analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Archive.zip__d7273xo9zcihec1b.exe.bin

Full analysis: https://app.any.run/tasks/be47ddd3-9ec6-489b-a88d-6b2dcfd2f87a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: March 14, 2019, 11:55:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
evasion
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

050DF58E34F530B716159BAC88E6EEFE

SHA1:

422DD2E7F41A676CB373E21B75C75426A9CC9938

SHA256:

410828750C57D4DA9A7331C9D7A2ACAF2EC512E4C3CF606CC834CD1DD53F1981

SSDEEP:

6144:7I3qqkPf2Lo35xauEIDwtOlneJ2N6MGOpP5m8lC5SEe4uI1O3AOp8tZr1973:7I3qXPf2U35xauEIDwtc1hpxm8lCEELh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads the Task Scheduler COM API

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
    • Connects to CnC server

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
    • Disables Windows Defender Real-time monitoring

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
  • SUSPICIOUS

    • Checks for external IP

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
    • Creates files in the user directory

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
    • Executable content was dropped or overwritten

      • Archive.zip__d7273xo9zcihec1b.exe.bin.exe (PID: 3360)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x20d37
UninitializedDataSize: -
InitializedDataSize: 116224
CodeSize: 232960
LinkerVersion: 14.16
PEType: PE32
TimeStamp: 2019:03:08 15:14:32+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 08-Mar-2019 14:14:32
Detected languages:
  • English - United States
Debug artifacts:
  • C:\Work\installer\Release\installer_.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 08-Mar-2019 14:14:32
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00038C7C
0x00038E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.57005
.rdata
0x0003A000
0x000170AE
0x00017200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.12635
.data
0x00052000
0x00001F80
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.59739
.rsrc
0x00054000
0x000001E8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.77204
.reloc
0x00055000
0x000030B8
0x00003200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.50294

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89623
392
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
KERNEL32.dll
OLEAUT32.dll
RPCRT4.dll
SHELL32.dll
USER32.dll
WININET.dll
ole32.dll
urlmon.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start archive.zip__d7273xo9zcihec1b.exe.bin.exe no specs archive.zip__d7273xo9zcihec1b.exe.bin.exe

Process information

PID
CMD
Path
Indicators
Parent process
2968"C:\Users\admin\AppData\Local\Temp\Archive.zip__d7273xo9zcihec1b.exe.bin.exe" C:\Users\admin\AppData\Local\Temp\Archive.zip__d7273xo9zcihec1b.exe.bin.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\archive.zip__d7273xo9zcihec1b.exe.bin.exe
c:\systemroot\system32\ntdll.dll
3360"C:\Users\admin\AppData\Local\Temp\Archive.zip__d7273xo9zcihec1b.exe.bin.exe" C:\Users\admin\AppData\Local\Temp\Archive.zip__d7273xo9zcihec1b.exe.bin.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\archive.zip__d7273xo9zcihec1b.exe.bin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
50
Read events
27
Write events
23
Delete events
0

Modification events

(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
Operation:writeName:DisableBehaviorMonitoring
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
Operation:writeName:DisableOnAccessProtection
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
Operation:writeName:DisableScanOnRealtimeEnable
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\WindowsUpdater
Operation:writeName:installed
Value:
1
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3360) Archive.zip__d7273xo9zcihec1b.exe.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Archive_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
3
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\count[1].htmtext
MD5:69EA0352F0F14473EA56BFBA30737839
SHA256:9CEDBDEE488A3B002B053B68E20A079457BEBBF86030017A3CAB22C5ED4C79AC
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\pushbot[1].exeexecutable
MD5:A1880F62D66DA4DF8384BB63AF5D121A
SHA256:DC3E5C180BB14E2678C65E3287EAC3734B06E6EB788748F43D52DAD01310BF84
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Roaming\Microsoft\Launcher.exeexecutable
MD5:050DF58E34F530B716159BAC88E6EEFE
SHA256:410828750C57D4DA9A7331C9D7A2ACAF2EC512E4C3CF606CC834CD1DD53F1981
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\count[1].htmtext
MD5:B9C0AFC9528336C0164477AEE083D759
SHA256:8B3C731BD4CEF46CDD905B85349E4EA26521D990781B941DB9A51CA45B259ED5
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\xml[1].xmlxml
MD5:D041843C4B23DCAFF9BA642E49C0895C
SHA256:374287F7C9501F68B9676BD3CFEEEACBCFEA434C1184737A4629C222A4FC7B07
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Temp\95CE.tmp.exeexecutable
MD5:A1880F62D66DA4DF8384BB63AF5D121A
SHA256:DC3E5C180BB14E2678C65E3287EAC3734B06E6EB788748F43D52DAD01310BF84
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\things[1].xmltext
MD5:E94E995431836C8A57B8F7433585BCB7
SHA256:0298B6C58192BF912EDC9C94A159E26836CF5839E48CC6D0421AF6F723CFD06D
3360Archive.zip__d7273xo9zcihec1b.exe.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\visit[1].htmtext
MD5:81051BCC2CF1BEDF378224B0A93E2877
SHA256:7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
13
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
GET
200
40.117.102.133:80
http://offer101.tk/click.php?cnv_id=d7273xo9zcihec1b
US
malicious
GET
200
137.135.79.79:80
http://adcash.cf/osc/count.php
US
text
5 b
malicious
GET
200
137.135.79.79:80
http://adcash.cf/20190118/things.xml
US
text
4.57 Kb
malicious
GET
200
185.194.141.58:80
http://ip-api.com/xml
DE
xml
656 b
shared
GET
200
137.135.79.79:80
http://adcash.cf/osck/count.php
US
text
3 b
malicious
GET
302
104.18.56.101:80
http://minimal.beneficiary.shop/gor?param1=test&param2=bt
US
html
133 b
shared
GET
200
137.135.79.79:80
http://www.adcash.cf/20190118/pushbot.exe
US
executable
144 Kb
malicious
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
POST
200
216.58.206.4:80
http://google-analytics.com/collect
US
image
35 b
whitelisted
GET
200
137.135.79.79:80
http://adcash.cf/source/pp/visit.php
US
text
2 b
malicious
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
POST
200
216.58.206.4:80
http://google-analytics.com/collect
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
185.194.141.58:80
ip-api.com
netcup GmbH
DE
unknown
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
40.117.102.133:80
offer101.tk
Microsoft Corporation
US
malicious
216.58.206.4:80
google-analytics.com
Google Inc.
US
whitelisted
172.217.22.67:443
www.gstatic.com
Google Inc.
US
whitelisted
172.217.16.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
137.135.79.79:80
adcash.cf
Microsoft Corporation
US
suspicious
104.18.56.101:80
minimal.beneficiary.shop
Cloudflare Inc
US
shared
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
138.68.113.179:443
click.dailynews.support
Digital Ocean, Inc.
DE
unknown

DNS requests

Domain
IP
Reputation
offer101.tk
  • 40.117.102.133
malicious
ip-api.com
  • 185.194.141.58
shared
google-analytics.com
  • 216.58.206.4
whitelisted
adcash.cf
  • 137.135.79.79
malicious
www.adcash.cf
  • 137.135.79.79
malicious
minimal.beneficiary.shop
  • 104.18.56.101
  • 104.18.57.101
unknown
www.gstatic.com
  • 172.217.22.67
whitelisted
clientservices.googleapis.com
  • 172.217.16.195
whitelisted
accounts.google.com
  • 172.217.16.141
shared
click.dailynews.support
  • 138.68.113.179
unknown

Threats

PID
Process
Class
Message
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .cf Domain
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/QwertMiner CoinMiner UA
3360
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/QwertMiner CoinMiner UA
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4 ETPRO signatures available at the full report
Process
Message
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
[14/03/2019 11:56:22:0229] 3.0
Archive.zip__d7273xo9zcihec1b.exe.bin.exe
[14/03/2019 11:56:22:0229] CommandLine: i