File name:

Set-up.exe

Full analysis: https://app.any.run/tasks/7df49539-0cae-4b1b-b3ef-4ddae6032d39
Verdict: Malicious activity
Analysis date: April 07, 2024, 11:33:45
OS: Ubuntu 22.04.2
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

41F159509017D234E08EB4F820BAB935

SHA1:

1C27A70F922A95F66F58D8E4B7E91D92C84DA6E3

SHA256:

4460DD8114B5609EA4E9644A659DE0F5B188696D27DC8846D633628B3ADE7C31

SSDEEP:

98304:wz16s9EwkidrwQwPdz9u/ZZmDZJErFXQbZT7wIX025:wz16gBrd3gu/XmDZiF0t5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:10:02 04:16:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.23
CodeSize: 3613696
InitializedDataSize: 4041728
UninitializedDataSize: -
EntryPoint: 0x2d147a
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 5.3.1.470
ProductVersionNumber: 5.3.1.470
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Adobe Inc.
FileDescription: Adobe Installer
FileVersion: 5.3.1.470
InternalName: Adobe Installer
LegalCopyright: © 2020 Adobe. All rights reserved.
OriginalFileName: Adobe Installer
ProductName: Adobe Installer
ProductVersion: 5.3.1.470
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
230
Monitored processes
9
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sh no specs sudo no specs nautilus no specs locale-check no specs systemctl no specs systemctl no specs systemctl no specs systemctl no specs systemctl no specs

Process information

PID
CMD
Path
Indicators
Parent process
9298/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus \"/tmp/Set-up\.exe\" "/bin/sh—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
9299sudo -iu user nautilus /tmp/Set-up.exe/usr/bin/sudo—sh
User:
user
Integrity Level:
UNKNOWN
9300nautilus /tmp/Set-up.exe/usr/bin/nautilus—sudo
User:
user
Integrity Level:
UNKNOWN
9301/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
9328systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
496
9329systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
496
9331systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
496
9332systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
496
9333systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service/usr/bin/systemctl—snapd
User:
root
Integrity Level:
UNKNOWN
Exit code:
1214
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
9300nautilus/home/user/.local/share/nautilus/tags/meta.db-wal —
MD5:—
SHA256:—
9300nautilus/home/user/.local/share/nautilus/tags/meta.db-shm —
MD5:—
SHA256:—
9300nautilus/home/user/.local/share/nautilus/tags/.meta.isrunning —
MD5:—
SHA256:—
9300nautilus/dconf/user —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
13
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.48:80
http://connectivity-check.ubuntu.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.48:80
—
Canonical Group Limited
GB
unknown
—
—
91.189.91.97:80
—
Canonical Group Limited
US
unknown
—
—
185.125.190.17:80
—
Canonical Group Limited
GB
unknown
—
—
212.102.56.182:443
—
Datacamp Limited
DE
unknown
—
—
224.0.0.251:5353
—
—
—
unknown
—
—
195.181.170.19:443
—
Datacamp Limited
DE
unknown
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
unknown

DNS requests

Domain
IP
Reputation
27.100.168.192.in-addr.arpa
  • —
unknown
api.snapcraft.io
  • 185.125.188.54
  • 185.125.188.59
  • 185.125.188.58
  • 185.125.188.55
unknown
connectivity-check.ubuntu.com
  • 2001:67c:1562::23
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::98
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::2b
  • 2001:67c:1562::24
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::23
  • 2620:2d:4002:1::197
  • 2620:2d:4002:1::198
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Set-up.exe