File name:

6434609915953152.zip

Full analysis: https://app.any.run/tasks/fa05e7a4-903d-4c3f-bf17-fd25ad8a4f38
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 18, 2019, 17:34:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
pup
installcore
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1A7C38D22B45C406EE4CC98A2FB804CE

SHA1:

EFEE59D78B9D77E887F57D80F8BC7A45481E1D11

SHA256:

467E4AE995D24C0F1C8651E1F5A8711A0E8D6CFAEA8CE30A8AEA4BC2ACFA66AD

SSDEEP:

49152:/Fwd0PV6L4KkT4he1ipCyhYC/oarhN3vvuIYhdVsokkfs/2N4Mm:/Fwd0PV6fYlipCVNazv2LHVsakYPm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Collection of bill.exe (PID: 3616)
      • Collection of bill.exe (PID: 3068)
      • Collection of bill.exe (PID: 3896)

    • INSTALLCORE was detected

      • Collection of bill.exe (PID: 3068)

    • Connects to CnC server

      • Collection of bill.exe (PID: 3068)

  • SUSPICIOUS

    • Application launched itself

      • Collection of bill.exe (PID: 3616)
      • Collection of bill.exe (PID: 3068)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3752)

    • Reads Environment values

      • Collection of bill.exe (PID: 3068)

    • Reads internet explorer settings

      • Collection of bill.exe (PID: 3068)

  • INFO

    • Manual execution by user

      • Collection of bill.exe (PID: 3616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x00000000
ZipCompressedSize: 2102996
ZipUncompressedSize: 2128406
ZipFileName: 568ea5f11aadcc9f92cdcc2b436bdade883e91d3a03a9fa297ea44e641254bf3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe collection of bill.exe no specs #INSTALLCORE collection of bill.exe collection of bill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Users\admin\Desktop\Collection of bill.exe" /RSF /ppn:YyhwYgxaFRAiP211FM5W /mnlC:\Users\admin\Desktop\Collection of bill.exe
Collection of bill.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Gopan Setup
Exit code:
4294967206
Version:
Modules
Images
c:\users\admin\desktop\collection of bill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3616"C:\Users\admin\Desktop\Collection of bill.exe" C:\Users\admin\Desktop\Collection of bill.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Gopan Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\collection of bill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3752"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\6434609915953152.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3896"C:\Users\admin\Desktop\Collection of bill.exe" /RSF /ppn:YyhwYgxaFRAiP211FM5W /_ShowProgress /mnlC:\Users\admin\Desktop\Collection of bill.exe—Collection of bill.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Gopan Setup
Exit code:
259
Version:
Modules
Images
c:\users\admin\desktop\collection of bill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
604
Read events
552
Write events
52
Delete events
0

Modification events

(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3752) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\6434609915953152.zip
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8F000000440000004F04000039020000
Executable files
1
Suspicious files
3
Text files
69
Unknown types
0

Dropped files

PID
Process
Filename
Type
3068Collection of bill.exeC:\Users\admin\AppData\Local\Temp\001727BC.log —
MD5:—
SHA256:—
3752WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3752.11327\568ea5f11aadcc9f92cdcc2b436bdade883e91d3a03a9fa297ea44e641254bf3executable
MD5:—
SHA256:—
3068Collection of bill.exeC:\Users\admin\AppData\Local\Temp\inH151750024310\form.bmp.Maskbinary
MD5:D2FC989F9C2043CD32332EC0FAD69C70
SHA256:27DD029405CBFB0C3BF8BAC517BE5DB9AA83E981B1DC2BD5C5D6C549FA514101
3068Collection of bill.exeC:\Users\admin\AppData\Local\Temp\inH151750024310\css\helpers\_colors.scsstext
MD5:2DA278FBB61E370E0CC9F548E8154E1C
SHA256:857A73FC1DA7CF54525048AA60EC9E2F07328EE1D718A66E3B17186170BB5B5B
3068Collection of bill.exeC:\Users\admin\AppData\Local\Temp\inH151750024310\css\swAgent.csstext
MD5:2543E3AF757C7D7C8A26C7CF57795F60
SHA256:C38892A06C8F50C6386ED794AF4F1EA3E1897AD5F0C7E19594D9EA7B20CFB3F1
3068Collection of bill.exeC:\Users\admin\AppData\Local\Temp\inH151750024310\css\main.scsstext
MD5:A85DEB7E401725C73E02464106F6501F
SHA256:3B5A044EF2BFF26A7D09AF66A3B8E102CF669BEDEEE65C127B46C4DC21EC344D
3068Collection of bill.exeC:\Users\admin\AppData\Local\Temp\inH151750024310\csshover3.htchtml
MD5:52FA0DA50BF4B27EE625C80D36C67941
SHA256:E37E99DDFC73AC7BA774E23736B2EF429D9A0CB8C906453C75B14C029BDD5493
3068Collection of bill.exeC:\Users\admin\AppData\Local\Temp\inH151750024310\css\ie6_main.scsstext
MD5:D10348D17ADF8A90670696728F54562D
SHA256:E8A3D15CF32009B01B9145B6E62FF6CAA9C2981F81CE063578C73C7ADFF08DFC
3068Collection of bill.exeC:\Users\admin\AppData\Local\Temp\inH151750024310\css\ie6_main.csstext
MD5:AD234E6A62580F62019C78B2A718DE00
SHA256:C4F2684F16C8E4553CC29C604A2F505399039638A34E652A7A1ACDEB157A0861
3068Collection of bill.exeC:\Users\admin\AppData\Local\Temp\inH151750024310\css\helpers\_clearfix.scsstext
MD5:ADD166BC071472DC105F4734D2DCF0E2
SHA256:75EBE8B4A4CBBAC0EB4DE35B60972452B4526C56EEFB5186DD40A92C70773377
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3068
Collection of bill.exe
POST
200
52.30.49.225:80
http://support.sihosophir.com/
IE
—
—
malicious
3068
Collection of bill.exe
POST
200
52.30.49.225:80
http://support.sihosophir.com/
IE
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3068
Collection of bill.exe
52.30.49.225:80
support.sihosophir.com
Amazon.com, Inc.
IE
malicious

DNS requests

Domain
IP
Reputation
support.sihosophir.com
  • 52.30.49.225
  • 52.214.73.247
malicious

Threats

PID
Process
Class
Message
3068
Collection of bill.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1
3068
Collection of bill.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6434609915953152.zip