File name: | vbehxx.zip |
Full analysis: | https://app.any.run/tasks/1e66280c-4e66-4550-ae23-04f6e4b47593 |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 05:49:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | DFB15C3BDEFF52B5B2D88F8CCA0B76FF |
SHA1: | 02CE8A26A825CBE44A28820415DB10CF5C75CF27 |
SHA256: | 2E80059A92E23F07ECE25CD25F4E855CB01C8623A5CA9D8D63756C2273368563 |
SSDEEP: | 768:YgV76KrqScCf4h4ywSC1/VzXDiAJgwkLF3YwzyrNjP:Yc6Kr27SV1/5z5Hhz |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | fucker script.exe |
---|---|
ZipUncompressedSize: | 107168 |
ZipCompressedSize: | 34474 |
ZipCRC: | 0xe6a17274 |
ZipModifyDate: | 2021:11:01 16:51:27 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2832 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\vbehxx.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
3484 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3468 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl ,1 | C:\Windows\system32\rundll32.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2956 | "C:\Users\admin\AppData\Local\Temp\8912c07e-f2f5-407f-b0b5-2299e8ea8e52.exe" | C:\Users\admin\AppData\Local\Temp\8912c07e-f2f5-407f-b0b5-2299e8ea8e52.exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM | ||||
3568 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
3240 | "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Program Files\VideoLAN\VLC\vlc.exe | Explorer.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Version: 3.0.11 | ||||
2244 | "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Program Files\VideoLAN\VLC\vlc.exe | Explorer.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Version: 3.0.11 | ||||
3384 | "C:\Windows\system32\calc.exe" | C:\Windows\system32\calc.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Calculator Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2004 | "C:\Windows\system32\calc.exe" | C:\Windows\system32\calc.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Calculator Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1328 | "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Program Files\VideoLAN\VLC\vlc.exe | Explorer.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Version: 3.0.11 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3568 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRDB1B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2588 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRE2CB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRE2EB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3568 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
1808 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRF356.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2712 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVREDD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3568 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk | lnk | |
MD5:301F671CC17AF078AC9A373BB2430E6D | SHA256:8D2A3C21C2A78050CDF58078ED973025CA0E86B8895D0FCB0889B0D0AD7ACE0C | |||
3568 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:D876C6D99607F94012611489209FDE4D | SHA256:E9ACD63224BCF106C8037C365AFF91187C4E236014F5710AE22A02A6B457B2D8 | |||
3568 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
3568 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\msoF376.tmp | html | |
MD5:A8934077843220A8E31367C7BBE15E6C | SHA256:A2DB0201D36F07F3F99D1ADF8B8EAFB9CF9BB803D024FCC9327B77AF56346861 |
Process | Message |
---|---|
vlc.exe | main libvlc debug: VLC media player - 3.0.11 Vetinari
|
vlc.exe | main libvlc debug: Copyright © 1996-2020 the VideoLAN team
|
vlc.exe | main libvlc debug: revision 3.0.11-0-gdc0c5ced72
|
vlc.exe | main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' 'host_alias=i686-w64-mingw32' 'PKG_CONFIG_LIBDIR=/home/jenkins/workspace/vlc-release/windows/vlc-release-win32-x86/contrib/i686-w64-mingw32/lib/pkgconfig'
|
vlc.exe | main libvlc debug: using multimedia timers as clock source
|
vlc.exe | main libvlc debug: min period: 1 ms, max period: 1000000 ms
|
vlc.exe | main libvlc debug: searching plug-in modules
|
vlc.exe | main libvlc debug: loading plugins cache file C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
|
vlc.exe | main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
|
vlc.exe | main libvlc error: stale plugins cache: modified C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll
|