analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

[email protected]

Full analysis: https://app.any.run/tasks/3e74797d-5269-4fb0-a758-3bb57660734f
Verdict: Malicious activity
Analysis date: May 30, 2020, 14:50:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

248AADD395FFA7FFB1670392A9398454

SHA1:

C53C140BBDEB556FCA33BC7F9B2E44E9061EA3E5

SHA256:

51290129CCCCA38C6E3B4444D0DFB8D848C8F3FC2E5291FC0D219FD642530ADC

SSDEEP:

3072:15TDpNFVbxDSXJFFGhcBR1WLZ37p73G8Wn7GlDOg+ELqdSxo5XtIZjnvxRJgghaR:157TcfFPB6B3GL7g+me5aZjn5VlI9T/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 6AdwCleaner.exe (PID: 2380)

    • Changes the autorun value in the registry

      • 6AdwCleaner.exe (PID: 2380)

    • Connects to CnC server

      • 6AdwCleaner.exe (PID: 2380)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

    • Reads Internet Cache Settings

      • 6AdwCleaner.exe (PID: 2380)

    • Reads internet explorer settings

      • 6AdwCleaner.exe (PID: 2380)

    • Executed via COM

      • iexplore.exe (PID: 2656)

    • Creates files in the user directory

      • 6AdwCleaner.exe (PID: 2380)
      • notepad++.exe (PID: 2860)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3428)
      • iexplore.exe (PID: 2656)
      • iexplore.exe (PID: 3936)

    • Manual execution by user

      • notepad++.exe (PID: 2860)
      • explorer.exe (PID: 2848)

    • Application launched itself

      • iexplore.exe (PID: 2656)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3428)
      • iexplore.exe (PID: 3936)

    • Changes internet zones settings

      • iexplore.exe (PID: 2656)

    • Creates files in the user directory

      • iexplore.exe (PID: 3936)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x30e4
UninitializedDataSize: 1024
InitializedDataSize: 162816
CodeSize: 24064
LinkerVersion: 6
PEType: PE32
TimeStamp: 2013:12:25 06:01:41+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Dec-2013 05:01:41
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 25-Dec-2013 05:01:41
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005DE2
0x00005E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.50844
.rdata
0x00007000
0x000012DA
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.10051
.data
0x00009000
0x00025498
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.04207
.ndata
0x0002F000
0x00008000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00037000
0x0000B268
0x0000B400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.91524

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.27028
773
UNKNOWN
English - United States
RT_MANIFEST
103
1.51664
20
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
8
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start [email protected] 6adwcleaner.exe explorer.exe no specs notepad++.exe gup.exe iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2936"C:\Users\admin\AppData\Local\Temp\[email protected]" C:\Users\admin\AppData\Local\Temp\[email protected]
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2380"C:\Users\admin\AppData\Local\6AdwCleaner.exe" C:\Users\admin\AppData\Local\6AdwCleaner.exe
[email protected]
User:
admin
Integrity Level:
MEDIUM
Description:
AdwareBooC
Version:
1.0.0.0
2848"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2860"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\AppData\Local\Temp\[email protected]"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
4068"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
2656"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3936"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2656 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3428"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2656 CREDAT:3872015 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
1 087
Read events
952
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
9
Text files
63
Unknown types
12

Dropped files

PID
Process
Filename
Type
23806AdwCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\OH0ZG7TB.htmhtml
MD5:8D1C82EECE4BD269FE4E55DB4ADF4F3A
SHA256:8C9778F755C3B34D62472951B4F994C5143F5FE2CEA38C69F702D8FB3C92E1EF
23806AdwCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\min[1].jstext
MD5:5563332AD6AF63C9C94CEF15761BE544
SHA256:4EFEC11A42893D4DF0249174CBE5AFAE24A5734F5DED35C5E84C56BF9F473EC2
23806AdwCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\paymore[1].htmhtml
MD5:6624C7D75A7A071D970D0D6B2A4AA189
SHA256:D46DEBCAC8E29C6EDA09FB81B3144A3F83318847004BF050EC354BD32259478D
23806AdwCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\paydefault[1].htmhtml
MD5:8583A751E2B6DD3A2EF79AF0A7A70667
SHA256:FE8BEA81007287FAAE3087ECDB39EC627334E58B13E50AE7F62D7E51C7F43E36
23806AdwCleaner.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Z8PHX6AR.txttext
MD5:2CFE7E72A7A8A998E452B9377B3C93A6
SHA256:51303E872944C1530DC56EC15F5F561096A4D87883F374BB77BEAF14502B1BBF
23806AdwCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\browserfp.min[1].jsbinary
MD5:1B30B1B34305807C9F14965025F57A08
SHA256:FB5A4C165C5C5F348EF48C64AB724A6B05C7960214DA278E69575B75D4AB991D
23806AdwCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\JMDG8QKD.htmhtml
MD5:440A05EA8F7A5A92696F2C12D17E6898
SHA256:92F0C4C56DA68B5DD92B067AA877258828AECE0571432CBE2A0D20C78227F169
23806AdwCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\js3[1].jstext
MD5:DB3CACFB57BA35D3FCFDBBCF7D46BD42
SHA256:A606134E35DB97024D04789609660C94F87F660DC259D91DB5180E32787D4DAD
23806AdwCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\paymore[1].htmhtml
MD5:D0D03F3BDEF813492A756A94E01E9724
SHA256:CF3F8C2699EB1866F2FF155A7C10B79102423721D22F86450CC776DFF9B7184A
23806AdwCleaner.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\paydefault[1].htmhtml
MD5:641D837735D35A63B5E7B3800AEBEF63
SHA256:29B3769192F8C9DD7ADA69EABB8B32A7976CB3F91711D7D5FF58DE3805293D85
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
82
TCP/UDP connections
57
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2380
6AdwCleaner.exe
GET
—
185.53.179.29:80
http://parkingcrew.net/assets/scripts/js3.js
DE
—
—
whitelisted
2380
6AdwCleaner.exe
GET
200
104.247.81.133:80
http://www.vikingwebscanner.com/scripts/paydefault.php?id=0
CA
html
2.04 Kb
malicious
2380
6AdwCleaner.exe
GET
200
2.16.186.106:80
http://i4.cdn-image.com/__media__/js/min.js?v2.2
unknown
text
2.97 Kb
whitelisted
2380
6AdwCleaner.exe
GET
200
208.91.196.46:80
http://iyfsearch.com/?dn=vikingwebscanner.com&pid=9PO755G95
VG
html
5.83 Kb
suspicious
2380
6AdwCleaner.exe
GET
200
185.53.179.29:80
http://parkingcrew.net/assets/scripts/js3.js
DE
text
17.5 Kb
whitelisted
2380
6AdwCleaner.exe
GET
200
104.247.81.133:80
http://www.vikingwebscanner.com/scripts/paymore.php
CA
html
2.04 Kb
malicious
2380
6AdwCleaner.exe
GET
200
2.16.186.106:80
http://i4.cdn-image.com/__media__/pics/12471/arrow.png
unknown
image
1.04 Kb
whitelisted
2380
6AdwCleaner.exe
GET
200
2.16.107.18:80
http://pxlgnpgecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=10&customerId=9CUO250V9
unknown
binary
31.5 Kb
whitelisted
2380
6AdwCleaner.exe
GET
200
2.16.186.106:80
http://i1.cdn-image.com/__media__/pics/12471/bodybg.png
unknown
image
94.9 Kb
whitelisted
2380
6AdwCleaner.exe
GET
200
208.91.196.46:80
http://iyfsearch.com/px.js?ch=1
VG
text
346 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2380
6AdwCleaner.exe
185.53.179.29:80
parkingcrew.net
Team Internet AG
DE
malicious
3936
iexplore.exe
208.91.196.46:80
iyfsearch.com
Confluence Networks Inc
VG
malicious
2380
6AdwCleaner.exe
2.16.107.18:80
pxlgnpgecom-a.akamaihd.net
Akamai International B.V.
—
malicious
2380
6AdwCleaner.exe
104.247.81.133:80
www.vikingwebscanner.com
Team Internet AG
CA
malicious
4068
gup.exe
172.67.218.84:443
notepad-plus-plus.org
—
US
malicious
2380
6AdwCleaner.exe
2.16.186.106:80
i4.cdn-image.com
Akamai International B.V.
—
whitelisted
3936
iexplore.exe
2.16.186.106:80
i4.cdn-image.com
Akamai International B.V.
—
whitelisted
2380
6AdwCleaner.exe
208.91.196.46:80
iyfsearch.com
Confluence Networks Inc
VG
malicious
—
—
208.91.196.46:80
iyfsearch.com
Confluence Networks Inc
VG
malicious

DNS requests

Domain
IP
Reputation
www.vikingwebscanner.com
  • 104.247.81.133
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
parkingcrew.net
  • 185.53.179.29
whitelisted
iyfsearch.com
  • 208.91.196.46
suspicious
i4.cdn-image.com
  • 2.16.186.106
  • 2.16.186.64
whitelisted
i1.cdn-image.com
  • 2.16.186.106
  • 2.16.186.64
whitelisted
i3.cdn-image.com
  • 2.16.186.106
  • 2.16.186.64
whitelisted
pxlgnpgecom-a.akamaihd.net
  • 2.16.107.18
  • 2.16.107.17
whitelisted
notepad-plus-plus.org
  • 172.67.218.84
  • 104.31.88.28
  • 104.31.89.28
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
2380
6AdwCleaner.exe
Misc activity
SUSPICIOUS [PTsecurity] Parkingcrew Monetize Tracker Checkin
2380
6AdwCleaner.exe
Misc activity
ADWARE [PTsecurity] InstantAccess
2380
6AdwCleaner.exe
Misc activity
SUSPICIOUS [PTsecurity] Parkingcrew Monetize Tracker Checkin
2380
6AdwCleaner.exe
Misc activity
ADWARE [PTsecurity] InstantAccess
1 ETPRO signatures available at the full report
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093