File name:

PANDORA HVNC Cracked.rar

Full analysis: https://app.any.run/tasks/2284df76-f359-4a5c-8b5a-4e26425561cd
Verdict: Malicious activity
Analysis date: July 31, 2024, 13:58:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
crypto-regex
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32, flags: RecoveryRecordPresent
MD5:

0E034C20B69CE88B1C426B68A4B74921

SHA1:

656B9C48B2B5C732FAF19D93147311DE24B6EB35

SHA256:

1B89A30FC28488683B9C1CB8AF0C2E574EFD8405B38F1DD26727C1EF04D2097A

SSDEEP:

98304:P7gKMMValfP47NbFHtt2NuaqPipaPqgUUjXtySMTtepuj8Mg5WCtCR4gg3evSnd2:6lU/Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • crack.exe (PID: 6668)

    • Drops the executable file immediately after the start

      • PANDORA HVNC Cracked.exe (PID: 6528)
      • crack.exe (PID: 6668)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6316)
      • PANDORA HVNC Cracked.exe (PID: 6528)

    • Reads Internet Explorer settings

      • PANDORA HVNC Cracked.exe (PID: 6528)

    • Reads Microsoft Outlook installation path

      • PANDORA HVNC Cracked.exe (PID: 6528)

    • Reads the date of Windows installation

      • PANDORA HVNC Cracked.exe (PID: 6528)

    • Executable content was dropped or overwritten

      • PANDORA HVNC Cracked.exe (PID: 6528)
      • crack.exe (PID: 6668)

    • Found regular expressions for crypto-addresses (YARA)

      • crack.exe (PID: 6668)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6316)

    • Checks supported languages

      • PANDORA HVNC Cracked.exe (PID: 6528)
      • crack.exe (PID: 6668)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6316)

    • Reads the computer name

      • PANDORA HVNC Cracked.exe (PID: 6528)
      • crack.exe (PID: 6668)

    • Process checks Internet Explorer phishing filters

      • PANDORA HVNC Cracked.exe (PID: 6528)

    • Checks proxy server information

      • PANDORA HVNC Cracked.exe (PID: 6528)

    • Create files in a temporary directory

      • PANDORA HVNC Cracked.exe (PID: 6528)

    • Process checks computer location settings

      • PANDORA HVNC Cracked.exe (PID: 6528)

    • Creates files or folders in the user directory

      • crack.exe (PID: 6668)

    • Reads the machine GUID from the registry

      • crack.exe (PID: 6668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 3142442
UncompressedSize: 3268446
OperatingSystem: Win32
ModifyDate: 2023:02:15 02:30:20
PackingMethod: Normal
ArchivedFileName: PANDORA HVNC Cracked\PANDORA HVNC Cracked.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe pandora hvnc cracked.exe THREAT crack.exe

Process information

PID
CMD
Path
Indicators
Parent process
6316"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PANDORA HVNC Cracked.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6528"C:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\PANDORA HVNC Cracked.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\PANDORA HVNC Cracked.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6316.13794\pandora hvnc cracked\pandora hvnc cracked.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6668"C:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\crack.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\crack.exe
PANDORA HVNC Cracked.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6316.13794\pandora hvnc cracked\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
9 780
Read events
9 751
Write events
27
Delete events
2

Modification events

(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\PANDORA HVNC Cracked.rar
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
8
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6316WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\PANDORA HVNC Cracked.exeexecutable
MD5:C6A702F28372143712668B5ED78A0977
SHA256:9BFD2E4DA54AD6962A88F2322A203A403A5F42AFA463C04CFDE24DFB922A042A
6528PANDORA HVNC Cracked.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\crack.exeexecutable
MD5:163BDC6F6240D733ABF9083AC7E4ECED
SHA256:CB184F8C1AEB967C72B3FF6093BA3E275E3BDEC4B40DE4D570E92BCEAACED1E9
6528PANDORA HVNC Cracked.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\learn all kind of hacking.urlbinary
MD5:7ADE4A739CBD8F44D0EF52A2F1BC6E7B
SHA256:CC7649ED53C65E4851ACE414529564FE16801BB2BED4CB15588BFD6B4AC13616
6528PANDORA HVNC Cracked.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\Guna.UI2.dllexecutable
MD5:D65FD6DBBD3C9AC74139AEAEDC4A5816
SHA256:84199A22C8669A39800272C3DA0D969EC4E8D77D67B9D324CA049953A5042C71
6528PANDORA HVNC Cracked.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\client.binexecutable
MD5:60B39085C266F364C6B1269AB8FE79F5
SHA256:AD45703EBDFD43596469416BC9E24374D77A6F361057A31B6CC659789522DA75
6668crack.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crack.exeexecutable
MD5:163BDC6F6240D733ABF9083AC7E4ECED
SHA256:CB184F8C1AEB967C72B3FF6093BA3E275E3BDEC4B40DE4D570E92BCEAACED1E9
6528PANDORA HVNC Cracked.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\PandorahVNC.exeexecutable
MD5:39EF11E7673738D7DAB6B7396044D003
SHA256:ECED18F42CC7A54E40444F42B4EE3A200022837B66235E5239CEBE0AB96A2740
6528PANDORA HVNC Cracked.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\pandorabuilder.zipcompressed
MD5:D086F5DE761BCABE7CEEC28B6F2BEABA
SHA256:303F76F0CFE8D7C356C738ABFF2861AD9F021007CAEBF7918FC35985132AB80B
6528PANDORA HVNC Cracked.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\ClientBuilder.exeexecutable
MD5:77D61A2FC9E55E0CDB6F52CB91005A86
SHA256:FB82B4746CD8878EC6CC3A934F11E8192B381A6B3A18AAE57323DD950D9F91E5
6528PANDORA HVNC Cracked.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6316.13794\PANDORA HVNC Cracked\dnlib.dllexecutable
MD5:E517EAEABD955F1E0F83ED04A0E6DD86
SHA256:D04369E2FAFABB36FDC31FC63B9A4BFD2BBA577A203EE8180F9B084D9B344676
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
34
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6752
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3900
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6800
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4160
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5112
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4160
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
95.100.146.25:443
www.bing.com
Akamai International B.V.
CZ
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3900
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.78
whitelisted
www.bing.com
  • 95.100.146.25
  • 95.100.146.19
  • 95.100.146.33
  • 95.100.146.35
  • 95.100.146.27
  • 95.100.146.32
  • 95.100.146.17
  • 95.100.146.24
  • 95.100.146.10
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.0
  • 20.190.159.4
  • 20.190.159.75
  • 20.190.159.73
  • 20.190.159.64
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
th.bing.com
  • 95.100.146.17
  • 95.100.146.10
  • 95.100.146.32
  • 95.100.146.33
  • 95.100.146.19
  • 95.100.146.26
  • 95.100.146.27
whitelisted
fd.api.iris.microsoft.com
  • 20.105.99.58
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PANDORA HVNC Cracked.rar