File name: | vbehxx.zip |
Full analysis: | https://app.any.run/tasks/c008eb05-0e0e-49e8-9d49-f827d6c4d2eb |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 05:51:42 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | DFB15C3BDEFF52B5B2D88F8CCA0B76FF |
SHA1: | 02CE8A26A825CBE44A28820415DB10CF5C75CF27 |
SHA256: | 2E80059A92E23F07ECE25CD25F4E855CB01C8623A5CA9D8D63756C2273368563 |
SSDEEP: | 768:YgV76KrqScCf4h4ywSC1/VzXDiAJgwkLF3YwzyrNjP:Yc6Kr27SV1/5z5Hhz |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2021:11:01 16:51:27 |
ZipCRC: | 0xe6a17274 |
ZipCompressedSize: | 34474 |
ZipUncompressedSize: | 107168 |
ZipFileName: | fucker script.exe |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1348 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\vbehxx.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 | ||||
2492 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1348.26429\fucker script.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1348.26429\fucker script.exe | — | WinRAR.exe |
User: admin Integrity Level: MEDIUM | ||||
2768 | "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Program Files\VideoLAN\VLC\vlc.exe | Explorer.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Version: 3.0.11 | ||||
1276 | "C:\Windows\system32\calc.exe" | C:\Windows\system32\calc.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Calculator Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1676 | "C:\Windows\system32\calc.exe" | C:\Windows\system32\calc.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Calculator Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3712 | "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Program Files\VideoLAN\VLC\vlc.exe | Explorer.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Version: 3.0.11 | ||||
3256 | "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Program Files\VideoLAN\VLC\vlc.exe | Explorer.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Version: 3.0.11 | ||||
3628 | "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Program Files\VideoLAN\VLC\vlc.exe | Explorer.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Version: 3.0.11 | ||||
2336 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
4020 | "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Program Files\VideoLAN\VLC\vlc.exe | Explorer.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Version: 3.0.11 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2336 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRAF51.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2336 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
3596 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRC24D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3020 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRC24D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3384 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRD122.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1204 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRD5A6.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3592 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62B94584-E08.pma | — | |
MD5:— | SHA256:— | |||
2336 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk | lnk | |
MD5:301F671CC17AF078AC9A373BB2430E6D | SHA256:8D2A3C21C2A78050CDF58078ED973025CA0E86B8895D0FCB0889B0D0AD7ACE0C | |||
3592 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFfdb63.TMP | text | |
MD5:936EB7280DA791E6DD28EF3A9B46D39C | SHA256:CBAF2AFD831B32F6D1C12337EE5D2F090D6AE1F4DCB40B08BEF49BF52AD9721F | |||
2336 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:70391B5DFC34E49DD2EA09193C74E251 | SHA256:94A7E92507CD4E11D1B1E4AFF95BDC4EAC15849A024C42F6070B349BCD53AFC6 |
Process | Message |
---|---|
vlc.exe | main libvlc debug: VLC media player - 3.0.11 Vetinari
|
vlc.exe | main libvlc debug: Copyright © 1996-2020 the VideoLAN team
|
vlc.exe | main libvlc debug: revision 3.0.11-0-gdc0c5ced72
|
vlc.exe | main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' 'host_alias=i686-w64-mingw32' 'PKG_CONFIG_LIBDIR=/home/jenkins/workspace/vlc-release/windows/vlc-release-win32-x86/contrib/i686-w64-mingw32/lib/pkgconfig'
|
vlc.exe | main libvlc debug: using multimedia timers as clock source
|
vlc.exe | main libvlc debug: min period: 1 ms, max period: 1000000 ms
|
vlc.exe | main libvlc debug: searching plug-in modules
|
vlc.exe | main libvlc debug: loading plugins cache file C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
|
vlc.exe | main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
|
vlc.exe | main libvlc error: stale plugins cache: modified C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll
|