File name: | DashlaneInst.exe |
Full analysis: | https://app.any.run/tasks/43bc0df6-3690-4c51-b4cf-a7567901725c |
Verdict: | Malicious activity |
Analysis date: | December 06, 2022, 06:12:41 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | 3BE372C290A12BD343C25E94ABDC89AC |
SHA1: | E8840F3703DA7E737BC15C950ED768F2B1BD50E1 |
SHA256: | 4F71407A42B514140D5FCE3F122C428484ADCD20CF1A45A8C8D28380C5120426 |
SSDEEP: | 12288:STwwc/MsA2k+l3BNYXwDN9ytoXY6vCCzCE2UPDGiA6brQxzM/PFP79BeI0:aw/MB+3YXuidACyCKDGEozM/PFz9wI |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2019-Jan-24 14:28:37 |
Detected languages: |
|
Comments : | - |
CompanyName: | Dashlane Inc. |
FileDescription: | Dashlane |
FileVersion: | 6.2105.0.43225 |
LegalCopyright: | Copyright 2009-2021 Dashlane Inc. |
LegalTradmarks: | Dashlane is a tradmark of Dashlane Inc. |
ProductName: | Dashlane |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 224 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 5 |
TimeDateStamp: | 2019-Jan-24 14:28:37 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 26288 | 26624 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.35989 |
.rdata | 32768 | 5544 | 5632 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.34624 |
.data | 40960 | 107736 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.61575 |
.ndata | 151552 | 786432 | 0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.rsrc | 937984 | 126088 | 126464 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.24235 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 2.60233 | 67624 | UNKNOWN | English - United States | RT_ICON |
2 | 3.09318 | 16936 | UNKNOWN | English - United States | RT_ICON |
3 | 7.61812 | 13137 | UNKNOWN | English - United States | RT_ICON |
4 | 3.21852 | 9640 | UNKNOWN | English - United States | RT_ICON |
5 | 7.86823 | 6375 | UNKNOWN | English - United States | RT_ICON |
6 | 3.26551 | 4264 | UNKNOWN | English - United States | RT_ICON |
7 | 4.44343 | 1128 | UNKNOWN | English - United States | RT_ICON |
103 | 2.79933 | 104 | UNKNOWN | English - United States | RT_GROUP_ICON |
105 | 2.73893 | 514 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.91148 | 248 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1772 | "C:\Users\admin\Desktop\DashlaneInst.exe" | C:\Users\admin\Desktop\DashlaneInst.exe | Explorer.EXE | ||||||||||||
User: admin Company: Dashlane Inc. Integrity Level: MEDIUM Description: Dashlane Version: 6.2105.0.43225 Modules
| |||||||||||||||
3120 | "C:\Users\admin\Desktop\DashlaneInst.exe" /UAC:50150 /NCRC | C:\Users\admin\Desktop\DashlaneInst.exe | DashlaneInst.exe | ||||||||||||
User: admin Company: Dashlane Inc. Integrity Level: HIGH Description: Dashlane Version: 6.2105.0.43225 Modules
|
(PID) Process: | (1772) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Dashlane\InstallInformation |
Operation: | write | Name: | partnerid |
Value: | |||
(PID) Process: | (1772) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Dashlane\InstallInformation |
Operation: | write | Name: | campaignid |
Value: NO_CAMPAIGN | |||
(PID) Process: | (1772) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Dashlane\InstallInformation |
Operation: | write | Name: | createDesktopShortcut |
Value: true | |||
(PID) Process: | (3120) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Dashlane\InstallInformation |
Operation: | write | Name: | partnerid |
Value: | |||
(PID) Process: | (3120) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Dashlane\InstallInformation |
Operation: | write | Name: | AnonymousInstallerId2 |
Value: 776022409137263215607901726 | |||
(PID) Process: | (3120) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Dashlane\InstallInformation |
Operation: | write | Name: | partnername |
Value: NO_TYPE | |||
(PID) Process: | (3120) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Dashlane\InstallInformation |
Operation: | write | Name: | InstallerPath |
Value: C:\Users\admin\Desktop\DashlaneInst.exe | |||
(PID) Process: | (3120) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (3120) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (3120) DashlaneInst.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: |
PID | Process | Filename | Type | |
---|---|---|---|---|
3120 | DashlaneInst.exe | C:\Users\admin\AppData\Local\Temp\nsh19F3.tmp\System.dll | executable | |
MD5:5BC871689EAB0C9726D71DD0E5921D9B | SHA256:0BCCF2D9FCAE0F2746E52DB6D3DA99C1AB21CBE81FD8D115157D31AFABA4601E | |||
3120 | DashlaneInst.exe | C:\Users\admin\AppData\Local\Temp\progress.bmp | image | |
MD5:3915292A803E2355315A5F12026563E2 | SHA256:4DD5353AB63B732ADE7C904B3586344C39ACE1837562809100E9A4E70C804969 | |||
1772 | DashlaneInst.exe | C:\Users\admin\AppData\Local\Temp\nsf1649.tmp\System.dll | executable | |
MD5:5BC871689EAB0C9726D71DD0E5921D9B | SHA256:0BCCF2D9FCAE0F2746E52DB6D3DA99C1AB21CBE81FD8D115157D31AFABA4601E | |||
3120 | DashlaneInst.exe | C:\Users\admin\AppData\Local\Temp\nsh19F3.tmp\inetc_17-05-09_1.dll | executable | |
MD5:51843D1334D3D9E751622541BBC76131 | SHA256:AF1BC66BCF117B5BA88ED3BE3676928EB527C98C50156405DDEBE73DB1F26E82 | |||
3120 | DashlaneInst.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:9CC252A357697AC13740EAFCB5589ECE | SHA256:7E6F5ACE8BA9ADEA04F0EF22B321031F8BC468FADADD0B4521D492FA0BAA683D | |||
1772 | DashlaneInst.exe | C:\Users\admin\AppData\Local\Temp\dashlaneInstallLog.txt | text | |
MD5:FA7F5959E47ECFFDD8589CA8473B9DCC | SHA256:810115657D2CDC4988263F25ECE7E88DBEB738EE0B80ED1355FDC68F211BF2FD | |||
3120 | DashlaneInst.exe | C:\Users\admin\AppData\Local\Temp\dashlaneInstallLog.txt | text | |
MD5:74A0CB366B1E217E71EA3E39D7E15D01 | SHA256:69955878AC3AB9928EF27C53E4EA59B9D9DA5DB176F368A2011F1DE722BA2AFE | |||
3120 | DashlaneInst.exe | C:\Users\admin\AppData\Local\Temp\nsh19F3.tmp\inetc_17-05-09_2.dll | executable | |
MD5:51843D1334D3D9E751622541BBC76131 | SHA256:AF1BC66BCF117B5BA88ED3BE3676928EB527C98C50156405DDEBE73DB1F26E82 | |||
3120 | DashlaneInst.exe | C:\Users\admin\AppData\Local\Temp\nsh19F3.tmp\nsRandom_1.dll | executable | |
MD5:AB467B8DFAA660A0F0E5B26E28AF5735 | SHA256:DB267D9920395B4BADC48DE04DF99DFD21D579480D103CAE0F48E6578197FF73 | |||
1772 | DashlaneInst.exe | C:\Users\admin\AppData\Local\Temp\nsf1649.tmp\nsRandom_1.dll | executable | |
MD5:AB467B8DFAA660A0F0E5B26E28AF5735 | SHA256:DB267D9920395B4BADC48DE04DF99DFD21D579480D103CAE0F48E6578197FF73 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3120 | DashlaneInst.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEApan6vViUvL1DgpMaS4zxI%3D | US | der | 278 b | whitelisted |
3120 | DashlaneInst.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
3120 | DashlaneInst.exe | GET | 200 | 46.228.146.128:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f04fd9e9c4bf4abc | IL | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3120 | DashlaneInst.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
— | — | 46.228.146.128:80 | ctldl.windowsupdate.com | LLNW | US | unknown |
3120 | DashlaneInst.exe | 54.171.25.177:443 | logs.dashlane.com | AMAZON-02 | IE | unknown |
3120 | DashlaneInst.exe | 104.18.27.218:443 | ws1.dashlane.com | CLOUDFLARENET | — | shared |
Domain | IP | Reputation |
---|---|---|
logs.dashlane.com |
| whitelisted |
ws1.dashlane.com |
| unknown |
dns.msftncsi.com |
| shared |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |