File name: | ed355114bb1c92caf6c267f44f3351ba |
Full analysis: | https://app.any.run/tasks/da5b2bac-3e56-4d83-bc77-a61642a7f8d5 |
Verdict: | Malicious activity |
Analysis date: | January 14, 2022, 20:51:08 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows |
MD5: | ED355114BB1C92CAF6C267F44F3351BA |
SHA1: | ED6C65876F81A69DB06FE518E2FC9249CFB5B29A |
SHA256: | 4F06D7B11608C4990A46F91120D6E7A76E778111C6DD70A06C518B66C0CDA123 |
SSDEEP: | 6144:o1ju3jPam65ucnNgDoDUhuGGwKveuW4VKYjHyCAJOhrmBlDxqms9ujAJKedmL/M:yMjcuDaUImAStJorohvsMjmKeD |
.exe | | | Win32 EXE PECompact compressed (generic) (35.9) |
---|---|---|
.exe | | | Win32 Executable MS Visual C++ (generic) (27) |
.exe | | | Win64 Executable (generic) (23.9) |
.dll | | | Win32 Dynamic Link Library (generic) (5.6) |
.exe | | | Win32 Executable (generic) (3.9) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2022:01:13 14:38:51+01:00 |
PEType: | PE32 |
LinkerVersion: | 8 |
CodeSize: | 163840 |
InitializedDataSize: | 249856 |
UninitializedDataSize: | - |
EntryPoint: | 0x17b85 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
FileVersionNumber: | 1.0.0.1 |
ProductVersionNumber: | 1.0.0.1 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | Chinese (Simplified) |
CharacterSet: | Unicode |
CompanyName: | - |
FileDescription: | UDPTool Microsoft 基础类应用程序 |
FileVersion: | 1, 0, 0, 1 |
InternalName: | UDPTool |
LegalCopyright: | 版权所有 (C) 2014 |
LegalTrademarks: | - |
OriginalFileName: | UDPTool.EXE |
ProductName: | UDPTool 应用程序 |
ProductVersion: | 1, 0, 0, 1 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 13-Jan-2022 13:38:51 |
Detected languages: |
|
CompanyName: | - |
FileDescription: | UDPTool Microsoft 基础类应用程序 |
FileVersion: | 1, 0, 0, 1 |
InternalName: | UDPTool |
LegalCopyright: | 版权所有 (C) 2014 |
LegalTrademarks: | - |
OriginalFilename: | UDPTool.EXE |
ProductName: | UDPTool 应用程序 |
ProductVersion: | 1, 0, 0, 1 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000F0 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 13-Jan-2022 13:38:51 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00027F5E | 0x00028000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.66252 |
.rdata | 0x00029000 | 0x00008410 | 0x00009000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.8306 |
.data | 0x00032000 | 0x0002A9A0 | 0x00027000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.93281 |
.rsrc | 0x0005D000 | 0x00003664 | 0x00004000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.49622 |
.reloc | 0x00061000 | 0x00008284 | 0x00009000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 3.82082 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.57949 | 736 | Latin 1 / Western European | Chinese - PRC | RT_VERSION |
2 | 4.65542 | 86 | Latin 1 / Western European | English - United States | RT_MANIFEST |
3 | 3.02695 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
4 | 2.74274 | 180 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
5 | 2.34038 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
6 | 2.34004 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
7 | 2.51649 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
8 | 2.45401 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
9 | 2.34864 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
10 | 2.34505 | 308 | Latin 1 / Western European | Chinese - PRC | RT_CURSOR |
ADVAPI32.dll |
GDI32.dll |
KERNEL32.dll |
OLEACC.dll (delay-loaded) |
OLEAUT32.dll |
SHLWAPI.dll |
USER32.dll |
WINSPOOL.DRV |
WS2_32.dll |
Title | Ordinal | Address |
---|---|---|
DllRegisterServer | 1 | 0x00008AF0 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2372 | "C:\Windows\System32\rundll32.exe" "C:\Users\admin\AppData\Local\Temp\ed355114bb1c92caf6c267f44f3351ba.exe", DllRegisterServer | C:\Windows\System32\rundll32.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1888 | C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Local\Temp\ed355114bb1c92caf6c267f44f3351ba.exe",DllRegisterServer | C:\Windows\system32\rundll32.exe | rundll32.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3948 | C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Local\Qfunuwtttsqld\hujrufipy.kjx",YsmyIC | C:\Windows\system32\rundll32.exe | — | rundll32.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2272 | C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Local\Qfunuwtttsqld\hujrufipy.kjx",DllRegisterServer | C:\Windows\system32\rundll32.exe | rundll32.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8} |
Operation: | write | Name: | WpadDecisionReason |
Value: 1 | |||
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8} |
Operation: | write | Name: | WpadDecisionTime |
Value: 18C4B0898809D801 | |||
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8} |
Operation: | write | Name: | WpadDecision |
Value: 0 | |||
(PID) Process: | (2272) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8} |
Operation: | write | Name: | WpadNetworkName |
Value: Network 4 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2272 | rundll32.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:96E3CF8870C9BDA4A5CDBDC69A6FDE21 | SHA256:1B177CC3D92485F47A47A58DA9061B9A602C1417044BECBBCF802BF9B344E276 | |||
2272 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\Tar344E.tmp | cat | |
MD5:D99661D0893A52A0700B8AE68457351A | SHA256:BDD5111162A6FA25682E18FA74E37E676D49CAFCB5B7207E98E5256D1EF0D003 | |||
2272 | rundll32.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:BABA0FBFBAD985FC5E9CCF4F1D843076 | SHA256:36F3F33CD3ABFB13A57B7CB82301DE31B328C98AEF2A2DACA27A9D9B03EB2C3C | |||
1888 | rundll32.exe | C:\Users\admin\AppData\Local\Qfunuwtttsqld\hujrufipy.kjx | executable | |
MD5:ED355114BB1C92CAF6C267F44F3351BA | SHA256:4F06D7B11608C4990A46F91120D6E7A76E778111C6DD70A06C518B66C0CDA123 | |||
2272 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\Cab344D.tmp | compressed | |
MD5:ACAEDA60C79C6BCAC925EEB3653F45E0 | SHA256:6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658 | |||
2272 | rundll32.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:ACAEDA60C79C6BCAC925EEB3653F45E0 | SHA256:6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658 | |||
2272 | rundll32.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:F7DCB24540769805E5BB30D193944DCE | SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2272 | rundll32.exe | GET | 200 | 8.248.137.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ef8717412b699d6e | US | compressed | 59.9 Kb | whitelisted |
2272 | rundll32.exe | GET | 200 | 8.248.137.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?63e154cbaa73557c | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2272 | rundll32.exe | 69.16.218.101:8080 | — | Liquid Web, L.L.C | US | malicious |
2272 | rundll32.exe | 45.138.98.34:80 | — | — | — | malicious |
2272 | rundll32.exe | 8.248.137.254:80 | ctldl.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
ctldl.windowsupdate.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2272 | rundll32.exe | A Network Trojan was detected | ET CNC Feodo Tracker Reported CnC Server group 17 |
2272 | rundll32.exe | A Network Trojan was detected | ET CNC Feodo Tracker Reported CnC Server group 20 |