File name:

TFM Pgiex Client v6.zip

Full analysis: https://app.any.run/tasks/07190481-4117-4fbe-b42a-4733ff81d40e
Verdict: Malicious activity
Analysis date: February 09, 2022, 20:18:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CDBB36E31429222672198D13FA2ECF09

SHA1:

77310F77ACF474E8A2A2BFD55461EA4C7F6BAF32

SHA256:

23F9B243882F95EB2FB6EEA5DE1E63658F2395823F927568D50AAC8AEA8ACF35

SSDEEP:

196608:K6fZOUWT7cKSUFP94Vntzu2FT6Brx/33R4ikdV/20kRsgLlYRKCnnnphKlb3WZa5:KD7nSUFUnRpFeB9p4ljlktLlYQ6gWZuv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3912)
      • TFMClient - Pgiex Tfm.exe (PID: 4056)
      • TFMClient - Pgiex Tfm.exe (PID: 1028)

    • Application was dropped or rewritten from another process

      • TFMClient - Pgiex Tfm.exe (PID: 4056)
      • TFMClient - Pgiex Tfm.exe (PID: 1028)
      • Pgiex - Transformice SWF Updater.exe (PID: 2200)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3860)
      • TFMClient - Pgiex Tfm.exe (PID: 4056)
      • TFMClient - Pgiex Tfm.exe (PID: 1028)
      • Pgiex - Transformice SWF Updater.exe (PID: 2200)

    • Checks supported languages

      • WinRAR.exe (PID: 3860)
      • TFMClient - Pgiex Tfm.exe (PID: 4056)
      • TFMClient - Pgiex Tfm.exe (PID: 1028)
      • Pgiex - Transformice SWF Updater.exe (PID: 2200)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3860)
      • TFMClient - Pgiex Tfm.exe (PID: 1028)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 3860)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3860)

    • Reads Environment values

      • TFMClient - Pgiex Tfm.exe (PID: 4056)
      • TFMClient - Pgiex Tfm.exe (PID: 1028)
      • Pgiex - Transformice SWF Updater.exe (PID: 2200)

    • Application launched itself

      • TFMClient - Pgiex Tfm.exe (PID: 4056)

    • Drops a file that was compiled in debug mode

      • TFMClient - Pgiex Tfm.exe (PID: 1028)

  • INFO

    • Manual execution by user

      • TFMClient - Pgiex Tfm.exe (PID: 4056)

    • Reads settings of System Certificates

      • TFMClient - Pgiex Tfm.exe (PID: 1028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: AdobeAIR.exe
ZipUncompressedSize: 7689512
ZipCompressedSize: 7351309
ZipCRC: 0xeaed1e2b
ZipModifyDate: 2021:03:25 12:16:14
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs tfmclient - pgiex tfm.exe tfmclient - pgiex tfm.exe pgiex - transformice swf updater.exe

Process information

PID
CMD
Path
Indicators
Parent process
1028"C:\Users\admin\Desktop\TFM Pgiex Client v6\TFMClient - Pgiex Tfm.exe" C:\Users\admin\Desktop\TFM Pgiex Client v6\TFMClient - Pgiex Tfm.exe
TFMClient - Pgiex Tfm.exe
User:
admin
Integrity Level:
MEDIUM
Description:
TFMClient - Pgiex Tfm
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\tfm pgiex client v6\tfmclient - pgiex tfm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2200"C:\0464a1aa-c46e-4971-b372-e53b0d85ac22\Pgiex - Transformice SWF Updater.exe"C:\0464a1aa-c46e-4971-b372-e53b0d85ac22\Pgiex - Transformice SWF Updater.exe
TFMClient - Pgiex Tfm.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Pgiex - Transformice SWF Updater
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\0464a1aa-c46e-4971-b372-e53b0d85ac22\pgiex - transformice swf updater.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3860"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TFM Pgiex Client v6.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3912"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4056"C:\Users\admin\Desktop\TFM Pgiex Client v6\TFMClient - Pgiex Tfm.exe" C:\Users\admin\Desktop\TFM Pgiex Client v6\TFMClient - Pgiex Tfm.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
TFMClient - Pgiex Tfm
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\tfm pgiex client v6\tfmclient - pgiex tfm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 261
Read events
7 182
Write events
79
Delete events
0

Modification events

(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3860) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\TFM Pgiex Client v6.zip
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
6
Suspicious files
3
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
1028TFMClient - Pgiex Tfm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
3860WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3860.9040\TFM Pgiex Client v6\TFMClient - Pgiex Tfm.exeexecutable
MD5:08773F1A4562128900D33D360BCE85E1
SHA256:AD479BF73BD329475B843C4A1786796C3F202D71F5D1C41CA8E5DA3B40CDED7E
3860WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3860.9040\TFM Pgiex Client v6\stdole.dllexecutable
MD5:09AB7545A93B78612AE74D806CF9A07C
SHA256:DA76CB7FF44B8560547A3E578C18F158FBBABB19B82AE41B282F47801277EF49
1028TFMClient - Pgiex Tfm.exeC:\Users\admin\AppData\Local\Temp\Cab5AF4.tmpcompressed
MD5:ACAEDA60C79C6BCAC925EEB3653F45E0
SHA256:6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
1028TFMClient - Pgiex Tfm.exeC:\0464a1aa-c46e-4971-b372-e53b0d85ac22\META-INF\AIR\application.xmlxml
MD5:—
SHA256:—
1028TFMClient - Pgiex Tfm.exeC:\0464a1aa-c46e-4971-b372-e53b0d85ac22\Pgiex - Transformice SWF Updater.exeexecutable
MD5:—
SHA256:—
3860WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3860.9040\TFM Pgiex Client v6\Interop.ShockwaveFlashObjects.dllexecutable
MD5:06A3F066769840D59803A363E4085C18
SHA256:71F163FDCBF8E488F27005B4AEF2667F94EB6528BEF549B90AB215F50672F3B3
1028TFMClient - Pgiex Tfm.exeC:\Users\admin\AppData\Local\Beds-Protector-rown-Fox??\TFMClient_-_Pgiex_Tfm.exe_Url_5sycvndflsf4lpm5vusrhru4htisfras\1.0.0.0\user.configxml
MD5:—
SHA256:—
3860WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3860.9040\TFM Pgiex Client v6\AxInterop.ShockwaveFlashObjects.dllexecutable
MD5:FC5755937BEFDD2E722983245E9E20F4
SHA256:1593EEB11FA3CC777E4357EFD0BB2BE65C74A54DAAA499BBA651AEFE221579F1
1028TFMClient - Pgiex Tfm.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:ACAEDA60C79C6BCAC925EEB3653F45E0
SHA256:6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
9
DNS requests
6
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1028
TFMClient - Pgiex Tfm.exe
GET
204
172.217.23.110:80
http://google.com/generate_204
US
—
—
malicious
1028
TFMClient - Pgiex Tfm.exe
GET
200
2.16.106.233:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c0087de96361d0f6
unknown
compressed
59.9 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4056
TFMClient - Pgiex Tfm.exe
172.217.23.110:80
google.com
Google Inc.
US
whitelisted
1028
TFMClient - Pgiex Tfm.exe
172.217.23.110:80
google.com
Google Inc.
US
whitelisted
1028
TFMClient - Pgiex Tfm.exe
140.82.36.185:443
bolcorp.icu
—
US
suspicious
1028
TFMClient - Pgiex Tfm.exe
2.16.106.233:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
1028
TFMClient - Pgiex Tfm.exe
162.159.133.233:443
discordapp.com
Cloudflare Inc
—
shared
2200
Pgiex - Transformice SWF Updater.exe
140.82.36.185:443
bolcorp.icu
—
US
suspicious

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
bolcorp.icu
  • 140.82.36.185
malicious
ctldl.windowsupdate.com
  • 2.16.106.233
  • 2.16.106.171
whitelisted
transformice.bolcorp.icu
  • 140.82.36.185
suspicious
discordapp.com
  • 162.159.133.233
  • 162.159.129.233
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.135.233
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
1028
TFMClient - Pgiex Tfm.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (*.icu) in TLS SNI
1028
TFMClient - Pgiex Tfm.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.icu)
1028
TFMClient - Pgiex Tfm.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.icu)
1028
TFMClient - Pgiex Tfm.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.icu)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TFM Pgiex Client v6.zip