analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

table.png

Full analysis: https://app.any.run/tasks/5a5a3481-d263-42be-8feb-8dcf8fa15b81
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 09:15:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
trickbot
evasion
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

AFDC3DC4E5703F404F366FF1595D5B60

SHA1:

ACBFD6EED4667ADC74879F6D3B75147CFF042C02

SHA256:

48F79C0865A302403C6D29D9CDE35CBDCE9A3865780CA272EF2440968E709B7A

SSDEEP:

6144:ppjImruEl1fkUgYiv1PpTCfNfaPNA9aJ5928LZifuKTXqyid0cZtR:ppjIuu01fa30NSPCo2bF2y+TZtR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Stops/Deletes Windows Defender service

      • cmd.exe (PID: 2692)
      • cmd.exe (PID: 2752)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 2120)

    • Known privilege escalation attack

      • DllHost.exe (PID: 2196)
      • DllHost.exe (PID: 2164)
      • DllHost.exe (PID: 3912)
      • DllHost.exe (PID: 3716)

    • Loads the Task Scheduler COM API

      • table.png.exe (PID: 3372)
      • table.png.exe (PID: 3248)

    • Downloads executable files from the Internet

      • chrome.exe (PID: 3936)

    • Downloads executable files with a strange extension

      • chrome.exe (PID: 3936)

    • Downloads executable files from IP

      • chrome.exe (PID: 3936)

    • Application was dropped or rewritten from another process

      • radiance.exe (PID: 2616)
      • sadiance.exe (PID: 1688)
      • radiance.exe (PID: 3368)
      • sadiance.exe (PID: 1712)
      • radiance.exe (PID: 2312)
      • radiance.exe (PID: 3200)
      • radiance.exe (PID: 2064)
      • radiance.exe (PID: 1908)
      • radiance.exe (PID: 3680)
      • radiance.exe (PID: 3208)
      • radiance.exe (PID: 880)
      • radiance.exe (PID: 1200)
      • radiance.exe (PID: 3484)
      • radiance.exe (PID: 2076)
      • radiance.exe (PID: 3764)
      • radiance.exe (PID: 904)
      • sadiance.exe (PID: 560)

    • Changes settings of System certificates

      • table.png.exe (PID: 3248)

    • Trickbot detected

      • table.png.exe (PID: 3248)

    • Uses SVCHOST.EXE for hidden code execution

      • table.png.exe (PID: 3248)

    • Connects to CnC server

      • table.png.exe (PID: 3248)

    • Stealing of credential data

      • svchost.exe (PID: 2408)

  • SUSPICIOUS

    • Creates files in the user directory

      • table.png.exe (PID: 2964)
      • powershell.exe (PID: 2116)
      • powershell.exe (PID: 3704)
      • radiance.exe (PID: 2616)
      • table.png.exe (PID: 3248)
      • filezilla.exe (PID: 912)
      • filezilla.exe (PID: 3884)
      • filezilla.exe (PID: 4004)
      • filezilla.exe (PID: 3172)
      • filezilla.exe (PID: 932)
      • filezilla.exe (PID: 3556)
      • filezilla.exe (PID: 3812)

    • Executable content was dropped or overwritten

      • table.png.exe (PID: 2964)
      • chrome.exe (PID: 3936)
      • radiance.exe (PID: 2616)
      • radiance.exe (PID: 3368)
      • radiance.exe (PID: 1908)

    • Starts CMD.EXE for commands execution

      • table.png.exe (PID: 2964)
      • table.png.exe (PID: 3372)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 2236)

    • Creates files in the program directory

      • table.png.exe (PID: 3248)

    • Adds / modifies Windows certificates

      • table.png.exe (PID: 3248)

    • Connects to unusual port

      • table.png.exe (PID: 3248)
      • svchost.exe (PID: 2408)

    • Creates files in the Windows directory

      • table.png.exe (PID: 3248)

    • Removes files from Windows directory

      • table.png.exe (PID: 3248)

    • Checks for external IP

      • sadiance.exe (PID: 1712)
      • radiance.exe (PID: 3200)
      • radiance.exe (PID: 3680)
      • radiance.exe (PID: 2064)
      • radiance.exe (PID: 1200)
      • radiance.exe (PID: 3208)
      • radiance.exe (PID: 2312)
      • radiance.exe (PID: 3764)
      • radiance.exe (PID: 880)
      • radiance.exe (PID: 2076)
      • radiance.exe (PID: 904)

    • Loads DLL from Mozilla Firefox

      • svchost.exe (PID: 2408)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 3936)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.1)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 1
OSVersion: 4
EntryPoint: 0x14c0
UninitializedDataSize: 3584
InitializedDataSize: 385536
CodeSize: 91136
LinkerVersion: 2.22
PEType: PE32
TimeStamp: 2018:12:05 10:37:45+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Dec-2018 09:37:45
Detected languages:
  • English - United States
  • Process Default Language
TLS Callbacks: 2 callback(s) detected.

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 05-Dec-2018 09:37:45
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00016378
0x00016400
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.9266
.data
0x00018000
0x00004C48
0x00004E00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.202311
.rdata
0x0001D000
0x00002240
0x00002400
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.08591
.bss
0x00020000
0x00000DCC
0x00000000
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00021000
0x00000A18
0x00000C00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.69071
.CRT
0x00022000
0x00000034
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.269445
.tls
0x00023000
0x00000020
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.200582
.rsrc
0x00024000
0x0003FA58
0x0003FC00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99409

Resources

Title
Entropy
Size
Codepage
Language
Type
1
2.21059
34
Latin 1 / Western European
Process Default Language
RT_GROUP_ICON
2
5.30968
4264
Latin 1 / Western European
Process Default Language
RT_ICON
101
7.99929
254976
Latin 1 / Western European
English - United States
GMINT

Imports

ADVAPI32.dll
KERNEL32.dll
msvcrt.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
112
Monitored processes
58
Malicious processes
21
Suspicious processes
6

Behavior graph

Click at the process to see the details
start drop and start table.png.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs CMSTPLUA no specs table.png.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs radiance.exe chrome.exe no specs #TRICKBOT table.png.exe CMSTPLUA no specs sadiance.exe radiance.exe CMSTPLUA no specs svchost.exe no specs sadiance.exe svchost.exe no specs filezilla.exe no specs filezilla.exe no specs filezilla.exe no specs filezilla.exe no specs filezilla.exe no specs filezilla.exe no specs filezilla.exe no specs filezilla.exe no specs svchost.exe radiance.exe radiance.exe radiance.exe radiance.exe radiance.exe radiance.exe radiance.exe radiance.exe radiance.exe radiance.exe radiance.exe radiance.exe CMSTPLUA no specs sadiance.exe

Process information

PID
CMD
Path
Indicators
Parent process
2964"C:\Users\admin\AppData\Local\Temp\table.png.exe" C:\Users\admin\AppData\Local\Temp\table.png.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2692/c sc stop WinDefendC:\Windows\system32\cmd.exe—table.png.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2752/c sc delete WinDefendC:\Windows\system32\cmd.exe—table.png.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2844/c powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\system32\cmd.exe—table.png.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4048sc stop WinDefendC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1300sc delete WinDefendC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2116powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2196C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3372"C:\Users\admin\AppData\Roaming\WinDefrag\table.png.exe" C:\Users\admin\AppData\Roaming\WinDefrag\table.png.exe—DllHost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
4056/c sc stop WinDefendC:\Windows\system32\cmd.exe—table.png.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1062
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
6 326
Read events
6 022
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
130
Text files
104
Unknown types
12

Dropped files

PID
Process
Filename
Type
2116powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KUFVBS5H1I6048Y8MEO9.temp —
MD5:—
SHA256:—
3704powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TYEZVY5NH1H2FGV6RBWZ.temp —
MD5:—
SHA256:—
3936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOG.old —
MD5:—
SHA256:—
3936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
3936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\2fec113b-4ad5-4fce-8927-78b7d039318e.tmp —
MD5:—
SHA256:—
3936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
3936chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
2964table.png.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:85E3AB8707C2CDB3C6316DC03CBDCA66
SHA256:0896D6D9DEE12496621174855F602F02A117541A171B237AB10A5DA698EC0990
3704powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2116powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19d305.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
43
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3936
chrome.exe
GET
200
145.239.25.101:80
http://145.239.25.101/radiance.png
FR
executable
377 Kb
suspicious
1712
sadiance.exe
GET
200
216.239.32.21:80
http://ipinfo.io/ip
US
text
12 b
shared
3764
radiance.exe
GET
200
78.47.139.102:80
http://myexternalip.com/raw
DE
text
12 b
shared
2312
radiance.exe
GET
302
216.239.32.21:80
http://ipecho.net/plain
US
text
46 b
shared
904
radiance.exe
GET
302
216.239.32.21:80
http://ipecho.net/plain
US
text
46 b
shared
2408
svchost.exe
POST
—
24.247.181.125:8082
http://24.247.181.125:8082/lib369/USER-PC_W617601.5A1D7236BB945CBF39025312AC807A86/81/
US
—
—
suspicious
3248
table.png.exe
GET
200
104.86.111.136:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
NL
compressed
55.2 Kb
whitelisted
880
radiance.exe
GET
200
34.192.84.239:80
http://checkip.amazonaws.com/
US
text
12 b
shared
3200
radiance.exe
GET
200
78.47.139.102:80
http://myexternalip.com/raw
DE
text
12 b
shared
2076
radiance.exe
GET
200
78.47.139.102:80
http://myexternalip.com/raw
DE
text
12 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3936
chrome.exe
172.217.22.131:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3936
chrome.exe
216.58.213.170:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3936
chrome.exe
216.58.213.174:443
apis.google.com
Google Inc.
US
whitelisted
3936
chrome.exe
216.58.213.163:443
www.google.de
Google Inc.
US
whitelisted
3936
chrome.exe
216.58.213.173:443
accounts.google.com
Google Inc.
US
whitelisted
3936
chrome.exe
74.125.193.147:443
www.google.com
Google Inc.
US
unknown
1712
sadiance.exe
216.239.32.21:80
ipinfo.io
Google Inc.
US
whitelisted
3248
table.png.exe
75.108.123.165:449
—
Suddenlink Communications
US
suspicious
3248
table.png.exe
78.47.139.102:443
www.myexternalip.com
Hetzner Online GmbH
DE
suspicious
3248
table.png.exe
92.38.184.111:447
—
JSC Digital Network
RU
suspicious

DNS requests

Domain
IP
Reputation
www.google.de
  • 216.58.213.163
whitelisted
www.gstatic.com
  • 216.58.213.163
whitelisted
clientservices.googleapis.com
  • 172.217.22.131
whitelisted
safebrowsing.googleapis.com
  • 216.58.213.170
whitelisted
accounts.google.com
  • 216.58.213.173
shared
ssl.gstatic.com
  • 216.58.213.163
whitelisted
www.google.com
  • 74.125.193.147
whitelisted
apis.google.com
  • 216.58.213.174
whitelisted
sb-ssl.google.com
  • 108.177.15.190
whitelisted
safebrowsing.google.com
  • 216.58.213.174
whitelisted

Threats

PID
Process
Class
Message
3936
chrome.exe
Misc activity
ET INFO Packed Executable Download
3936
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3936
chrome.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
3936
chrome.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious behavior, PE instead image from server
3936
chrome.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
3248
table.png.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
3248
table.png.exe
A Network Trojan was detected
ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
1712
sadiance.exe
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup ipinfo.io
3248
table.png.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
3248
table.png.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
7 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
table.png