Analysis date (UTC): 8 November 2025, 16:56Analysis environment: Windows 10 Pro, build 19044, x64

eld5.exe.exe

MD5:CDB67B1C54903F223F7DCCA14AEA67DF

SHA1:DAC11017ABB2D6D196A527C2101AA7077EBC8910

SHA256:4FF37E0D4B7D74C84BD26AE956A71441D8595F22C4EF1C9DB6FBFC1EE2325F5F

Analysis result

Threat level:Malicious activity

Tags:

anti-evasionpythonpyinstaller

Full analysis:Analysis eld5.exe.exe (MD5: CDB67B1C54903F223F7DCCA14AEA67DF) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes the autorun value in the registry

eld5.exe.exe (PID: 7452)

SUSPICIOUS

The process drops C-runtime libraries

eld5.exe.exe (PID: 7428)

Process drops python dynamic module

eld5.exe.exe (PID: 7428)

Application launched itself

eld5.exe.exe (PID: 7428)

Loads Python modules

eld5.exe.exe (PID: 7452)

Process drops legitimate windows executable

eld5.exe.exe (PID: 7428)

Executable content was dropped or overwritten

eld5.exe.exe (PID: 7428)

Starts CMD.EXE for commands execution

eld5.exe.exe (PID: 7452)

Uses WMIC.EXE to obtain Windows Installer data

cmd.exe (PID: 7488)

Accesses product unique identifier via WMI (SCRIPT)

WMIC.exe (PID: 7544)

INFO

Checks supported languages

eld5.exe.exe (PID: 7428)
eld5.exe.exe (PID: 7452)

Reads the computer name

eld5.exe.exe (PID: 7428)
eld5.exe.exe (PID: 7452)

Create files in a temporary directory

eld5.exe.exe (PID: 7428)

The sample compiled with english language support

eld5.exe.exe (PID: 7428)

Reads the machine GUID from the registry

eld5.exe.exe (PID: 7452)

Reads security settings of Internet Explorer

WMIC.exe (PID: 7544)
Taskmgr.exe (PID: 3972)

Checks proxy server information

eld5.exe.exe (PID: 7452)

Launching a file from a Registry key

eld5.exe.exe (PID: 7452)

PyInstaller has been detected (YARA)

eld5.exe.exe (PID: 7428)
eld5.exe.exe (PID: 7452)

Manual execution by a user

Taskmgr.exe (PID: 3972)
Taskmgr.exe (PID: 3308)

Threats

PID	Process	Class	Message
—	—	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)