File name:

image.jpg

Full analysis: https://app.any.run/tasks/52e51d73-474c-464b-b4a7-044f9755c353
Verdict: Malicious activity
Analysis date: August 12, 2023, 05:52:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: image/jpeg
File info: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=4, orientation=upper-left, software=Picasa], baseline, precision 8, 2560x1211, components 3
MD5:

286351179B45F11759BB6CDD5CD94F38

SHA1:

4D1CCC767090B64338559C686FAEF3D9FF4C83BA

SHA256:

2F711D14AFB9496CA70961925BD939C637880AC585C4277998C6499404DCB168

SSDEEP:

6144:q4xS7m0oJkfHmOV89VEIdzDEU/Cvv/24/3WZS9JrAqZywAgvxkn6S6vMhyDoimo1:pom08a69KiPF/Cvv/24/DrrzywAgGAai

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • rundll32.exe (PID: 124)

  • INFO

    • The process checks LSA protection

      • dllhost.exe (PID: 3644)

    • Manual execution by a user

      • WINWORD.EXE (PID: 1680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jpg | JFIF-EXIF JPEG Bitmap (32.2)
.jpg | JFIF JPEG bitmap (25.8)
.jpg | JPEG bitmap (19.3)
.mp3 | MP3 audio (ID3 v1.x tag) (16.1)
.mp3 | MP3 audio (6.4)

EXIF

Composite

Megapixels: 3.1
ImageSize: 2560x1211

ICC_Profile

ProfileCopyright: Google Inc. 2016
MediaWhitePoint: 0.9642 1 0.82491
BlueTRC: (Binary data 40 bytes, use -b option to extract)
GreenTRC: (Binary data 40 bytes, use -b option to extract)
RedTRC: (Binary data 40 bytes, use -b option to extract)
BlueMatrixColumn: 0.14307 0.06061 0.7141
GreenMatrixColumn: 0.38515 0.71687 0.09708
RedMatrixColumn: 0.43607 0.22249 0.01392
ProfileDescription: sRGB
ProfileID: -
ProfileCreator: -
ConnectionSpaceIlluminant: 0.9642 1 0.82491
RenderingIntent: Media-Relative Colorimetric
DeviceAttributes: Reflective, Glossy, Positive, Color
DeviceModel: -
DeviceManufacturer: -
CMMFlags: Not Embedded, Independent
PrimaryPlatform: Unknown ()
ProfileFileSignature: acsp
ProfileDateTime: 0000:00:00 00:00:00
ProfileConnectionSpace: XYZ
ColorSpaceData: RGB
ProfileClass: Display Device Profile
ProfileVersion: 2.1.0
ProfileCMMType: -

EXIF

ThumbnailImage: (Binary data 4573 bytes, use -b option to extract)
ThumbnailLength: 4573
ThumbnailOffset: 282
ResolutionUnit: inches
YResolution: 72
XResolution: 72
Compression: JPEG (old-style)
ImageUniqueID: f99de3f5c6a940f50000000000000000
ExifImageHeight: 1211
ExifImageWidth: 2560
ExifVersion: 0220
YCbCrSubSampling: YCbCr4:2:0 (2 2)
Software: Picasa
Orientation: Horizontal (normal)

JFIF

YResolution: 1
XResolution: 1
ResolutionUnit: None
JFIFVersion: 1.01
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs PhotoViewer.dll no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Windows\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen "C:\Users\admin\Desktop\image.jpg"C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1680"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\textforums.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3644C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 231
Read events
3 693
Write events
374
Delete events
164

Modification events

(PID) Process:(124) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(3644) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(1680) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(1680) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(1680) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(1680) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(1680) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(1680) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(1680) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(1680) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
Executable files
1
Suspicious files
4
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRCC6F.tmp.cvr —
MD5:—
SHA256:—
1680WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:48F4DEE0000930A0D8A0E079C770C605
SHA256:D1889CC917135D8B4C28E02EE5DFB18048B91EF67FB71EBDCF4C2AEC2D93F2B6
1680WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\textforums.rtf.LNKbinary
MD5:5B18B7FD7CFF5BAB7FEEE620C87C58F3
SHA256:9F35684599227923CA7BADA4A36D01C2DF5923E2DFA02606A968158DB3B14E41
1680WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\image.jpg.LNKbinary
MD5:E72E4A7A6BA6DBC5125D9EF8CE5BA059
SHA256:FF122AAD0F8412E3DD840A0A396D7D14DB06BD723C2D675C390C5BA45C22780A
1680WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:16673CB77480ACFAC6C9BD00C28E9383
SHA256:468E06E23CDEAF031AA3D1A90B143E202F13D3F0864E65C4E3E4B375E1C9AD61
1680WINWORD.EXEC:\Users\admin\Desktop\~$xtforums.rtfbinary
MD5:EDD6AAD9F7CF168D07116685B49E6348
SHA256:C3358938BD5F2590F9E3FEFC59F55225BDC70EE70444E262130B9A761543DE0C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
image.jpg