| File name: | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875 |
| Full analysis: | https://app.any.run/tasks/a4e751b0-1240-4ef3-b841-8d5eda323c0b |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | August 02, 2024, 05:17:42 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 8E3C88DDB6D23DA0B303C30FD5E002D6 |
| SHA1: | 917D6A8DC7A2473E0DFD93D5024066A074DE2A3A |
| SHA256: | 466325FD3E7E6ACA180949508D5B31A6D603F2038BDB011B73E649F510C44B0B |
| SSDEEP: | 98304:vM1dh0wNtG9wpWlRVWZ+jKYQrO4sXLramoKuIIqZLHgYUE1TeSYbx2swjQ8uOliu:4/bxG7dBd |
| .exe | | | Win32 Executable (generic) (3.6) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (1.6) |
| .exe | | | DOS Executable Generic (1.5) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1970:02:17 12:03:12+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 2176512 |
| InitializedDataSize: | 1926656 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x9b08a |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2024.7.8.638 |
| ProductVersionNumber: | 9.3.0.2772 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Dynamic link library |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| CompanyName: | Kingsoft Corporation |
| FileDescription: | Kingsoft Security - 安装程序 |
| FileVersion: | 2024,07,05,2772 |
| InternalName: | KInstallTool |
| LegalCopyright: | Copyright (C) 1998-2024 Kingsoft Corporation |
| OriginalFileName: | - |
| ProductName: | Kingsoft Internet Security |
| ProductVersion: | 9,3,0,2772 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6432 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | — | explorer.exe | |||||||||||
User: admin Company: Kingsoft Corporation Integrity Level: MEDIUM Description: Kingsoft Security - 安装程序 Exit code: 3221226540 Version: 2024,07,05,2772 Modules
| |||||||||||||||
| 6480 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | explorer.exe | ||||||||||||
User: admin Company: Kingsoft Corporation Integrity Level: HIGH Description: Kingsoft Security - 安装程序 Version: 2024,07,05,2772 Modules
| |||||||||||||||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} |
| Operation: | write | Name: | idex |
Value: 07f97b39538cf5132f4d6a0081fe970f | |||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} |
| Operation: | write | Name: | idno |
Value: 1 | |||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E} |
| Operation: | write | Name: | did |
Value: 544CE2F7AD2086089700061031EBEE5C | |||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E} |
| Operation: | write | Name: | PacketPath_104_716_1 |
Value: C:\Users\admin\AppData\Local\Temp\duba_u30419932_sv1_83_33.dll | |||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E} |
| Operation: | write | Name: | PacketPath_104_716_3 |
Value: C:\Users\admin\AppData\Local\Temp\safedown.exe | |||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} |
| Operation: | write | Name: | svrid |
Value: | |||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} |
| Operation: | write | Name: | svrid |
Value: c2sj5kx4a5qhh9gbfwjzoy8pewtl | |||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6480) SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\install_res\100.png | image | |
MD5:A64D7F2A825F5547182E9E3EE25B4544 | SHA256:E78B678846C177786E70E29D5111359D4AFF20D9AC5935FAD2BE87B17D7F9FC9 | |||
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\install_res\backup_0307\6000.xml | text | |
MD5:B1C00F67FE681FFF27F80A020D4D8CD9 | SHA256:7C37E942CE92FC48457FC6D484E8ED788DA7B8B23689C0ED4601D26B0F629336 | |||
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\install_res\soft.ico | image | |
MD5:F09986091A0DA5D72A57248E12A9AE4E | SHA256:20C293C66182884940954A5EE7A37937B3FBBC90BDB0FCEE714B66BEE2518671 | |||
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\duba_u30419932_sv1_83_33.dll | — | |
MD5:— | SHA256:— | |||
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\install_res\backup_0317\soft.ico | image | |
MD5:F09986091A0DA5D72A57248E12A9AE4E | SHA256:20C293C66182884940954A5EE7A37937B3FBBC90BDB0FCEE714B66BEE2518671 | |||
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\install_res\backup_0317\100.png | image | |
MD5:A64D7F2A825F5547182E9E3EE25B4544 | SHA256:E78B678846C177786E70E29D5111359D4AFF20D9AC5935FAD2BE87B17D7F9FC9 | |||
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\install_res\110.png | image | |
MD5:020AE4ED917D5F84277384CAB39E56B0 | SHA256:DC35117220A1A6959FFC2125DBD3A40452F88FFCA94B2A69CCBD9CF58380FDD9 | |||
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\install_res\backup_0317\6000.xml | text | |
MD5:9605F14AED72906A40155329EAE6F49B | SHA256:B6C22395227C36B8BBE240CB826B1277A65DC6AAB15A46A0E2D3F96485BFB098 | |||
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\install_res\backup_0307\6001.xml | text | |
MD5:A41FE6AD4115C9508AF69013806AF36D | SHA256:C300345EA071E284C7B619544ED1BBD993DA4052307189962A7876AFE042D082 | |||
| 6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | C:\Users\admin\AppData\Local\Temp\install_res\backup_0307\6002.xml | html | |
MD5:009DFBF0B4E8AACBBD726B411267C62B | SHA256:6C078C654FB149203708810289BC6E6A94DDA59D62CC828E5746F5FFD15FF2A4 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | POST | 200 | 121.37.247.153:80 | http://infoc0.duba.net/c/ | unknown | — | — | unknown |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | GET | 200 | 221.194.141.155:80 | http://2398.35go.net/defend/o1/jcqgx.ini | unknown | — | — | whitelisted |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | POST | 200 | 121.37.247.153:80 | http://infoc0.duba.net/c/ | unknown | — | — | unknown |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | POST | 200 | 121.37.247.153:80 | http://infoc0.duba.net/c/ | unknown | — | — | unknown |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | GET | 200 | 36.42.77.167:80 | http://softmgr.duba.net/softmgr_v2/softdetail/70016859.json?ver=1 | unknown | — | — | whitelisted |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | GET | 200 | 218.60.21.6:80 | http://cu003.www.duba.net/duba/tools/dubatools/softmgricon/70016859.png | unknown | — | — | whitelisted |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | POST | 200 | 121.37.247.153:80 | http://infoc0.duba.net/c/ | unknown | — | — | unknown |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | GET | 200 | 218.12.76.155:80 | http://config.i.duba.net/seminstall/104/716.xml?time=1722575885 | unknown | — | — | whitelisted |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | POST | 200 | 121.37.247.153:80 | http://infoc0.duba.net/c/ | unknown | — | — | unknown |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | POST | 200 | 121.37.247.153:80 | http://infoc0.duba.net/c/ | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4100 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1664 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2120 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | 221.194.141.155:80 | 2398.35go.net | CHINA UNICOM China169 Backbone | CN | unknown |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | 121.37.247.153:80 | infoc0.duba.net | Huawei Cloud Service data center | CN | malicious |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | 36.42.77.167:80 | softmgr.duba.net | CHINANET SHAANXI province Cloud Base network | CN | unknown |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | 218.60.21.6:80 | cu003.www.duba.net | CHINA UNICOM China169 Backbone | CN | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
2398.35go.net |
| whitelisted |
infoc0.duba.net |
| whitelisted |
softmgr.duba.net |
| whitelisted |
cu003.www.duba.net |
| whitelisted |
softmgr-softsem-srv.jinshanapi.com |
| unknown |
config.i.duba.net |
| whitelisted |
cd001.www.duba.net |
| whitelisted |
www.bing.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Potentially Bad Traffic | ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0) |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Potentially Bad Traffic | ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0) |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Possibly Unwanted Program Detected | ADWARE [ANY.RUN] PUP.Win32/KingSoft.E HTTP POST Request |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Possibly Unwanted Program Detected | ADWARE [ANY.RUN] PUP.Win32/KingSoft.E HTTP POST Request |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Potentially Bad Traffic | ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0) |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Potentially Bad Traffic | ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0) |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Possibly Unwanted Program Detected | ADWARE [ANY.RUN] PUP.Win32/KingSoft.E HTTP POST Request |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Potentially Bad Traffic | ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0) |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Potentially Bad Traffic | ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0) |
6480 | SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Duba.gen.16761.24875.exe | Possibly Unwanted Program Detected | ADWARE [ANY.RUN] PUP.Win32/KingSoft.E HTTP POST Request |