File name:

Purple Bitch - Linkvertise Downloader_vZ-9XA1.exe

Full analysis: https://app.any.run/tasks/1f9b5110-60c1-4668-8924-65e6c4f41e84
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 05:28:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

92D7DCF74A7319A58A5F58AFE831FAB2

SHA1:

17EE79510D098184C0BA3A0C7B3193DC416F2088

SHA256:

3563B35A2964D71E796487EEF130AE7E27393AF67D275DDF700534403F9CDD2C

SSDEEP:

98304:JSiuM6hoXOWZ3lsuUxqxgWphvaLx137O5B:UoXOM1ugh67SB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • saBSI.exe (PID: 3156)
      • cookie_mmm_irs_ppi_902_451_o.exe (PID: 1208)
      • avg_antivirus_free_setup.exe (PID: 1780)
      • instup.exe (PID: 2636)
      • instup.exe (PID: 3540)
      • sbr.exe (PID: 2880)
      • SetupInf.exe (PID: 2552)
      • SetupInf.exe (PID: 296)
      • SetupInf.exe (PID: 3024)
      • SetupInf.exe (PID: 3568)
      • AvEmUpdate.exe (PID: 3776)
      • AvEmUpdate.exe (PID: 4064)
      • avBugReport.exe (PID: 3400)
      • AvEmUpdate.exe (PID: 2488)
      • SetupInf.exe (PID: 3660)
      • AvEmUpdate.exe (PID: 356)
      • SetupInf.exe (PID: 2276)

    • Loads dropped or rewritten executable

      • instup.exe (PID: 2636)
      • instup.exe (PID: 3540)
      • AvEmUpdate.exe (PID: 4064)
      • AvEmUpdate.exe (PID: 2488)
      • AvEmUpdate.exe (PID: 356)

  • SUSPICIOUS

    • Starts itself from another location

      • instup.exe (PID: 2636)

    • Application launched itself

      • AvEmUpdate.exe (PID: 4064)

  • INFO

    • Loads dropped or rewritten executable

      • Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmp (PID: 2584)

    • Application was dropped or rewritten from another process

      • Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmp (PID: 3568)
      • Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmp (PID: 2584)

    • Application launched itself

      • iexplore.exe (PID: 2092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Jun-03 08:09:11
Detected languages:
  • English - United States
Comments: This installation was built with Inno Setup.
CompanyName: -
FileDescription: Linkvertise GmbH & Co. KG
FileVersion: 2.0.0.15
LegalCopyright: -
OriginalFileName: -
ProductName: Linkvertise GmbH & Co. KG
ProductVersion: 2.0.0.15

DOS Header

e_magic: MZ
e_cblp: 80
e_cp: 2
e_crlc: -
e_cparhdr: 4
e_minalloc: 15
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: 26
e_oemid: -
e_oeminfo: -
e_lfanew: 256

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 10
TimeDateStamp: 2021-Jun-03 08:09:11
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
734748
735232
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.35606
.itext
741376
5768
6144
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.97275
.data
749568
14244
14336
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.0444
.bss
765952
28136
0
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata
794624
3894
4096
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.8987
.didata
798720
420
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.75636
.edata
802816
154
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.87222
.tls
806912
24
0
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata
811008
93
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.38389
.rsrc
815104
472684
473088
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.97111

Resources

Title
Entropy
Size
Codepage
Language
Type
1
2.53418
74792
Latin 1 / Western European
English - United States
RT_ICON
2
3.30061
19496
Latin 1 / Western European
English - United States
RT_ICON
3
4.23227
3752
Latin 1 / Western European
English - United States
RT_ICON
4
4.59583
2216
Latin 1 / Western European
English - United States
RT_ICON
5
5.29635
1736
Latin 1 / Western European
English - United States
RT_ICON
6
4.32066
1384
Latin 1 / Western European
English - United States
RT_ICON
7
3.50817
270376
Latin 1 / Western European
English - United States
RT_ICON
8
4.33111
67624
Latin 1 / Western European
English - United States
RT_ICON
9
5.37856
9640
Latin 1 / Western European
English - United States
RT_ICON
10
5.68979
4264
Latin 1 / Western European
English - United States
RT_ICON

Imports

advapi32.dll
comctl32.dll
kernel32.dll
kernel32.dll (delay-loaded)
netapi32.dll
oleaut32.dll
user32.dll
version.dll

Exports

Title
Ordinal
Address
dbkFCallWrapperAddr
1
779836
__dbk_fcall_wrapper
2
53408
TMethodImplementationIntercept
3
344160
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
25
Malicious processes
6
Suspicious processes
9

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start purple bitch - linkvertise downloader_vz-9xa1.exe no specs purple bitch - linkvertise downloader_vz-9xa1.tmp no specs purple bitch - linkvertise downloader_vz-9xa1.exe purple bitch - linkvertise downloader_vz-9xa1.tmp sabsi.exe cookie_mmm_irs_ppi_902_451_o.exe iexplore.exe iexplore.exe avg_antivirus_free_setup.exe instup.exe instup.exe sbr.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs avemupdate.exe no specs avemupdate.exe avemupdate.exe avemupdate.exe avbugreport.exe setupinf.exe no specs setupinf.exe no specs drvinst.exe no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.catC:\Program Files\AVG\Antivirus\SetupInf.exe—instup.exe
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Antivirus Installer
Exit code:
0
Version:
22.9.7554.0
Modules
Images
c:\program files\avg\antivirus\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
332"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2092 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
356AvEmUpdate.exe /installer1 /emupdater /applydll "C:\Program Files\AVG\Antivirus\Setup\5bd6a794-0e4a-43f7-8315-d5513642916e.dll"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
AvEmUpdate.exe
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Emergency Update
Exit code:
0
Version:
22.9.7554.0
Modules
Images
c:\program files\avg\antivirus\avemupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
1208"C:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\prod1_extract\cookie_mmm_irs_ppi_902_451_o.exe" /silent /ws /psh:92pTtLC14DkVy5hX4DOyWFDvHZFTkspbpMGTg13p3ABOOFl5P3OY72dhjj69G9cjrLIOtjIyb5pFFIC:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\prod1_extract\cookie_mmm_irs_ppi_902_451_o.exe
Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmp
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Antivirus Installer
Exit code:
0
Version:
2.1.1279.0
Modules
Images
c:\users\admin\appdata\local\temp\is-g11ho.tmp\prod1_extract\cookie_mmm_irs_ppi_902_451_o.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1780"C:\Windows\Temp\asw.e15807512ef0dbea\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtLC14DkVy5hX4DOyWFDvHZFTkspbpMGTg13p3ABOOFl5P3OY72dhjj69G9cjrLIOtjIyb5pFFI /cookie:mmm_irs_ppi_902_451_o /ga_clientid:72b1a30f-8b87-49b3-9af6-ea93f64d5938 /edat_dir:C:\Windows\Temp\asw.e15807512ef0dbeaC:\Windows\Temp\asw.e15807512ef0dbea\avg_antivirus_free_setup.exe
cookie_mmm_irs_ppi_902_451_o.exe
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Antivirus
Exit code:
0
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.e15807512ef0dbea\avg_antivirus_free_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
2092"C:\Program Files\Internet Explorer\iexplore.exe" https://rentry.co/cghqxC:\Program Files\Internet Explorer\iexplore.exe
Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
2276"C:\Program Files\AVG\Antivirus\SetupInf.exe" /install /netservice:avgNetNd6 /catalog:avgNetNd6.cat "C:\Program Files\AVG\Antivirus\setup\Inf\avgNetNd6.inf"C:\Program Files\AVG\Antivirus\SetupInf.exe—instup.exe
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Antivirus Installer
Exit code:
0
Version:
22.9.7554.0
Modules
Images
c:\program files\avg\antivirus\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2488AvEmUpdate.exe /installer1 /emupdater /applydll "C:\Program Files\AVG\Antivirus\Setup\aa8e7a00-5757-48fc-a40d-1c36db877ec1.dll"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
AvEmUpdate.exe
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Emergency Update
Exit code:
0
Version:
22.9.7554.0
Modules
Images
c:\program files\avg\antivirus\avemupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
2552"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.catC:\Program Files\AVG\Antivirus\SetupInf.exe—instup.exe
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Antivirus Installer
Exit code:
0
Version:
22.9.7554.0
Modules
Images
c:\program files\avg\antivirus\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2584"C:\Users\admin\AppData\Local\Temp\is-3AGE5.tmp\Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmp" /SL5="$2013A,3586010,1235456,C:\Users\admin\AppData\Local\Temp\Purple Bitch - Linkvertise Downloader_vZ-9XA1.exe" /SPAWNWND=$20130 /NOTIFYWND=$20138 C:\Users\admin\AppData\Local\Temp\is-3AGE5.tmp\Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmp
Purple Bitch - Linkvertise Downloader_vZ-9XA1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-3age5.tmp\purple bitch - linkvertise downloader_vz-9xa1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
64 807
Read events
59 162
Write events
5 637
Delete events
8

Modification events

(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
180A00008A803B4F7BD8D801
(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
53EDDF713DF07E5CABA4AA7DA5B1BBBC15920C502E32AE435ED5CE33497E8F67
(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E6070A000300050005001D000B008500010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(2584) Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000763803667BD8D801
Executable files
477
Suspicious files
165
Text files
226
Unknown types
44

Dropped files

PID
Process
Filename
Type
3296Purple Bitch - Linkvertise Downloader_vZ-9XA1.exeC:\Users\admin\AppData\Local\Temp\is-7NKLM.tmp\Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpexecutable
MD5:—
SHA256:—
3848Purple Bitch - Linkvertise Downloader_vZ-9XA1.exeC:\Users\admin\AppData\Local\Temp\is-3AGE5.tmp\Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpexecutable
MD5:—
SHA256:—
3156saBSI.exeC:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00000057003F001D0006.txttext
MD5:—
SHA256:—
2584Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpC:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\botva2.dllexecutable
MD5:67965A5957A61867D661F05AE1F4773E
SHA256:450B9B0BA25BF068AFBC2B23D252585A19E282939BF38326384EA9112DFD0105
2584Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpC:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\AVG_AV.pngimage
MD5:5EF5291810C454A35F76D976105F37CC
SHA256:03E69E8C87732C625DF2F628AC63BD145268F9DEA9C5F3DD3670B1CF349A995C
2584Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpC:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\error.pngimage
MD5:49C631D696316E3BD64C329DD371E20E
SHA256:177C744BE364460669C7F4CB9E047880A3EBDFA2246CBE7972BC23B9FC5C66D6
2584Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpC:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\is-KK4EE.tmpimage
MD5:DB6C259CD7B58F2F7A3CCA0C38834D0E
SHA256:494169CDD9C79EB4668378F770BFA55D4B140F23A682FF424441427DFAB0CED2
2584Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpC:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\is-FI33Q.tmpimage
MD5:5EF5291810C454A35F76D976105F37CC
SHA256:03E69E8C87732C625DF2F628AC63BD145268F9DEA9C5F3DD3670B1CF349A995C
2584Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpC:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\side-logo.pngimage
MD5:06B0076D9F4E2488D32855A0161E9C74
SHA256:929243F002EB4209A9E68AF6744A3D63ECE2B173C910A59D6752536DABF3870B
2584Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmpC:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\DimensionUtils.dllexecutable
MD5:CE2DC2CC12AEC529511DA19CF63BA802
SHA256:BDE7CC0193AD2FBDFA9F072D9003BF1C82CD27E027B2E038343514F8CC8EE6D2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
65
TCP/UDP connections
107
DNS requests
95
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1208
cookie_mmm_irs_ppi_902_451_o.exe
GET
200
23.48.23.6:80
http://iavs9x.avg.u.avcdn.net/avg/iavs9x/avg_antivirus_free_setup.exe
US
executable
8.44 Mb
whitelisted
1208
cookie_mmm_irs_ppi_902_451_o.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
US
—
—
whitelisted
2636
instup.exe
GET
200
104.85.249.107:80
http://l9346865.iavs9x.avg.u.avcdn.net/avg/iavs9x/avdump_x86_ais-cb6.vpx
NL
binary
380 Kb
whitelisted
2636
instup.exe
GET
200
104.85.249.107:80
http://l9346865.iavs9x.avg.u.avcdn.net/avg/iavs9x/prod-pgm.vpx
NL
binary
572 b
whitelisted
332
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?800895010ebb7f72
US
compressed
60.9 Kb
whitelisted
1208
cookie_mmm_irs_ppi_902_451_o.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
US
—
—
whitelisted
2636
instup.exe
GET
200
104.85.249.107:80
http://l9346865.iavs9x.avg.u.avcdn.net/avg/iavs9x/sbr_x86_ais-cb6.vpx
NL
binary
9.74 Kb
whitelisted
332
iexplore.exe
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
1208
cookie_mmm_irs_ppi_902_451_o.exe
POST
200
142.250.186.110:80
http://www.google-analytics.com/collect
US
image
35 b
whitelisted
1780
avg_antivirus_free_setup.exe
GET
200
142.250.186.110:80
http://www.google-analytics.com/collect?aiid=mmm_irs_ppi_902_451_o&an=Avg%20Free&av=22.9.7554&cd=stub-extended&cd3=Online&cid=6d6f10a2-2585-4228-8533-eb82836d3c98&dt=Installation&t=screenview&tid=UA-58120669-4&v=1
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2584
Purple Bitch - Linkvertise Downloader_vZ-9XA1.tmp
13.224.194.69:443
d2khbwcectqqex.cloudfront.net
AMAZON-02
US
suspicious
1208
cookie_mmm_irs_ppi_902_451_o.exe
34.117.223.223:80
v7event.stats.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
1208
cookie_mmm_irs_ppi_902_451_o.exe
23.48.23.6:80
iavs9x.avg.u.avcdn.net
Akamai International B.V.
DE
suspicious
332
iexplore.exe
107.189.8.5:443
rentry.co
PONYNET
LU
unknown
1208
cookie_mmm_irs_ppi_902_451_o.exe
142.250.186.110:80
www.google-analytics.com
GOOGLE
US
whitelisted
3156
saBSI.exe
44.231.120.241:443
apis.mosaic.analytics.awscommon.mcafee.com
AMAZON-02
US
unknown
—
—
23.35.236.52:443
sadownload.mcafee.com
AKAMAI-AS
DE
suspicious
3156
saBSI.exe
23.35.236.52:443
sadownload.mcafee.com
AKAMAI-AS
DE
suspicious
332
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
332
iexplore.exe
104.244.78.163:443
a.rentry.co
PONYNET
LU
suspicious

DNS requests

Domain
IP
Reputation
d2khbwcectqqex.cloudfront.net
  • 13.224.194.69
  • 13.224.194.48
  • 13.224.194.153
  • 13.224.194.68
suspicious
dns.msftncsi.com
  • 131.107.255.255
shared
cu1pehnswad01.servicebus.windows.net
  • 104.208.16.0
whitelisted
iavs9x.avg.u.avcdn.net
  • 23.48.23.6
  • 23.48.23.20
whitelisted
www.google-analytics.com
  • 142.250.186.110
whitelisted
v7event.stats.avast.com
  • 34.117.223.223
whitelisted
apis.mosaic.analytics.awscommon.mcafee.com
  • 44.231.120.241
  • 44.241.177.58
unknown
rentry.co
  • 107.189.8.5
suspicious
sadownload.mcafee.com
  • 23.35.236.52
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

PID
Process
Class
Message
1208
cookie_mmm_irs_ppi_902_451_o.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3156
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3156
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
4064
AvEmUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-G11HO.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Purple Bitch - Linkvertise Downloader_vZ-9XA1.exe