File name:

41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e

Full analysis: https://app.any.run/tasks/29b06d4a-0e9e-4121-bffc-2df978c701c3
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 11:18:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

AE4480B56F9D73EB8C56869426E7683B

SHA1:

BAF1B253DE7F436E4606A5BA2179C8EDC212177D

SHA256:

41DE8EF61C5A21D20A5482C02FBC2F531EEC0B22D306CC7EBFA1411F0A7ECF1E

SSDEEP:

6144:Iwvwawr6rcnYS/EUboJ1iZhfJ0QhL/QCNd1w:BAI4G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Disables the Find the Start menu

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Disables the Shutdown in the Start menu

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Changes image file execution options

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Disables the LogOff the Start menu

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Disables the Run the Start menu

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Actions looks like stealing of personal data

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Steals credentials from Web Browsers

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

  • SUSPICIOUS

    • Creates or modifies Windows services

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Changes the desktop background image

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Creates file in the systems drive root

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Deletes system .NET executable

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

  • INFO

    • The sample compiled with english language support

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Checks supported languages

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Reads the computer name

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Reads the machine GUID from the registry

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe (PID: 716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:14 09:09:12+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.41
CodeSize: 99840
InitializedDataSize: 107008
UninitializedDataSize: -
EntryPoint: 0x17f05
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 114.514.1919.810
ProductVersionNumber: 114.514.1919.810
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: 水龙危险运营 Zoey
FileDescription: I'm a Destructive GDI Malware called Pentoxide. Open me if you want to destroy your pc.
FileVersion: 114.514.1919.810
InternalName: Pentoxide.exe
LegalCopyright: Copyright (C) 2024 水龙危险运营 Zoey, All rights reserved.
OriginalFileName: Pentoxide.exe
ProductName: PentoxideDestructive
ProductVersion: Release1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
120
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
716"C:\Users\admin\Desktop\41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe" C:\Users\admin\Desktop\41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe
explorer.exe
User:
admin
Company:
水龙危险运营 Zoey
Integrity Level:
HIGH
Description:
I'm a Destructive GDI Malware called Pentoxide. Open me if you want to destroy your pc.
Version:
114.514.1919.810
Modules
Images
c:\users\admin\desktop\41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4576"C:\Users\admin\Desktop\41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe" C:\Users\admin\Desktop\41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe—explorer.exe
User:
admin
Company:
水龙危险运营 Zoey
Integrity Level:
MEDIUM
Description:
I'm a Destructive GDI Malware called Pentoxide. Open me if you want to destroy your pc.
Exit code:
3221226540
Version:
114.514.1919.810
Modules
Images
c:\users\admin\desktop\41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
467
Read events
257
Write events
210
Delete events
0

Modification events

(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}
Operation:writeName:UpperFilters
Value:
Pentoxide
(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}
Operation:writeName:UpperFilters
Value:
Pentoxide
(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}
Operation:writeName:UpperFilters
Value:
Pentoxide
(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318}
Operation:writeName:UpperFilters
Value:
Pentoxide
(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{53487c23-680f-4585-acc3-1f10d6777e82}
Operation:writeName:UpperFilters
Value:
Pentoxide
(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk
Operation:writeName:ImagePath
Value:
Pentoxide
(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kbdclass
Operation:writeName:ImagePath
Value:
Pentoxide
(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mouclass
Operation:writeName:ImagePath
Value:
Pentoxide
(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr
Operation:writeName:ImagePath
Value:
Pentoxide
(PID) Process:(716) 41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:LogPixels
Value:
21000
Executable files
0
Suspicious files
1
Text files
1 274
Unknown types
0

Dropped files

PID
Process
Filename
Type
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\y21d8ZS6tF99gAdw8Lq59LH1cJN1IXu97H3w86XHIwCkJABqX2text
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\939v68luNRmAUW4USxGVr85VAU600lIL2zU086NEo2lSEf8RFutext
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\210NHf8Hk4UXih2nwqwDDGqaBlU68nPU9991ELt8bUrm7OVxbTtext
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\qX2s2QBzDBtY93j5VpWSZw395sdOenpp0E3Kqal400CnuGFO3Ztext
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\Y78IB44ejk27yv9ho8iq97zK7Y3dnl5lm8Fogi6Wno4BZcV5Mytext
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\T2mZDwp4zQY1JgctBga1y7R1pjT66Ro3oLGWo877nbGl61u0U0text
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\a08jKbxHuRmPbAaA9qzsRMFNJEBpMMrxTfY7CNT10307Be2ROntext
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\GsVNjXmVr9yd9I8st45Fman8Z6Vm56SG362Kt74zh6i7u982G0text
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\ubhf0cN8uwPhESvBXjmKuesN865eFVsUFqXkOEO46eTpS56WELtext
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
71641de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e.exeC:\8KF6z1A7niYZ5k1XOs32v664VyH8B581kXVNd414E09E2V00S8text
MD5:AD7AE03F4E15AD13FE26D2CCAB73AD6E
SHA256:877C573A1FEE1AFBF65DC0D834598C2EB256720DF962468D96292525B2F52D23
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
15
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
524
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
524
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
204
104.126.37.160:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
524
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
524
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
524
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.179:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.189
  • 2.23.209.185
  • 2.23.209.160
  • 2.23.209.181
  • 2.23.209.177
  • 2.23.209.176
whitelisted
self.events.data.microsoft.com
  • 104.208.16.89
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
41de8ef61c5a21d20a5482c02fbc2f531eec0b22d306cc7ebfa1411f0a7ecf1e