File name: | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe |
Full analysis: | https://app.any.run/tasks/6d74225b-8e02-4a6c-9545-b907ccbf28e2 |
Verdict: | Malicious activity |
Analysis date: | January 10, 2025, 21:10:57 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections |
MD5: | 6B7DC1B91B2EEFA7A408902219B64A2F |
SHA1: | 1B06A3413BBBCF1DA029375840806D05AEF8BFDF |
SHA256: | 273A61EB82104B8252E1328BD9650CFBC2FDD47031D856D993EB96CE958D6D63 |
SSDEEP: | 3072:cpDSvVVVVVVVVwSQcxpDSvVVVVVVVVwSQc2:cdSvVVVVVVVVwStdSvVVVVVVVVwSS |
.exe | | | Win32 Executable MS Visual C++ (generic) (30.9) |
---|---|---|
.exe | | | Win64 Executable (generic) (27.3) |
.exe | | | UPX compressed Win32 Executable (26.8) |
.dll | | | Win32 Dynamic Link Library (generic) (6.5) |
.exe | | | Win32 Executable (generic) (4.4) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2011:03:15 04:06:07+00:00 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 8192 |
InitializedDataSize: | 4096 |
UninitializedDataSize: | 24576 |
EntryPoint: | 0x2130 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
5308 | "C:\Users\admin\Desktop\273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe" | C:\Users\admin\Desktop\273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | — | ||
MD5:— | SHA256:— | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmp | executable | |
MD5:E955A1DAFAF051A134BCF8C4D66CF603 | SHA256:FC74C9856D234A2BEDD03AC661558DB4F483C2062F913B1C5F00A36C63CAF7D4 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmp | executable | |
MD5:7BE9ECBD36D89BD0BD2512ABCCF13705 | SHA256:8CC1528DE487390EA45C60F8EBC5EDF5899FBB691C13B7E41E97237C78B9843F | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmp | executable | |
MD5:7515C941644345535E5A359ABDA6C4E3 | SHA256:76C884C47E54D649BDEB0738260FA8FE2FEA42239BA395227E16E64E11B8C48F | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png.tmp | executable | |
MD5:3253517008AC25EB1021A458D2D63DD2 | SHA256:34C3CB97F999833E93C5D6878063D2B5D6C368534CFC4624A3C5953B56FFB602 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmp | executable | |
MD5:68DD9D685B4F97B9C9FC16AB8C44C732 | SHA256:3D76B246E095F3E470A0EE1B5C3D94BEFF3202B97D4DA45ADEBF82E3F00EEA55 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmp | executable | |
MD5:290CB991699FF379D537CB76CF32CE86 | SHA256:97481AF5B397E1AD45D9CFDCDED5E27D1EE974C0E9BBF0995081AD098730F3CB | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe.tmp | executable | |
MD5:F66E45D48DCA9CE922D653975CB31013 | SHA256:A1029DFC5631E528CCFE5AFC395481E44C95A02E0273938A9F592DB022954EB9 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.tmp | executable | |
MD5:09C2B3E896D52BADFF0FCC37114BF879 | SHA256:EE82E4B04F78E75B0A0333CC35F664E1B61C0E74C0E539C900A9D87D1DF690D0 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmp | executable | |
MD5:FA1E79A63F815BA675CF4E274AFDC46D | SHA256:46F071E833A7427C69979E2031C45FE34B8A211405E2AAC1C51440FF183D191D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4536 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4536 | svchost.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4536 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.23.227.208:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4536 | svchost.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4536 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |