| File name: | [Bot] adf.ly (1).rar |
| Full analysis: | https://app.any.run/tasks/d0da0316-90e6-4c25-aeca-5b551140d311 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | August 20, 2019, 16:49:04 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v4, os: Win32 |
| MD5: | C6312FFAA473FAEC1A973B0F7F34E12B |
| SHA1: | 67B2CC6E35D4C894694E5BF1629DB07269A960BB |
| SHA256: | 3277F8F5D0632175EA2F2E5299F20E5A10C6B5D821301362B035EF4E44EC965A |
| SSDEEP: | 6144:Ln9TWVc1IRKPzVvTIBIwJY4zc8xt9uUc2x+hGARVVimfRNatBDDxONHokmxam/P8:xTWV0yalaISYF8X9uzxhR+qNaTNONHoc |
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
| CompressedSize: | 17194 |
|---|---|
| UncompressedSize: | 18640 |
| OperatingSystem: | Win32 |
| ModifyDate: | 2013:08:08 11:20:09 |
| PackingMethod: | Best Compression |
| ArchivedFileName: | [Bot] adf.ly\bot adf.ly by OHmmaster\1.PNG |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1132 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id 2732 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | เปิดการใช้งาน.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 Modules
| |||||||||||||||
| 2396 | "C:\Users\admin\Desktop\[Bot] adf.ly\bot adf.ly by OHmmaster\เปิดการใช้งาน.exe" /idx=10 | C:\Users\admin\Desktop\[Bot] adf.ly\bot adf.ly by OHmmaster\เปิดการใช้งาน.exe | เปิดการใช้งาน.exe | ||||||||||||
User: admin Company: 精灵软件 Integrity Level: MEDIUM Description: 流量精灵 Exit code: 0 Version: 2013.3.14.99 Modules
| |||||||||||||||
| 2732 | "C:\Users\admin\Desktop\[Bot] adf.ly\bot adf.ly by OHmmaster\เปิดการใช้งาน.exe" /idx=0 | C:\Users\admin\Desktop\[Bot] adf.ly\bot adf.ly by OHmmaster\เปิดการใช้งาน.exe | เปิดการใช้งาน.exe | ||||||||||||
User: admin Company: 精灵软件 Integrity Level: MEDIUM Description: 流量精灵 Exit code: 0 Version: 2013.3.14.99 Modules
| |||||||||||||||
| 2932 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /o /eo /l /b /id 2732 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 Modules
| |||||||||||||||
| 3356 | "C:\Users\admin\Desktop\[Bot] adf.ly\bot adf.ly by OHmmaster\เปิดการใช้งาน.exe" /idx=20 | C:\Users\admin\Desktop\[Bot] adf.ly\bot adf.ly by OHmmaster\เปิดการใช้งาน.exe | เปิดการใช้งาน.exe | ||||||||||||
User: admin Company: 精灵软件 Integrity Level: MEDIUM Description: 流量精灵 Exit code: 0 Version: 2013.3.14.99 Modules
| |||||||||||||||
| 3448 | "C:\Users\admin\Desktop\[Bot] adf.ly\bot adf.ly by OHmmaster\เปิดการใช้งาน.exe" | C:\Users\admin\Desktop\[Bot] adf.ly\bot adf.ly by OHmmaster\เปิดการใช้งาน.exe | explorer.exe | ||||||||||||
User: admin Company: 精灵软件 Integrity Level: MEDIUM Description: 流量精灵 Exit code: 0 Version: 2013.3.14.99 Modules
| |||||||||||||||
| 3560 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\[Bot] adf.ly (1).rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\[Bot] adf.ly (1).rar | |||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
| (PID) Process: | (3560) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\General |
| Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\AppData\Local\Temp | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3560 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3560.27426\[Bot] adf.ly\bot adf.ly by OHmmaster\เปิดการใช้งาน.exe | — | |
MD5:— | SHA256:— | |||
| 3560 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3560.27426\[Bot] adf.ly\bot adf.ly by OHmmaster\2.PNG | image | |
MD5:— | SHA256:— | |||
| 3560 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3560.27426\[Bot] adf.ly\bot adf.ly by OHmmaster\อ่านก่อนใช้\วิธีใช้งาน\adf.PNG | image | |
MD5:— | SHA256:— | |||
| 3560 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3560.27426\[Bot] adf.ly\bot adf.ly by OHmmaster\1.PNG | image | |
MD5:— | SHA256:— | |||
| 3560 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3560.27426\[Bot] adf.ly\bot adf.ly by OHmmaster\Thumbs.db | binary | |
MD5:— | SHA256:— | |||
| 3560 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3560.27426\[Bot] adf.ly\bot adf.ly by OHmmaster\อ่านก่อนใช้\อ่านก่อนใช่นะ.txt | text | |
MD5:— | SHA256:— | |||
| 3560 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3560.27426\[Bot] adf.ly\bot adf.ly by OHmmaster\อ่านก่อนใช้\วิธีใช้งาน\Thumbs.db | binary | |
MD5:— | SHA256:— | |||
| 3560 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3560.27426\[Bot] adf.ly\bot adf.ly by OHmmaster\3.PNG | image | |
MD5:— | SHA256:— | |||
| 3448 | เปิดการใช้งาน.exe | C:\Users\admin\AppData\Roaming\Spiritsoft\urlspirit\bd.dat | ini | |
MD5:— | SHA256:— | |||
| 3448 | เปิดการใช้งาน.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\url[1].htm | html | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2732 | เปิดการใช้งาน.exe | GET | 200 | 185.10.104.115:80 | http://book.zongheng.com/chapter/582047/56998370.html | unknown | html | 8.83 Kb | suspicious |
2732 | เปิดการใช้งาน.exe | GET | 200 | 163.171.128.148:80 | http://image.bitautoimg.com/uimg/css/00060/yiche_2016_cube_dubi_chanshu_style-20190422092524-1284.css | US | text | 46.8 Kb | malicious |
2732 | เปิดการใช้งาน.exe | GET | 200 | 42.62.1.156:80 | http://car.bitauto.com/chexingduibi/?carids=132107,132916 | CN | html | 9.06 Kb | malicious |
2732 | เปิดการใช้งาน.exe | GET | 200 | 163.171.128.148:80 | http://image.bitautoimg.com/uimg/css/00060/yiche_2016_cube_dubi_chanshu_style-20190422092524-1284.css | US | text | 46.8 Kb | malicious |
3448 | เปิดการใช้งาน.exe | GET | 200 | 120.55.28.122:80 | http://info.spiritsoft.cn/v4/url.html?v=4.0.2.1-1110 | CN | html | 2.29 Kb | suspicious |
3448 | เปิดการใช้งาน.exe | GET | — | 120.55.28.122:80 | http://info.spiritsoft.cn/v4/css/style.css | CN | — | — | suspicious |
3448 | เปิดการใช้งาน.exe | GET | 200 | 120.55.28.122:80 | http://info.spiritsoft.cn/v4/lib/jquery/jquery-1.11.1.min.js | CN | text | 36.5 Kb | suspicious |
3448 | เปิดการใช้งาน.exe | GET | 200 | 120.55.28.122:80 | http://info.spiritsoft.cn/v4/css/style.css | CN | text | 806 b | suspicious |
3448 | เปิดการใช้งาน.exe | GET | 200 | 120.55.28.122:80 | http://info.spiritsoft.cn/v4/images/sound_high.gif | CN | image | 356 b | suspicious |
3448 | เปิดการใช้งาน.exe | GET | 200 | 120.55.28.122:80 | http://info.spiritsoft.cn/v4/js/main.js | CN | text | 1.25 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3448 | เปิดการใช้งาน.exe | 120.55.28.122:80 | urlspirit.spiritsoft.cn | Hangzhou Alibaba Advertising Co.,Ltd. | CN | malicious |
— | — | 120.55.28.122:80 | urlspirit.spiritsoft.cn | Hangzhou Alibaba Advertising Co.,Ltd. | CN | malicious |
2732 | เปิดการใช้งาน.exe | 43.226.33.149:80 | vip.kld.cc | — | CN | unknown |
3448 | เปิดการใช้งาน.exe | 222.85.26.209:80 | s11.cnzz.com | No.31,Jin-rong Street | CN | unknown |
2732 | เปิดการใช้งาน.exe | 104.31.80.102:443 | nicehits.club | Cloudflare Inc | US | shared |
2732 | เปิดการใช้งาน.exe | 42.62.1.156:80 | car.bitauto.com | China Unicom Beijing Province Network | CN | unknown |
2732 | เปิดการใช้งาน.exe | 185.10.104.115:80 | book.zongheng.com | — | — | suspicious |
2732 | เปิดการใช้งาน.exe | 163.171.128.148:80 | image.bitautoimg.com | — | US | malicious |
3448 | เปิดการใช้งาน.exe | 222.85.26.208:80 | s11.cnzz.com | No.31,Jin-rong Street | CN | unknown |
3448 | เปิดการใช้งาน.exe | 203.119.129.114:80 | hzs11.cnzz.com | — | CN | malicious |
Domain | IP | Reputation |
|---|---|---|
urlspirit.spiritsoft.cn |
| suspicious |
s1.spiritsoft.cn |
| malicious |
info.spiritsoft.cn |
| suspicious |
s11.cnzz.com |
| whitelisted |
vip.kld.cc |
| unknown |
nicehits.club |
| suspicious |
car.bitauto.com |
| unknown |
book.zongheng.com |
| suspicious |
image.bitautoimg.com |
| malicious |
hzs11.cnzz.com |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
3448 | เปิดการใช้งาน.exe | Misc activity | ADWARE [PTsecurity] Win32.FlowSpirit.a (v) |
3448 | เปิดการใช้งาน.exe | Misc activity | ADWARE [PTsecurity] Win32/FlowSpirit.A potentially unsafe for improve web traffic |
3448 | เปิดการใช้งาน.exe | Misc activity | ADWARE [PTsecurity] Win32.FlowSpirit.a (v) |
3448 | เปิดการใช้งาน.exe | Misc activity | ADWARE [PTsecurity] Win32/FlowSpirit.A potentially unsafe for improve web traffic |
1060 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
1060 | svchost.exe | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .ml Domain |
2732 | เปิดการใช้งาน.exe | Potentially Bad Traffic | ET INFO Suspicious Domain (*.ml) in TLS SNI |
3448 | เปิดการใช้งาน.exe | Misc activity | ADWARE [PTsecurity] Win32.FlowSpirit.a (v) |
3448 | เปิดการใช้งาน.exe | Misc activity | ADWARE [PTsecurity] Win32/FlowSpirit.A potentially unsafe for improve web traffic |
3448 | เปิดการใช้งาน.exe | Misc activity | ADWARE [PTsecurity] Win32.FlowSpirit.a (v) |