File name:

YouAreAnIdiot.exe

Full analysis: https://app.any.run/tasks/01f2a88c-19e4-4836-b253-746ce4b1e42e
Verdict: Malicious activity
Analysis date: May 06, 2024, 09:06:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

E263C5B306480143855655233F76DC5A

SHA1:

E7DCD6C23C72209EE5AA0890372DE1CE52045815

SHA256:

1F69810B8FE71E30A8738278ADF09DD982F7DE0AB9891D296CE7EA61B3FA4F69

SSDEEP:

6144:XgasGR5rnK2Qh9lp2E9ThHZmnRRQh9lp2E9ThHZmfR:XgasmWrjJ1ZmwjJ1ZmfR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • YouAreAnIdiot.exe (PID: 3972)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • YouAreAnIdiot.exe (PID: 2204)

  • INFO

    • Checks supported languages

      • YouAreAnIdiot.exe (PID: 3972)
      • wmpnscfg.exe (PID: 1200)
      • YouAreAnIdiot.exe (PID: 2204)

    • Reads the computer name

      • YouAreAnIdiot.exe (PID: 3972)
      • wmpnscfg.exe (PID: 1200)
      • YouAreAnIdiot.exe (PID: 2204)

    • Reads the machine GUID from the registry

      • YouAreAnIdiot.exe (PID: 3972)
      • YouAreAnIdiot.exe (PID: 2204)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1200)
      • YouAreAnIdiot.exe (PID: 2204)

    • Reads CPU info

      • YouAreAnIdiot.exe (PID: 2204)

    • Creates files or folders in the user directory

      • YouAreAnIdiot.exe (PID: 2204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:10:17 03:46:00+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 257024
InitializedDataSize: 176640
UninitializedDataSize: -
EntryPoint: 0x40aee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Microsoft
FileDescription: Microsoft Word 2010
FileVersion: 1.0.0.0
InternalName: YouAreAnIdiot.exe
LegalCopyright: Copyright © Microsoft 2010
OriginalFileName: YouAreAnIdiot.exe
ProductName: Office 2010
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start youareanidiot.exe wmpnscfg.exe no specs youareanidiot.exe

Process information

PID
CMD
Path
Indicators
Parent process
1200"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2204"C:\Users\admin\Desktop\YouAreAnIdiot.exe" C:\Users\admin\Desktop\YouAreAnIdiot.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Microsoft Word 2010
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\youareanidiot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3972"C:\Users\admin\AppData\Local\Temp\YouAreAnIdiot.exe" C:\Users\admin\AppData\Local\Temp\YouAreAnIdiot.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Microsoft Word 2010
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\youareanidiot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
2 037
Read events
2 037
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
22
Text files
0
Unknown types
28

Dropped files

PID
Process
Filename
Type
2204YouAreAnIdiot.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxxsol
MD5:4E442C66F85325FE25C83EE8855432CA
SHA256:C1F7F9394B37899EC9EFE36DD2C26C80837F357D86F20F67DC13F6491F0CFEA9
2204YouAreAnIdiot.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.solsol
MD5:4E442C66F85325FE25C83EE8855432CA
SHA256:C1F7F9394B37899EC9EFE36DD2C26C80837F357D86F20F67DC13F6491F0CFEA9
2204YouAreAnIdiot.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\openssl\cache\RevocationCacheFile.datbinary
MD5:0F343B0931126A20F133D67C2B018A3B
SHA256:5F70BF18A086007016E948B04AED3B82103A36BEA41755B6CDDFAF10ACE3C6EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
12
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2204
YouAreAnIdiot.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
unknown
2204
YouAreAnIdiot.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
unknown
2204
YouAreAnIdiot.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
unknown
2204
YouAreAnIdiot.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4032
WerFault.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2204
YouAreAnIdiot.exe
173.223.56.162:443
geo2.adobe.com
AKAMAI-AS
US
whitelisted
2204
YouAreAnIdiot.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2204
YouAreAnIdiot.exe
104.106.250.151:443
fpdownload.macromedia.com
AKAMAI-AS
US
unknown

DNS requests

Domain
IP
Reputation
watson.microsoft.com
  • 104.208.16.93
whitelisted
geo2.adobe.com
  • 173.223.56.162
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
fpdownload.macromedia.com
  • 104.106.250.151
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
YouAreAnIdiot.exe