analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

NHLGames-v.1.3.3-simplified.zip

Full analysis: https://app.any.run/tasks/bdd3b8f3-b15a-4ca4-8290-89bcf176988b
Verdict: Malicious activity
Analysis date: March 21, 2019, 13:59:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

91A46613416FC76A7196EB1C2901E9D7

SHA1:

EEB952283C26D38BA04631DDE34C7A0808E8960B

SHA256:

2FABCE5A0FA184E8F3CF791FFBFE4FABE74E05479BD9AD02630E6F89D21FC5A9

SSDEEP:

196608:yPcgGmi/RF2FkY5ZcLeq+SriaL1a/JmjKEc242zhIBysO0WuflVRm1aZc+7t1SBj:yji/+6rriaSiiMui0hNV3tt1o9xq/w

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NHLGames.exe (PID: 3248)
      • mlbamproxy.exe (PID: 3940)

    • Loads dropped or rewritten executable

      • NHLGames.exe (PID: 3248)

  • SUSPICIOUS

    • Reads Environment values

      • NHLGames.exe (PID: 3248)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3188)

  • INFO

    • Reads settings of System Certificates

      • NHLGames.exe (PID: 3248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: MetroFramework.Design.dll
ZipUncompressedSize: 16896
ZipCompressedSize: 6527
ZipCRC: 0xd992439d
ZipModifyDate: 2016:07:19 23:44:01
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe nhlgames.exe mlbamproxy.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3188"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NHLGames-v.1.3.3-simplified.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3248"C:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\NHLGames.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\NHLGames.exe
WinRAR.exe
User:
admin
Company:
NHLGames
Integrity Level:
MEDIUM
Description:
NHLGames
Version:
1.3.3.0
3940"C:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\mlbamproxy\x86\mlbamproxy.exe" -p 17070 -d freegamez.ga -s mf.svc.nhl.comC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\mlbamproxy\x86\mlbamproxy.exe—NHLGames.exe
User:
admin
Integrity Level:
MEDIUM
Total events
507
Read events
469
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\mkts5ype.newcfg —
MD5:—
SHA256:—
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\k3tl50kl.newcfg —
MD5:—
SHA256:—
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\jibdxcjg.newcfg —
MD5:—
SHA256:—
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\leewx5xd.newcfg —
MD5:—
SHA256:—
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\j2ootgk2.newcfg —
MD5:—
SHA256:—
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\x4i3i4ff.newcfg —
MD5:—
SHA256:—
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\3glnxs3m.newcfg —
MD5:—
SHA256:—
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\tr3trv4c.newcfg —
MD5:—
SHA256:—
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\h2noju43.newcfg —
MD5:—
SHA256:—
3248NHLGames.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3188.29156\suif0ct0.newcfg —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3248
NHLGames.exe
HEAD
200
178.62.203.238:80
http://freegamez.ga/
NL
—
—
suspicious
3248
NHLGames.exe
GET
200
13.32.223.203:80
http://statsapi.web.nhl.com/api/v1/schedule?startDate=2019-03-21&endDate=2019-03-21&expand=schedule.teams,schedule.linescore,schedule.game.seriesSummary,schedule.game.content.media.epg
US
text
89.9 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3248
NHLGames.exe
216.58.210.4:443
www.google.com
Google Inc.
US
whitelisted
3248
NHLGames.exe
192.30.253.117:443
api.github.com
GitHub, Inc.
US
shared
3248
NHLGames.exe
178.62.203.238:80
freegamez.ga
Digital Ocean, Inc.
NL
suspicious
3248
NHLGames.exe
13.32.223.203:80
statsapi.web.nhl.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
www.google.com
  • 216.58.210.4
whitelisted
api.github.com
  • 192.30.253.117
  • 192.30.253.116
whitelisted
freegamez.ga
  • 178.62.203.238
suspicious
statsapi.web.nhl.com
  • 13.32.223.203
  • 13.32.223.39
  • 13.32.223.140
  • 13.32.223.156
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .ga Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
NHLGames-v.1.3.3-simplified.zip