File name:

AntiPublic v1.0.10.zip

Full analysis: https://app.any.run/tasks/e0b924f8-6fb7-4200-bc87-7d10ab933afd
Verdict: Malicious activity
Analysis date: May 16, 2023, 15:45:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

B0BCF6975ECBFE7541EADABCB400C173

SHA1:

11EF0364A8C5F2B0C170B403F57184452467C501

SHA256:

2E9E2A7F2B5C413072AF154915637B48029F6859D49E933D727D1B6057FA40A0

SSDEEP:

98304:I0++PjY4lJFH4ybCxlTn2py6xyBG5Ksx8OvgU3y3iq8CzImzxm5l0zbD+BbRy0B4:4uY4lbrboncxyBG5plvgZyWzF45mbDkA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AntiPublic_Cracked.exe (PID: 2744)
      • ndp481-web.exe (PID: 3924)
      • ndp481-web.exe (PID: 1572)

  • SUSPICIOUS

    • Reads the Internet Settings

      • AntiPublic_Cracked.exe (PID: 2744)

    • Executable content was dropped or overwritten

      • ndp481-web.exe (PID: 1572)

  • INFO

    • Manual execution by a user

      • AntiPublic_Cracked.exe (PID: 2744)
      • AntiPublic_Cracked.exe (PID: 3772)

    • Checks supported languages

      • AntiPublic_Cracked.exe (PID: 2744)
      • ndp481-web.exe (PID: 1572)
      • Setup.exe (PID: 2076)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3660)
      • WinRAR.exe (PID: 3932)
      • iexplore.exe (PID: 3576)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3576)

    • Reads the computer name

      • ndp481-web.exe (PID: 1572)
      • AntiPublic_Cracked.exe (PID: 2744)
      • Setup.exe (PID: 2076)

    • Application launched itself

      • iexplore.exe (PID: 3576)

    • Create files in a temporary directory

      • iexplore.exe (PID: 3576)
      • Setup.exe (PID: 2076)
      • ndp481-web.exe (PID: 1572)

    • Reads the machine GUID from the registry

      • ndp481-web.exe (PID: 1572)
      • Setup.exe (PID: 2076)

    • The process checks LSA protection

      • ndp481-web.exe (PID: 1572)
      • Setup.exe (PID: 2076)

    • Reads CPU info

      • Setup.exe (PID: 2076)

    • Reads Environment values

      • Setup.exe (PID: 2076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: AntiPublic v1.0.10/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2022:12:16 17:04:16
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
8
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winrar.exe antipublic_cracked.exe no specs iexplore.exe iexplore.exe ndp481-web.exe no specs ndp481-web.exe setup.exe antipublic_cracked.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1572"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\ndp481-web.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\ndp481-web.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.8.1 Setup
Exit code:
5100
Version:
4.8.09037.06
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\6z2bcoul\ndp481-web.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\user32.dll
2076C:\5d1392298e3df0a8a048cf7467f9\\Setup.exe /x86 /x64 /webC:\5d1392298e3df0a8a048cf7467f9\Setup.exe
ndp481-web.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
5100
Version:
14.8.9037.0 built by: NET481REL1
Modules
Images
c:\5d1392298e3df0a8a048cf7467f9\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\sechost.dll
2744"C:\Users\admin\Desktop\AntiPublic v1.0.10\AntiPublic_Cracked.exe" C:\Users\admin\Desktop\AntiPublic v1.0.10\AntiPublic_Cracked.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AntiPublic
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\antipublic v1.0.10\antipublic_cracked.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3576"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.7.2&processName=AntiPublic_Cracked.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Internet Explorer\iexplore.exe
AntiPublic_Cracked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3660"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3576 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3772"C:\Users\admin\Desktop\AntiPublic v1.0.10\AntiPublic_Cracked.exe" C:\Users\admin\Desktop\AntiPublic v1.0.10\AntiPublic_Cracked.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AntiPublic
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\antipublic v1.0.10\antipublic_cracked.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3924"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\ndp481-web.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\ndp481-web.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.8.1 Setup
Exit code:
3221226540
Version:
4.8.09037.06
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\6z2bcoul\ndp481-web.exe
c:\windows\system32\ntdll.dll
3932"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AntiPublic v1.0.10.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
Total events
17 959
Read events
17 838
Write events
119
Delete events
2

Modification events

(PID) Process:(3932) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3932) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3932) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3932) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3932) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3932) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3932) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3932) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3932) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3932) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
34
Suspicious files
31
Text files
119
Unknown types
2

Dropped files

PID
Process
Filename
Type
3932WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3932.40513\AntiPublic v1.0.10\AntiPublic Updater.exe.configxml
MD5:21FA0B1D75C0CC7369F1E735FE90C7A9
SHA256:AD8267122C40D37DCD9D99E1412D763187A1825732F378DB8867F3ECF675CF70
3932WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3932.40513\AntiPublic v1.0.10\AntiPublic_Cracked.exeexecutable
MD5:0301FEA7EA4F3EB6B33D8871F571B26B
SHA256:A7E3C19AEB39D2B59A1146D453855E9D5E1380059EF0305ACFB848F91B41E946
3660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:7D094A515C1B5C1F15E40D15C1770D66
SHA256:065617D2B7A05EAE2A2C24E3C1C2668E54EFB0BBE69D8BED9EA538A5D760A682
3932WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3932.40513\AntiPublic v1.0.10\AntiPublic_Cracked.exe.configxml
MD5:118F2B6D9E075377768657EDD559AB33
SHA256:0C018550072A98A38A61365510AC98952BA3878143DF31989E719EE1DA7FC38A
3660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
3660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1B03804CACDCD4FBDAD96158262B71B1
SHA256:7316FAC3616A4561D19819657E435040CEA3AFF5D5C8B2449104C8CE2C3C7AAC
3660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:F8022AE8AC7F86548D9B210B5980EA30
SHA256:298DFDF9DBE3AD436103FAD3AB9F1FC9B58BD52DE90ACAE14F4555670D484E8D
3660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:585B15D3E52F6EF95219682C2C24AED1
SHA256:80332F48A9E42CE20577CFB243845B44AA881EAFD56B584B3FFE4C25C955A762
3660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEder
MD5:462CE8E9A1C194AB4E8AF231860847DF
SHA256:22BC2A970E7C4AA80370CB43733802704C3393330B39C9908DF72DA9AC564278
3932WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3932.40513\AntiPublic v1.0.10\AntiPublic Updater.exeexecutable
MD5:841A41E90F4BBFE3D88FDEC50170E15A
SHA256:A3C3AC5CA3951A328313A470C05BE338E98241C0550979C76DE2636E57E0A354
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
37
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3660
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
3660
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
binary
1.47 Kb
whitelisted
3660
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?06f9af50452a25c6
US
compressed
4.70 Kb
whitelisted
3660
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
binary
471 b
whitelisted
3576
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
binary
1.47 Kb
whitelisted
3660
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
binary
471 b
whitelisted
3660
iexplore.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRS%2FsoQjbTlq1Jokw0nyC%2FyFeJLtQQUAKuR%2FCFiJpeaqHkbYUGQYKliZ%2F0CEzMAftU9k32SHztW2swAAAB%2B1T0%3D
US
binary
1.74 Kb
whitelisted
3660
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?062b0104441894b8
US
compressed
4.70 Kb
whitelisted
3660
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
3660
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3372
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3660
iexplore.exe
23.35.229.160:443
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3660
iexplore.exe
13.107.246.45:443
dotnet.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious
3660
iexplore.exe
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious
3660
iexplore.exe
104.102.40.139:443
go.microsoft.com
AKAMAI-AS
DE
malicious
3576
iexplore.exe
92.123.104.47:443
www.bing.com
Akamai International B.V.
DE
suspicious
3660
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 104.102.40.139
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
dotnet.microsoft.com
  • 13.107.246.45
  • 13.107.213.45
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 92.123.104.47
  • 92.123.104.19
  • 92.123.104.34
  • 92.123.104.32
  • 92.123.104.17
  • 92.123.104.21
  • 92.123.104.40
  • 92.123.104.33
  • 92.123.104.31
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
js.monitor.azure.com
  • 13.107.237.45
  • 13.107.238.45
whitelisted
img-prod-cms-rt-microsoft-com.akamaized.net
  • 2.21.20.144
  • 2.21.20.148
whitelisted
wcpstatic.microsoft.com
  • 13.107.246.45
  • 13.107.213.45
whitelisted

Threats

No threats detected
Process
Message
Setup.exe
A StopBlock was hit or a System Requirement was not met.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AntiPublic v1.0.10.zip