D2C8AB4474647D23CB | |||
2988 | BootstrapperFinobe.exe | C:\Users\admin\AppData\Local\Temp\RBX-EF28BD22.log | text | |
MD5:4F18BE014B6E21CAA37DDD620E663295 | SHA256:D78F9EA8F7DCB4BC6CEED97041C607800CA16AE484324792965D6C0D1A2FB8F6 | |||
2988 | BootstrapperFinobe.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\I1ZGQE1C.txt | text | |
MD5:ED591263227C8A91E0E9439D53C8AEF5 | SHA256:EB2E69B6C2F447011CE036FCDF3F83EF2EF7C9EF7BFCB7D05DDFD3C6E42B7FDC |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2988 | BootstrapperFinobe.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2512 | chrome.exe | 172.217.23.163:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2512 | chrome.exe | 216.58.210.4:443 | www.google.com | Google Inc. | US | whitelisted |
2988 | BootstrapperFinobe.exe | 104.24.117.15:443 | finobe.com | Cloudflare Inc | US | shared |
2864 | RBX-052D5F4E.tmp | 104.24.116.15:443 | finobe.com | Cloudflare Inc | US | shared |
2512 | chrome.exe | 216.58.212.173:443 | accounts.google.com | Google Inc. | US | whitelisted |
2988 | BootstrapperFinobe.exe | 104.24.116.15:443 | finobe.com | Cloudflare Inc | US | shared |
2864 | RBX-052D5F4E.tmp | 104.24.117.15:443 | finobe.com | Cloudflare Inc | US | shared |
2512 | chrome.exe | 216.58.207.74:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2512 | chrome.exe | 172.217.22.78:443 | ogs.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
finobe.com |
| suspicious |
ocsp.digicert.com |
| whitelisted |
prod1-setup.finobe.com |
| suspicious |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |