File name:

CFYHack.exe

Full analysis: https://app.any.run/tasks/f33e0f7a-f962-48de-aa82-af1249048f08
Verdict: Malicious activity
Analysis date: July 13, 2020, 23:11:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

A0003178DDC18DCE20066740B819D454

SHA1:

52FC857E106E60CAB9B5B8F91DEDB2A3D2F47827

SHA256:

32BCDE0D947C624D6E7CCDB54ACDBB050CA605752DF803BF0BD4BF895EBE90CF

SSDEEP:

196608:9ZDda1ZYnbrG/QeBv0LrtbYPvbJQlHTb2u8CtwOnj1iunbwcHr1i:js10PG/QaurkJQluOjXbRHr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • CFYHack.exe (PID: 2664)

  • SUSPICIOUS

    • Loads Python modules

      • CFYHack.exe (PID: 2664)

    • Application launched itself

      • CFYHack.exe (PID: 2412)

    • Executable content was dropped or overwritten

      • CFYHack.exe (PID: 2412)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • CFYHack.exe (PID: 2412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:01:05 13:16:15+01:00
PEType: PE32
LinkerVersion: 14
CodeSize: 128512
InitializedDataSize: 126976
UninitializedDataSize: -
EntryPoint: 0x7a6a
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows command line

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 05-Jan-2020 12:16:15

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 05-Jan-2020 12:16:15
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001F4D4
0x0001F600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.6643
.rdata
0x00021000
0x0000B19E
0x0000B200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.11204
.data
0x0002D000
0x0000E680
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.93811
.gfids
0x0003C000
0x000000B8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.86299
.rsrc
0x0003D000
0x00003A98
0x00003C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.85683
.reloc
0x00041000
0x000017D4
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.65456

Resources

Title
Entropy
Size
Codepage
Language
Type
1
7.94997
14818
UNKNOWN
UNKNOWN
RT_ICON
101
1.51664
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
WS2_32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
2412"C:\Users\admin\AppData\Local\Temp\CFYHack.exe" C:\Users\admin\AppData\Local\Temp\CFYHack.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\cfyhack.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
2664"C:\Users\admin\AppData\Local\Temp\CFYHack.exe" C:\Users\admin\AppData\Local\Temp\CFYHack.exe
CFYHack.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\cfyhack.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
Total events
9
Read events
9
Write events
0
Delete events
0

Modification events

No data
Executable files
65
Suspicious files
3
Text files
916
Unknown types
2

Dropped files

PID
Process
Filename
Type
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\_decimal.pydexecutable
MD5:44CCF7FF70B92FDC6C843C68D1DD66E4
SHA256:D4554BDF86C188E97EAACAE305223678262138C7569CFBB9837990EFD6255E77
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\_socket.pydexecutable
MD5:6F71A76BB3C8DA44C671F23B4B78F901
SHA256:9CB6BB684C2D475C60A94D3F789CAE6E662901EA408E18AC4BC34CBA0BAFFEED
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\_testcapi.pydexecutable
MD5:323593FE59435711A811AC04E6C54BC2
SHA256:658CF91D8A9D1725B3F003BA3D11B92FA4EB20805502A949934C3F49ABCA26CD
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\_lzma.pydexecutable
MD5:B1ABE0DA66EC97E4AFF97F1BD5203434
SHA256:EE4F276EC7F0B34ACD38361023173D6113D97A7DE17D28A4FBBD286FE5CE2F28
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\_ctypes.pydexecutable
MD5:E7F1C92338EB9964EA5922DE823ABCB8
SHA256:497CF76470349D3CB601E1FE66C8E08F7570CFB0D25E15C3D94AAE84280DBA58
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\VCRUNTIME140.dllexecutable
MD5:AE96651CFBD18991D186A029CBECB30C
SHA256:1B372F064EACB455A0351863706E6326CA31B08E779A70DE5DE986B5BE8069A1
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\_multiprocessing.pydexecutable
MD5:A7F5A7A1D1B967457812F94026864378
SHA256:BB766742D1657427691882F5F5EB9B222618B0144F7D05FD7BE2A8B43569E4D6
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\_queue.pydexecutable
MD5:B9DC46C4D8F7640C75BABA109D9569BB
SHA256:151315638F893E81D9E724615CB2E97F31D7A1AAFF3C5D598094206332C78E2B
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\_tkinter.pydexecutable
MD5:F5FA0ED3DEA125649C4C01326C41C617
SHA256:1A2394E295252BCEF3EBFE88D8633E833D172C9E4FBCC6657E16094C91D3A041
2412CFYHack.exeC:\Users\admin\AppData\Local\Temp\_MEI24122\_ssl.pydexecutable
MD5:38A431E39FE4502EBBC7A17BCB519240
SHA256:91225559138228AAADF83D77C92835B080BBCBCC17C190C6EF7BB9D23CC17595
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
801
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2664
CFYHack.exe
216.117.2.180:443
api.shodan.io
CyrusOne LLC
US
unknown
2664
CFYHack.exe
71.62.88.240:25566
—
Comcast Cable Communications, LLC
US
unknown
2664
CFYHack.exe
71.62.88.240:25567
—
Comcast Cable Communications, LLC
US
unknown
2664
CFYHack.exe
71.62.88.240:25568
—
Comcast Cable Communications, LLC
US
unknown
2664
CFYHack.exe
71.62.88.240:25569
—
Comcast Cable Communications, LLC
US
unknown
2664
CFYHack.exe
71.62.88.240:25570
—
Comcast Cable Communications, LLC
US
unknown
2664
CFYHack.exe
71.62.88.240:25573
—
Comcast Cable Communications, LLC
US
unknown
2664
CFYHack.exe
71.62.88.240:25577
—
Comcast Cable Communications, LLC
US
unknown
2664
CFYHack.exe
71.62.88.240:25579
—
Comcast Cable Communications, LLC
US
unknown
2664
CFYHack.exe
209.182.109.8:25566
—
Hydra Communications Ltd
GB
unknown

DNS requests

Domain
IP
Reputation
api.shodan.io
  • 216.117.2.180
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CFYHack.exe