File name: | MailAccess Checker By G-KLIT.exe |
Full analysis: | https://app.any.run/tasks/c6809357-800f-40ce-b7b9-2330b8684b79 |
Verdict: | Malicious activity |
Analysis date: | January 18, 2020, 05:48:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (console) Intel 80386, for MS Windows |
MD5: | 02EADD468D5B5A606F3A73770AE73A41 |
SHA1: | D639249F959E4BDB2F5C87CF27EE1B5106CE2702 |
SHA256: | 39063D85E04B6DA2A504FED78BF9B8ADA68EAE7CDD1945D9D2AD1D576F149B31 |
SSDEEP: | 196608:EymHbTDp4QeUpg176GtbYPvbJQlHq6e8CxBbO:c6VMg1OGkJQlK |
.exe | | | Win64 Executable (generic) (76.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (12.4) |
.exe | | | Generic Win/DOS Executable (5.5) |
.exe | | | DOS Executable Generic (5.5) |
Subsystem: | Windows command line |
---|---|
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x790a |
UninitializedDataSize: | - |
InitializedDataSize: | 218112 |
CodeSize: | 128000 |
LinkerVersion: | 14 |
PEType: | PE32 |
TimeStamp: | 2019:07:09 16:22:19+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_CUI |
Compilation Date: | 09-Jul-2019 14:22:19 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000108 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 6 |
Time date stamp: | 09-Jul-2019 14:22:19 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0001F3B4 | 0x0001F400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.66635 |
.rdata | 0x00021000 | 0x0000B0EC | 0x0000B200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.10031 |
.data | 0x0002D000 | 0x0000E680 | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.94098 |
.gfids | 0x0003C000 | 0x000000B8 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.86637 |
.rsrc | 0x0003D000 | 0x00019E6E | 0x0001A000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.79041 |
.reloc | 0x00057000 | 0x000017D0 | 0x00001800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.64245 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 7.82053 | 6011 | UNKNOWN | UNKNOWN | RT_ICON |
2 | 1.06643 | 67624 | UNKNOWN | UNKNOWN | RT_ICON |
3 | 1.28327 | 16936 | UNKNOWN | UNKNOWN | RT_ICON |
4 | 1.4402 | 9640 | UNKNOWN | UNKNOWN | RT_ICON |
5 | 1.66849 | 4264 | UNKNOWN | UNKNOWN | RT_ICON |
6 | 2.09007 | 1128 | UNKNOWN | UNKNOWN | RT_ICON |
101 | 2.79908 | 90 | UNKNOWN | UNKNOWN | RT_GROUP_ICON |
KERNEL32.dll |
WS2_32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2208 | "C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe" | C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3904 | "C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe" | C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe | — | MailAccess Checker By G-KLIT.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2696 | C:\Windows\system32\cmd.exe /c cls | C:\Windows\system32\cmd.exe | — | MailAccess Checker By G-KLIT.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3872 | "C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe" "--multiprocessing-fork" "parent_pid=3904" "pipe_handle=1252" | C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe | — | MailAccess Checker By G-KLIT.exe |
User: admin Integrity Level: MEDIUM Exit code: 65536 | ||||
4012 | "C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe" "--multiprocessing-fork" "parent_pid=3904" "pipe_handle=1088" | C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe | — | MailAccess Checker By G-KLIT.exe |
User: admin Integrity Level: MEDIUM Exit code: 65536 | ||||
3784 | "C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe" "--multiprocessing-fork" "parent_pid=3904" "pipe_handle=1364" | C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe | — | MailAccess Checker By G-KLIT.exe |
User: admin Integrity Level: MEDIUM Exit code: 65536 | ||||
1880 | "C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe" "--multiprocessing-fork" "parent_pid=3904" "pipe_handle=604" | C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe | — | MailAccess Checker By G-KLIT.exe |
User: admin Integrity Level: MEDIUM Exit code: 65536 | ||||
1748 | "C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe" "--multiprocessing-fork" "parent_pid=3904" "pipe_handle=1372" | C:\Users\admin\AppData\Local\Temp\MailAccess Checker By G-KLIT.exe | — | MailAccess Checker By G-KLIT.exe |
User: admin Integrity Level: MEDIUM Exit code: 65536 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\MailAccess.exe.manifest | xml | |
MD5:60E873672800DB7FF829EC9778744AB1 | SHA256:5425F3397A1605CB0F0B937A85965C7EE07C19382C72D7CA3D1AE1B8CB5E9DE3 | |||
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\_queue.pyd | executable | |
MD5:8807DC228BB761439DC6525A2966E27E | SHA256:B7ED6DFB6882E8EC4267D9F80CD5B1DC0A43519382FCB72AB5E74C47875C209D | |||
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\_tkinter.pyd | executable | |
MD5:E46970E8EB0061DF01347A3723140E77 | SHA256:71C4545CEE713F26CF2F910A08340DD519C4713B8416479F74B0B9E2683C85D5 | |||
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\_socket.pyd | executable | |
MD5:A4BD8E0C0597A22C3F0601FE798668AA | SHA256:96B0A3CFC16E215F0EF5D1E206F0137B4255005052720E91A58BC98CDE8C898E | |||
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\_lzma.pyd | executable | |
MD5:65880A33015AF2030A08987924CA737B | SHA256:A71366B95D89D1539A6EE751D48A969C1BCA1AA75116424CC5F905F32A625EEA | |||
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\select.pyd | executable | |
MD5:6A796088CD3D1B1D6590364B9372959D | SHA256:74D8E6A57090BA32CF7C82AD9A275351E421842D6EC94C44ADBBA629B1893FA7 | |||
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\_bz2.pyd | executable | |
MD5:FF5AC8FB724EDB1635E2AD985F98EE5B | SHA256:B94F64FCB49F40682ED794FA1940A1DC0C8A28F24A1768D3BFE774CF75F59B62 | |||
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\_multiprocessing.pyd | executable | |
MD5:42A5EC2E2EC56DCA18E7221C1858A7DE | SHA256:C22D475ADA5E8D7EA37124892B4A3D8315E6E66594A2237DCB0BBDF160B053DE | |||
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\_decimal.pyd | executable | |
MD5:E4292AD50769F592F34BC63F62A5E428 | SHA256:0240F15B44E2D3E37EBEFBB221D3D6017BE5EF99806EC4E36C3521F284CB8043 | |||
2208 | MailAccess Checker By G-KLIT.exe | C:\Users\admin\AppData\Local\Temp\_MEI22082\libcrypto-1_1.dll | executable | |
MD5:C0E55A25DD5C5447F15EED0CA6552AB7 | SHA256:9FEFBA93FA3300732B7E68FB3B4DBB57BF2726889772A1D0D6694A71820D71F3 |