File name:

setup_PuddingDesktop.exe

Full analysis: https://app.any.run/tasks/90f2ece9-4479-416d-a590-2e41f2228623
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: March 19, 2020, 17:07:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
pup
pua
softcnapp
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

10E1B67A9CA834E3294DF2FA54DAE085

SHA1:

8F9689EB2E0BFC23D7CCE34777D0EB780B710C06

SHA256:

2D894917B7C3D9245B3163288C2C50CD2CDA3411927EFDE8A7CAC5032A566EBC

SSDEEP:

393216:U8mSVWCfFXQhMJDfBthvk+0OgFFUQUP0D70:U8mydUQDZthvk/FF2P1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PDUtty.exe (PID: 2900)
      • PDService.exe (PID: 2692)
      • PDPower32.exe (PID: 3736)
      • PDUtty.exe (PID: 2892)
      • PDUtty.exe (PID: 4012)
      • PDDesktop.exe (PID: 1380)
      • PDLanuncher.exe (PID: 2572)
      • PDUtty.exe (PID: 3524)
      • PDLittleNotes.exe (PID: 2864)
      • PDExpUtil32.exe (PID: 2464)
      • PDUtty.exe (PID: 3056)
      • PDUtty.exe (PID: 2632)
      • PDUtty.exe (PID: 3272)
      • PDPower32.exe (PID: 2356)
      • PDUtty.exe (PID: 3404)
      • PDTool.exe (PID: 2076)
      • PDUtty.exe (PID: 2676)
      • PDUtty.exe (PID: 2904)
      • PDWallpaper.exe (PID: 3540)
      • PDUpd.exe (PID: 3432)
      • PDUtty.exe (PID: 2464)
      • PDWallpaper.exe (PID: 3560)
      • PDUtty.exe (PID: 2852)
      • PDTool.exe (PID: 1888)
      • PDUtty.exe (PID: 2160)
      • PDUtty.exe (PID: 2712)
      • PDPower32.exe (PID: 3104)

    • SOFTCNAPP was detected

      • PDUtty.exe (PID: 2900)
      • PDService.exe (PID: 2692)
      • PDUtty.exe (PID: 2892)
      • PDTool.exe (PID: 2076)
      • PDUtty.exe (PID: 2464)
      • PDDesktop.exe (PID: 1380)
      • PDUpd.exe (PID: 3432)
      • PDUtty.exe (PID: 2852)

    • Connects to CnC server

      • PDUtty.exe (PID: 2900)
      • PDUtty.exe (PID: 2632)
      • PDUtty.exe (PID: 2464)
      • PDUtty.exe (PID: 2160)

    • Loads dropped or rewritten executable

      • PDDesktop.exe (PID: 1380)
      • PDPower32.exe (PID: 3736)

    • Changes the autorun value in the registry

      • PDUtty.exe (PID: 2900)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • setup_PuddingDesktop.exe (PID: 1948)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • setup_PuddingDesktop.exe (PID: 1948)
      • PDUtty.exe (PID: 2900)
      • PDPower32.exe (PID: 2356)
      • PDPower32.exe (PID: 3104)

    • Executable content was dropped or overwritten

      • setup_PuddingDesktop.exe (PID: 1948)
      • PDUtty.exe (PID: 2900)

    • Creates a software uninstall entry

      • PDUtty.exe (PID: 2900)

    • Creates files in the user directory

      • PDUtty.exe (PID: 2900)

    • Creates files in the program directory

      • setup_PuddingDesktop.exe (PID: 1948)
      • PDUtty.exe (PID: 2900)
      • PDLittleNotes.exe (PID: 2864)
      • PDDesktop.exe (PID: 1380)
      • PDExpUtil32.exe (PID: 2464)

    • Executed as Windows Service

      • PDService.exe (PID: 2692)

    • Creates files in the Windows directory

      • PDUtty.exe (PID: 2900)
      • PDService.exe (PID: 2692)

    • Application launched itself

      • PDUtty.exe (PID: 2892)
      • PDUtty.exe (PID: 2852)

    • Creates files in the driver directory

      • PDUtty.exe (PID: 2900)

    • Creates COM task schedule object

      • PDPower32.exe (PID: 3736)

    • Reads Internet Cache Settings

      • PDWallpaper.exe (PID: 3540)
      • PDUpd.exe (PID: 3432)
      • PDWallpaper.exe (PID: 3560)

    • Searches for installed software

      • PDService.exe (PID: 2692)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • setup_PuddingDesktop.exe (PID: 1948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:10:30 13:45:14+01:00
PEType: PE32
LinkerVersion: 14
CodeSize: 1435648
InitializedDataSize: 15175680
UninitializedDataSize: -
EntryPoint: 0xbd783
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.4.6.10291
ProductVersionNumber: 1.4.6.10291
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: 布丁桌面
FileDescription: 布丁桌面
FileVersion: 1.4.6.10291
InternalName: 布丁桌面
LegalCopyright: Copyright (C) 2019
OriginalFileName: Install.exe
ProductName: 布丁桌面
ProductVersion: 1,4,6,10291

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 30-Oct-2019 12:45:14
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • E:\workcode\ZhuoMian\ChengXu\Trunk\pdbmap\Pudding\PuddingInstall.pdb
CompanyName: 布丁桌面
FileDescription: 布丁桌面
FileVersion: 1.4.6.10291
InternalName: 布丁桌面
LegalCopyright: Copyright (C) 2019
OriginalFilename: Install.exe
ProductName: 布丁桌面
ProductVersion: 1,4,6,10291

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000130

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 30-Oct-2019 12:45:14
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0015E60E
0x0015E800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.6514
.rdata
0x00160000
0x000625CA
0x00062600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.71313
.data
0x001C3000
0x0001113C
0x0000AA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.21277
.gfids
0x001D5000
0x000001A4
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.51491
.tls
0x001D6000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x001D7000
0x00DF92F0
0x00DF9400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.99504
.reloc
0x00FD1000
0x00012760
0x00012800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.57024

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.06216
651
Latin 1 / Western European
English - United States
RT_MANIFEST
2
4.06116
38056
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
4.0848
21640
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
4.14553
16936
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
4.37594
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
4.62333
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
7
4.80654
2440
Latin 1 / Western European
Chinese - PRC
RT_ICON
8
4.98011
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
101
3.06388
118
Latin 1 / Western European
Chinese - PRC
RT_GROUP_ICON
SHADOW.PNG
6.86241
623
Latin 1 / Western European
Chinese - PRC
PIC

Imports

ADVAPI32.dll
COMCTL32.dll
CRYPT32.dll
GDI32.dll
IMM32.dll
IPHLPAPI.DLL
KERNEL32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
85
Monitored processes
34
Malicious processes
15
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start setup_puddingdesktop.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs #SOFTCNAPP pdutty.exe #SOFTCNAPP pdservice.exe pdpower32.exe no specs pdlanuncher.exe no specs #SOFTCNAPP pddesktop.exe #SOFTCNAPP pdutty.exe pdutty.exe pdexputil32.exe no specs pdutty.exe no specs pdlittlenotes.exe no specs pdutty.exe pdutty.exe pdutty.exe no specs pdpower32.exe #SOFTCNAPP pdtool.exe pdutty.exe no specs pdutty.exe pdwallpaper.exe pdutty.exe no specs #SOFTCNAPP pdutty.exe #SOFTCNAPP pdupd.exe pdwallpaper.exe #SOFTCNAPP pdutty.exe pdutty.exe pdtool.exe no specs pdutty.exe no specs pdpower32.exe setup_puddingdesktop.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1380"C:\Program Files\PuddingDesktop\PDDesktop.exe"C:\Program Files\PuddingDesktop\PDDesktop.exe
PDLanuncher.exe
User:
admin
Company:
布丁桌面
Integrity Level:
MEDIUM
Description:
布丁桌面
Exit code:
0
Modules
Images
c:\program files\puddingdesktop\pddesktop.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1520taskkill /f /im PDConfig.exeC:\Windows\system32\taskkill.exe—setup_PuddingDesktop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1888"C:\Program Files\PuddingDesktop\PDTool.exe" LongSpriteC:\Program Files\PuddingDesktop\PDTool.exe—PDUtty.exe
User:
admin
Company:
布丁桌面
Integrity Level:
MEDIUM
Description:
布丁桌面
Exit code:
0
Modules
Images
c:\program files\puddingdesktop\pdtool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1948"C:\Users\admin\Desktop\setup_PuddingDesktop.exe" C:\Users\admin\Desktop\setup_PuddingDesktop.exe
explorer.exe
User:
admin
Company:
布丁桌面
Integrity Level:
HIGH
Description:
布丁桌面
Exit code:
0
Version:
1.4.6.10291
Modules
Images
c:\users\admin\desktop\setup_puddingdesktop.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2076"C:\Program Files\PuddingDesktop\PDTool.exe" LongSpriteC:\Program Files\PuddingDesktop\PDTool.exe
PDUtty.exe
User:
admin
Company:
布丁桌面
Integrity Level:
HIGH
Description:
布丁桌面
Exit code:
0
Modules
Images
c:\program files\puddingdesktop\pdtool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2160"C:\Program Files\PuddingDesktop\PDUtty.exe" UpOnlineData --SoftName ZhuoMian --RunType 0C:\Program Files\PuddingDesktop\PDUtty.exe
PDUtty.exe
User:
admin
Company:
布丁桌面
Integrity Level:
MEDIUM
Description:
布丁桌面
Exit code:
0
Modules
Images
c:\program files\puddingdesktop\pdutty.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
2356"C:\Program Files\PuddingDesktop\PDPower32.exe" SetSpreader --qid guanf200200319 --time 1584637726C:\Program Files\PuddingDesktop\PDPower32.exe
PDUtty.exe
User:
admin
Company:
布丁桌面
Integrity Level:
HIGH
Description:
布丁桌面
Exit code:
1
Modules
Images
c:\program files\puddingdesktop\pdpower32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2464"C:\Program Files\PuddingDesktop\PDExpUtil32.exe" GetIconPositions 100C:\Program Files\PuddingDesktop\PDExpUtil32.exe—PDDesktop.exe
User:
admin
Company:
布丁桌面
Integrity Level:
MEDIUM
Description:
布丁桌面
Exit code:
1
Modules
Images
c:\program files\puddingdesktop\pdexputil32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
2464"C:\Program Files\PuddingDesktop\PDUtty.exe" QueryAppInfoC:\Program Files\PuddingDesktop\PDUtty.exe
PDUtty.exe
User:
admin
Company:
布丁桌面
Integrity Level:
HIGH
Description:
布丁桌面
Exit code:
0
Modules
Images
c:\windows\system32\ole32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shell32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\program files\puddingdesktop\pdutty.exe
2572"C:\Program Files\PuddingDesktop\\PDLanuncher.exe" RunSpreadOperateC:\Program Files\PuddingDesktop\PDLanuncher.exe—setup_PuddingDesktop.exe
User:
admin
Company:
布丁桌面
Integrity Level:
HIGH
Description:
布丁桌面
Exit code:
0
Modules
Images
c:\program files\puddingdesktop\pdlanuncher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 358
Read events
1 189
Write events
169
Delete events
0

Modification events

(PID) Process:(1948) setup_PuddingDesktop.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1948) setup_PuddingDesktop.exeKey:HKEY_CURRENT_USER\Software\PuddingDesktop\PreInstall
Operation:writeName:InstallParentName
Value:
Explorer.EXE
(PID) Process:(1948) setup_PuddingDesktop.exeKey:HKEY_CURRENT_USER\Software\PuddingDesktop\PreInstall
Operation:writeName:InstallParentSign
Value:
UnKonw
(PID) Process:(1948) setup_PuddingDesktop.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\PuddingDesktop
Operation:writeName:InstallPath
Value:
C:\Program Files\PuddingDesktop\
(PID) Process:(1948) setup_PuddingDesktop.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TXlTb2Z0\WmhpTmVuZw==\UHVkZGluZ0Rlc2t0b3A=
Operation:writeName:InstallPath
Value:
C:\Program Files\PuddingDesktop\
(PID) Process:(1948) setup_PuddingDesktop.exeKey:HKEY_CURRENT_USER\Software\PuddingDesktop\Setting
Operation:writeName:SoftMD5
Value:
10e1b67a9ca834e3294df2fa54dae085
(PID) Process:(2900) PDUtty.exeKey:HKEY_CURRENT_USER\Software\PuddingDesktop\AppInfo
Operation:writeName:CfgRootPath
Value:
C:\Users\admin\AppData\LocalLow\PuddingDesktop\
(PID) Process:(2900) PDUtty.exeKey:HKEY_CURRENT_USER\Software\PuddingDesktop\AppInfo
Operation:writeName:CfgUserPath
Value:
C:\Users\admin\AppData\LocalLow\PuddingDesktop.users\
(PID) Process:(2900) PDUtty.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\PuddingDesktop
Operation:writeName:InstallPath
Value:
C:\Program Files\PuddingDesktop\
(PID) Process:(2900) PDUtty.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\PuddingDesktop
Operation:writeName:LastUninstallTime
Value:
0
Executable files
36
Suspicious files
18
Text files
138
Unknown types
7

Dropped files

PID
Process
Filename
Type
1948setup_PuddingDesktop.exeC:\Users\admin\AppData\Local\Temp\PuddingDesktop-99416-7zData.7z —
MD5:—
SHA256:—
1948setup_PuddingDesktop.exeC:\Program Files\Common Files\PuddingDesktop\PuddingDesktop.initext
MD5:—
SHA256:—
1948setup_PuddingDesktop.exeC:\Program Files\PuddingDesktop\Config\desktop_setting.xmlxml
MD5:A2805D19A87CFB35FA3F69B41393C9D6
SHA256:4BC5FD4DBAC631FCF3E3901835BD954C9BA08FCC3FE95377F07F932D756ED0A2
1948setup_PuddingDesktop.exeC:\Program Files\PuddingDesktop\Config\panel_default_setting.xmlxml
MD5:EACAEDC6B5911089D2565B771A5E470F
SHA256:03B10EEE3AC22AD9DBB7161945B5C87EA4F7DA8DDB7E211663147EFD18ABF6A7
1948setup_PuddingDesktop.exeC:\Program Files\PuddingDesktop\Config\panels_setting.xmlxml
MD5:E3C55229F80CB22CA422B5D364DAA81B
SHA256:F55E84F9BBA87F6F4062722666D7B109274F60FE34EC4876E37521DF4750D7FB
1948setup_PuddingDesktop.exeC:\Program Files\PuddingDesktop\Resource\Skin.xmlxml
MD5:AB2D4477FFD010BDFA2EBAA9407028F1
SHA256:85AFD0AB6D9532D27AF13492317FD9B6E452C12403601AB125919EDDB89AADBE
1948setup_PuddingDesktop.exeC:\Program Files\PuddingDesktop\Config\tool_btns.xmlxml
MD5:78A14EF572902AAA7F03A190AF0DB14A
SHA256:972CA1D23531030164EAE0E2FD023C87478337B5C3DDC6ABCA8860ADFC1071C0
1948setup_PuddingDesktop.exeC:\Program Files\PuddingDesktop\Config\quick_toolbar_btns_default.xmlxml
MD5:58595CCF33E7993A02B5A45B229A95E6
SHA256:A97A75E83361E4171373F8AF37CF53FA3CEC1CFFCBB749627223D47479913A06
1948setup_PuddingDesktop.exeC:\Program Files\PuddingDesktop\Resource\default.skincompressed
MD5:DE7CCF27FFA31B64CBE32DB71F2B6A70
SHA256:AB2DCFD57F562B9F7529B4C3122B99FDE838EFA3BA14E79EC89227FDD697E27D
1948setup_PuddingDesktop.exeC:\Program Files\PuddingDesktop\Config\panel_customer_setting.xmlxml
MD5:775FC3C8C6DA33A72CF2B73460709482
SHA256:6A4A4ABF0550636E268CB131250814A739F7A1FC616D06C85E0BB55C4384AD80
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
76
TCP/UDP connections
58
DNS requests
21
Threats
27

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1948
setup_PuddingDesktop.exe
GET
200
106.75.24.100:80
http://tjv1.znyshurufa.com/statistics/timestamp
CN
text
26 b
malicious
2900
PDUtty.exe
GET
200
106.75.104.103:80
http://config.znyshurufa.com/zhuomian/pudding/common/softdatav1.dat?rand=1520
CN
binary
2.77 Kb
malicious
2692
PDService.exe
GET
200
163.171.132.119:80
http://down.znyshurufa.com/zhuomian/pudding/cld/tt.gif?4855
US
binary
1.23 Mb
malicious
2900
PDUtty.exe
GET
200
106.75.104.103:80
http://config.znyshurufa.com/zhuomian/pudding/common/firstcfg.dat
CN
binary
313 b
malicious
2076
PDTool.exe
GET
200
163.171.132.119:80
http://down.znshuru.com/zhuomian/pudding/cld/tt.dat?14765
US
binary
303 b
suspicious
1380
PDDesktop.exe
GET
200
106.75.104.103:80
http://config.znyshurufa.com/zhuomian/pudding/common/commoncfg.dat
CN
binary
465 b
malicious
2692
PDService.exe
GET
200
163.171.132.119:80
http://down.znshuru.com/zhuomian/pudding/bp/bp.dat
US
binary
42.3 Kb
suspicious
2900
PDUtty.exe
GET
200
106.75.104.103:80
http://config.znyshurufa.com/zhuomian/pudding/common/operationcfg.dat
CN
binary
605 b
malicious
2076
PDTool.exe
GET
200
117.50.94.170:80
http://tjtv3.znyshurufa.com/ts.php?data=NGI0NzA0MWI4MmExMGFkMjJmMjNjMmQyNmI1MDA2ODkJUHVkZGluZ0Rlc2t0b3AJMS40LjEuNglndWFuZjIwMDIwMDMxOQlMb25nU3ByaXRlQ2xvdWRQb3BTdGFydAkxCTA%3D
CN
text
20 b
unknown
2692
PDService.exe
GET
200
117.50.94.170:80
http://tjtv3.znshuru.com/ts.php?data=NGI0NzA0MWI4MmExMGFkMjJmMjNjMmQyNmI1MDA2ODkJUHVkZGluZ0Rlc2t0b3AJMS40LjEuNQlndWFuZjIwMDIwMDMxOQlSUDIwMDIyMDIJMQkwCUlzUnVuU2VydmVyCWVyXzA%3D
CN
text
20 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1948
setup_PuddingDesktop.exe
106.75.24.100:80
tjv1.znyshurufa.com
China Unicom Beijing Province Network
CN
malicious
2692
PDService.exe
163.171.132.119:80
down.znshuru.com
—
US
malicious
2900
PDUtty.exe
106.75.104.103:80
config.znyshurufa.com
China Unicom Beijing Province Network
CN
malicious
2692
PDService.exe
117.50.94.170:80
tjtv3.znyshurufa.com
IDC, China Telecommunications Corporation
CN
unknown
2900
PDUtty.exe
120.132.93.190:80
ins.znyshurufa.com
China Unicom Beijing Province Network
CN
unknown
2900
PDUtty.exe
106.75.7.242:80
tjv5.znyshurufa.com
China Unicom Beijing Province Network
CN
malicious
1380
PDDesktop.exe
106.75.104.103:80
config.znyshurufa.com
China Unicom Beijing Province Network
CN
malicious
4012
PDUtty.exe
117.50.94.170:80
tjtv3.znyshurufa.com
IDC, China Telecommunications Corporation
CN
unknown
1380
PDDesktop.exe
117.50.94.170:80
tjtv3.znyshurufa.com
IDC, China Telecommunications Corporation
CN
unknown
3056
PDUtty.exe
117.50.94.170:80
tjtv3.znyshurufa.com
IDC, China Telecommunications Corporation
CN
unknown

DNS requests

Domain
IP
Reputation
tjv1.znyshurufa.com
  • 106.75.24.100
malicious
config.znyshurufa.com
  • 106.75.104.103
malicious
down.znshuru.com
  • 163.171.132.119
suspicious
tjv5.znyshurufa.com
  • 106.75.7.242
malicious
tjtv3.znyshurufa.com
  • 117.50.94.170
unknown
ins.znyshurufa.com
  • 120.132.93.190
unknown
proup.znyshurufa.com
  • 117.50.94.170
  • 120.132.93.190
unknown
down.znyshurufa.com
  • 163.171.132.119
malicious
tjtv3.znshuru.com
  • 117.50.94.170
unknown
tjtv4.znyshurufa.com
  • 117.50.94.170
unknown

Threats

PID
Process
Class
Message
2900
PDUtty.exe
Misc activity
ADWARE [PTsecurity] Softcnapp.J PUP
2900
PDUtty.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
2900
PDUtty.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
2900
PDUtty.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
2692
PDService.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
2900
PDUtty.exe
Misc activity
ADWARE [PTsecurity] RiskWare[RiskTool]/Win32.KuaiZip
2900
PDUtty.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
2892
PDUtty.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
2076
PDTool.exe
Misc activity
ADWARE [PTsecurity] PUA.Softcnapp payload
2632
PDUtty.exe
Misc activity
ADWARE [PTsecurity] RiskWare[RiskTool]/Win32.KuaiZip
8 ETPRO signatures available at the full report
Process
Message
PDDesktop.exe
SHGetPathFromIDList ??????!
PDDesktop.exe
LoadImage SECUEESS
PDDesktop.exe
LoadImage SECUEESS
PDService.exe
CreateProcessAsUser ok!
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup_PuddingDesktop.exe