File name: | Reason-Free-Antivirus-Installer.exe |
Full analysis: | https://app.any.run/tasks/d0d5c2ed-d8fe-422d-ae54-b66261abf49f |
Verdict: | Malicious activity |
Analysis date: | January 18, 2019, 01:49:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
MD5: | 818EC6DF37B874290F4A750CC2873781 |
SHA1: | 353A33ED01DD30A34DE00E83046D9696BB7041D9 |
SHA256: | 2E660AC6D0953248C8F53E1FAE42F20781727F2D868BFB4B9DFE12B74E503731 |
SSDEEP: | 12288:DUsBl/iA9DtJ4GKofGDcUHc/4f4WYtKoYr+DWlf78+GkUYOtWHKzTzt4:DLiwOofUcD+4WkdDCxGFIHGP+ |
.exe | | | Win64 Executable (generic) (30.7) |
---|---|---|
.exe | | | UPX compressed Win32 Executable (30.1) |
.exe | | | Win32 EXE Yoda's Crypter (29.5) |
.exe | | | Win32 Executable (generic) (5) |
.exe | | | Generic Win/DOS Executable (2.2) |
ProductVersion: | 1 |
---|---|
ProductName: | Reason Antivirus |
LegalCopyright: | Copyright Reason Software Company Inc. |
FileVersion: | 1 |
FileDescription: | Reason Antivirus Installer |
CompanyName: | Reason Software Company Inc. |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.0.0.0 |
FileVersionNumber: | 1.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x19aba0 |
UninitializedDataSize: | 1224704 |
InitializedDataSize: | 57344 |
CodeSize: | 454656 |
LinkerVersion: | 14.16 |
PEType: | PE32 |
TimeStamp: | 2018:12:30 16:24:34+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 30-Dec-2018 15:24:34 |
Detected languages: |
|
CompanyName: | Reason Software Company Inc. |
FileDescription: | Reason Antivirus Installer |
FileVersion: | 1.0 |
LegalCopyright: | Copyright Reason Software Company Inc. |
ProductName: | Reason Antivirus |
ProductVersion: | 1.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000128 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 30-Dec-2018 15:24:34 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x0012B000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x0012C000 | 0x0006F000 | 0x0006F000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.92844 |
.rsrc | 0x0019B000 | 0x0000E000 | 0x0000DC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.27558 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.16876 | 1985 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 2.87471 | 16936 | UNKNOWN | English - United States | RT_ICON |
3 | 3.08508 | 9640 | UNKNOWN | English - United States | RT_ICON |
4 | 3.532 | 4264 | UNKNOWN | English - United States | RT_ICON |
5 | 3.83775 | 2440 | UNKNOWN | English - United States | RT_ICON |
6 | 4.29581 | 1128 | UNKNOWN | English - United States | RT_ICON |
7 | 0 | 130504 | UNKNOWN | English - United States | RT_ICON |
8 | 7.88635 | 10977 | UNKNOWN | English - United States | RT_ICON |
9 | 6.32307 | 88 | UNKNOWN | English - United States | RT_STRING |
10 | 7.83196 | 2432 | UNKNOWN | English - United States | RT_ICON |
ADVAPI32.dll |
COMCTL32.dll |
CRYPT32.dll |
GDI32.dll |
KERNEL32.DLL |
Normaliz.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2992 | "C:\Users\admin\Desktop\Reason-Free-Antivirus-Installer.exe" | C:\Users\admin\Desktop\Reason-Free-Antivirus-Installer.exe | — | explorer.exe |
User: admin Company: Reason Software Company Inc. Integrity Level: MEDIUM Description: Reason Antivirus Installer Exit code: 3221226540 Version: 1.0 | ||||
2552 | "C:\Users\admin\Desktop\Reason-Free-Antivirus-Installer.exe" | C:\Users\admin\Desktop\Reason-Free-Antivirus-Installer.exe | explorer.exe | |
User: admin Company: Reason Software Company Inc. Integrity Level: HIGH Description: Reason Antivirus Installer Exit code: 0 Version: 1.0 | ||||
3244 | "ReasonAntivirusInstaller.exe" /install | C:\Program Files\Reason\Reason Antivirus\ReasonAntivirusInstaller.exe | Reason-Free-Antivirus-Installer.exe | |
User: admin Company: Reason Cybersecurity Inc. Integrity Level: HIGH Description: Reason Antivirus Installer Exit code: 0 Version: 1.0.0.3 | ||||
2340 | "c:\windows\system32\InfDefaultInstall.exe" "C:\Program Files\Reason\Reason Antivirus\x86\ReasonCamFilter.inf" | c:\windows\system32\InfDefaultInstall.exe | ReasonAntivirusInstaller.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: INF Default Install Exit code: 0 Version: 5.2.3668.0 | ||||
3328 | "C:\Windows\system32\runonce.exe" -r | C:\Windows\system32\runonce.exe | — | InfDefaultInstall.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Run Once Wrapper Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
912 | "C:\Windows\System32\grpconv.exe" -o | C:\Windows\System32\grpconv.exe | — | runonce.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Progman Group Converter Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3400 | "C:\Program Files\Reason\Reason Antivirus\rsEngineSvc.exe" -i | C:\Program Files\Reason\Reason Antivirus\rsEngineSvc.exe | — | ReasonAntivirusInstaller.exe |
User: admin Company: Reason Software Company Inc. Integrity Level: HIGH Description: Reason Security Engine Service Exit code: 0 Version: 3.0.1.12 | ||||
2424 | "C:\Program Files\Reason\Reason Antivirus\rsEngineSvc.exe" | C:\Program Files\Reason\Reason Antivirus\rsEngineSvc.exe | services.exe | |
User: SYSTEM Company: Reason Software Company Inc. Integrity Level: SYSTEM Description: Reason Security Engine Service Version: 3.0.1.12 | ||||
2828 | "c:\windows\system32\schtasks.exe" /create /tn "Reason Antivirus UI" /tr "C:\Program Files\Reason\Reason Antivirus\ReasonAV.exe" /sc ONLOGON | c:\windows\system32\schtasks.exe | — | ReasonAntivirusInstaller.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2812 | "C:\Program Files\Reason\Reason Antivirus\ReasonAV.exe" | C:\Program Files\Reason\Reason Antivirus\ReasonAV.exe | ReasonAntivirusInstaller.exe | |
User: admin Integrity Level: HIGH Description: ReasonAV Version: 1.0.0.20 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\ReasonAV.7z | — | |
MD5:— | SHA256:— | |||
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\UI\static\js\main.cf82952b.js.map | — | |
MD5:— | SHA256:— | |||
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\ReasonAV.exe.config | xml | |
MD5:66B1E17C62B1B8E0019A765A4A262536 | SHA256:64BEA4F639F7A7734AF2F16AE50F2BD1ED62E20D2DC2454CECBD1DDA3D24DD64 | |||
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\UI\service-worker.js | text | |
MD5:FD652CF8133FB3F94978F7E63AA342EF | SHA256:CE2CA264D953B59B80C37E21C74971657B6BBC77E5088437D4A62CD61CF6A88A | |||
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\x86\ReasonCamFilter.inf | txt | |
MD5:D175C5D0B741CE58F5064C78FD0836AB | SHA256:64A677EA01447FE72AC31A026E1D74EC9AAED64938FB80B65574805664AFA32F | |||
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\UI\asset-manifest.json | text | |
MD5:28FFDCBB8441B120F410DB7877FDAD03 | SHA256:DABA989C0F6F4E946A5557BB6982AD6D3CC193D6B14F262B1A7072A39E164832 | |||
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\x64\ReasonCamFilter.inf | txt | |
MD5:8F89AE9EA6AAE4309802C66E6CFE6901 | SHA256:F183BC07DA24937AE0B093429C14291A998E4A0D36EA433FBC45EFD26334458A | |||
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\rsEngineHelper.exe.config | xml | |
MD5:E3D5F62B7B28176A510484E465FA0F18 | SHA256:827CDA24DF7876010D5239FE2B8AF49472442D899F9C0F6D9FF53B4FF6860946 | |||
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\x64\reasoncamfilter.cat | cat | |
MD5:74C6012CF24B671165A4B5F604E67FA5 | SHA256:C0E8823E6D44B7278F21DB8A3F73682A232DBB771E79273E64F3F088B38CB105 | |||
2552 | Reason-Free-Antivirus-Installer.exe | C:\Program Files\Reason\Reason Antivirus\UI\static\js\main.cf82952b.js | text | |
MD5:E801A293411471EFEDBB935942AE8861 | SHA256:683ECA07700003286AB137540EC3DD9511BF6460A74904B5E83DE18BE50C7960 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 52.85.221.80:80 | http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D | US | der | 1.51 Kb | whitelisted |
— | — | GET | 200 | 13.35.254.205:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
— | — | GET | 200 | 8.247.203.126:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.2 Kb | whitelisted |
— | — | GET | 200 | 52.85.221.111:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D | US | der | 1.39 Kb | shared |
— | — | GET | 200 | 13.35.254.113:80 | http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAb24cP%2F50I7YF0jhHLb7co%3D | US | der | 471 b | whitelisted |
— | — | GET | 200 | 13.35.254.205:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
— | — | GET | 200 | 52.85.221.250:80 | http://x.ss2.us/x.cer | US | der | 1.27 Kb | whitelisted |
— | — | GET | 200 | 13.35.254.113:80 | http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAIQTqmdAfVu6uabiQKHkMU%3D | US | der | 471 b | whitelisted |
— | — | GET | 200 | 52.85.221.111:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D | US | der | 1.39 Kb | shared |
— | — | GET | 200 | 8.247.203.126:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.2 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2552 | Reason-Free-Antivirus-Installer.exe | 34.233.189.60:443 | update.reasonsecurity.com | Amazon.com, Inc. | US | unknown |
2552 | Reason-Free-Antivirus-Installer.exe | 52.85.224.23:443 | cdn.reasonsecurity.com | — | US | unknown |
2552 | Reason-Free-Antivirus-Installer.exe | 54.194.225.50:443 | track.atom-data.io | Amazon.com, Inc. | IE | unknown |
— | — | 52.85.221.80:80 | ocsp.rootg2.amazontrust.com | Amazon.com, Inc. | US | whitelisted |
— | — | 13.35.254.205:80 | o.ss2.us | — | US | malicious |
— | — | 52.85.221.250:80 | x.ss2.us | Amazon.com, Inc. | US | unknown |
— | — | 52.85.221.111:80 | ocsp.rootca1.amazontrust.com | Amazon.com, Inc. | US | whitelisted |
— | — | 13.35.254.113:80 | ocsp.sca1b.amazontrust.com | — | US | whitelisted |
— | — | 8.247.203.126:80 | www.download.windowsupdate.com | Level 3 Communications, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
track.atom-data.io |
| suspicious |
x.ss2.us |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |
o.ss2.us |
| whitelisted |
ocsp.rootg2.amazontrust.com |
| whitelisted |
ocsp.rootca1.amazontrust.com |
| shared |
ocsp.sca1b.amazontrust.com |
| whitelisted |
update.reasonsecurity.com |
| suspicious |
cdn.reasonsecurity.com |
| shared |
Process | Message |
---|---|
ReasonAV.exe | CREDIT 1
|
ReasonAV.exe | CREDIT 1
|
ReasonAV.exe | CREDIT reset in 172800 seconds..
|
ReasonAV.exe | CONNECT wss://mc.reasonsecurity.com:443/..
|
ReasonAV.exe | PUMP ready
|
ReasonAV.exe | [0118/015139.283:ERROR:gpu_process_transport_factory.cc(1026)] Lost UI shared context.
|
ReasonAV.exe | OPEN
|
ReasonAV.exe | HEADER {"version":5}
|
ReasonAV.exe | SUB [1] Subscribing 87040fda-d935-4d16-920e-93964a1a842d..
|
ReasonAV.exe | ENCODE Subscribe
|