analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

维护通知.bin

Full analysis: https://app.any.run/tasks/46ce89fb-4eba-406a-b113-5e0b114eda73
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: August 08, 2020, 08:44:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

010913338CF84943976371EE6BD42C49

SHA1:

5322DEDDD89734A3998BE517C1B77DEFDEC6A625

SHA256:

5809A13718B24A61B70121CCC78D00657D6C17AD4B00B940640D8C8DADCCF7A8

SSDEEP:

24576:XIONmSNEfZY2DfwrDLdX+VScHDlb59wsjg6tdWTlXcFyRO:XfVNEfZpwrDYESlb597iZswO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • jy.exe (PID: 1940)
      • DingDebug.exe (PID: 1412)
      • jy.exe (PID: 2832)

    • Writes to a start menu file

      • 维护通知.bin.exe (PID: 3752)
      • jy.exe (PID: 2832)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3464)
      • DingDebug.exe (PID: 1412)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 维护通知.bin.exe (PID: 3752)
      • cmd.exe (PID: 3776)

    • Reads Internet Cache Settings

      • 维护通知.bin.exe (PID: 3752)

    • Starts CMD.EXE for commands execution

      • 维护通知.bin.exe (PID: 3752)
      • DingDebug.exe (PID: 1412)

    • Executed via COM

      • mmc.exe (PID: 2304)
      • explorer.exe (PID: 3696)

    • Creates files in the user directory

      • cmd.exe (PID: 3776)
      • jy.exe (PID: 2832)
      • DingDebug.exe (PID: 1412)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 3324)

  • INFO

    • Manual execution by user

      • taskmgr.exe (PID: 3428)
      • cmd.exe (PID: 2692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (54.3)
.exe | Win64 Executable (generic) (34.8)
.exe | Win32 Executable (generic) (5.6)
.exe | Generic Win/DOS Executable (2.5)
.exe | DOS Executable Generic (2.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x3b923
UninitializedDataSize: -
InitializedDataSize: 801792
CodeSize: 327680
LinkerVersion: 9
PEType: PE32
TimeStamp: 2020:08:04 14:06:56+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Aug-2020 12:06:56
Detected languages:
  • English - United States
Debug artifacts:
  • D:\Administrator\Desktop\网易CC\collector\Release\collector.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 04-Aug-2020 12:06:56
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0004FFA3
0x00050000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.52367
.rdata
0x00051000
0x00014F26
0x00015000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.89542
.data
0x00066000
0x0008A0B8
0x00086400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.7315
.rsrc
0x000F1000
0x0001CD84
0x0001CE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.62696
.reloc
0x0010E000
0x0000B848
0x0000BA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.40208

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.01229
633
Latin 1 / Western European
English - United States
RT_MANIFEST
2
2.68944
744
Latin 1 / Western European
English - United States
RT_ICON
3
2.74803
296
Latin 1 / Western European
English - United States
RT_ICON
4
2.73679
3752
Latin 1 / Western European
English - United States
RT_ICON
5
2.38649
2216
Latin 1 / Western European
English - United States
RT_ICON
6
1.64388
1384
Latin 1 / Western European
English - United States
RT_ICON
7
2.7403
202
Latin 1 / Western European
English - United States
RT_STRING
8
3.09995
9640
Latin 1 / Western European
English - United States
RT_ICON
9
2.33229
152
Latin 1 / Western European
English - United States
RT_STRING
10
4.09871
1128
Latin 1 / Western European
English - United States
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.dll
OLEACC.dll (delay-loaded)
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
538
Monitored processes
493
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start 维护通知.bin.exe no specs 维护通知.bin.exe taskmgr.exe no specs jy.exe no specs cmd.exe mmc.exe no specs searchprotocolhost.exe no specs explorer.exe no specs explorer.exe no specs jy.exe dingdebug.exe cmd.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2676"C:\Users\admin\AppData\Local\Temp\维护通知.bin.exe" C:\Users\admin\AppData\Local\Temp\维护通知.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
3752"C:\Users\admin\AppData\Local\Temp\维护通知.bin.exe" C:\Users\admin\AppData\Local\Temp\维护通知.bin.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3428"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1940"C:\Users\Public\Documents\6Zuyk\jy.exe" a C:\Users\Public\Documents\6Zuyk\111.zip C:\Users\Public\Documents\6Zuyk\Roaming\*C:\Users\Public\Documents\6Zuyk\jy.exe—维护通知.bin.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
3776cmd /c ""C:\Users\Public\Documents\6Zuyk\copy.bat" "C:\Windows\system32\cmd.exe
维护通知.bin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2304C:\Windows\system32\mmc.exe -EmbeddingC:\Windows\system32\mmc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3464"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2504"C:\Windows\explorer.exe" C:\Users\Public\Documents\6Zuyk\run.urlC:\Windows\explorer.exe—mmc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3696C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2832"C:\Users\admin\AppData\Roaming\jy.exe" x 111.zip -yC:\Users\admin\AppData\Roaming\jy.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Total events
2 031
Read events
1 787
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
4
Text files
6
Unknown types
4

Dropped files

PID
Process
Filename
Type
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\run003.lnklnk
MD5:62D8CC41D969E06BEFC26152AA8DDC3A
SHA256:E218B28F8D581A5D915443F978773C441F952E38A00B12FCB902B6349B0A2A0F
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\copy.battext
MD5:FC34BEA0B9DADD199B25A395BE6A9CCC
SHA256:661ECB983889AEE20605303677BC727A6421D881A7D611AFE6235BF01A53441E
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\run.battext
MD5:27CE302C84653B433D05B135A3550221
SHA256:024C9FB5F37AECCE6D177BE5062975066B726F9DAF3FD3DF696D14165E6FDD75
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\DingDebug.exeexecutable
MD5:01D0F51047AEA1A7275F0969DFF052FC
SHA256:2DA870D099A0E1BF40C0D92CACFA873A4624C4A71411818AF9B27499562EBCBE
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\jy.exeexecutable
MD5:42E83BB2537A79B17E13DD936EC2FEF4
SHA256:00F85BEB322FE51AB3A3B88ABCBBBE40F019A7EE53498E27A507DA6824ADAF76
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\KK.logbinary
MD5:8D1D2680C2080B990D2BE0601BE1D809
SHA256:9A4081D38A81EC8230F6E26EAB0C4A940A9A28E70DE138F86A1643F25B9137A6
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\run.urltext
MD5:99ADAAC65446428229D476FEDED0055B
SHA256:CCF544898BDB985FE4A2B19A498293D8323C065B70187732C6D103771377BDC1
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\libcurl.dllexecutable
MD5:058D865CF4AD084E9FEFB69A9C6F6439
SHA256:EB0B96033D6B88EDB6727CAB42947A7FBCE9B39DBF9C1D1F9A9FE3267528A03E
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\run001.lnklnk
MD5:ACC8F5E2C980957E348F1AE5041EED18
SHA256:B2B32653D93CFB4E823E54F5282394F011A36BC7F4AC37F44F38B091B5317723
3752维护通知.bin.exeC:\Users\Public\Documents\6Zuyk\run.ps1text
MD5:1ED4CE4193E2D20D69F63C107162E6D3
SHA256:0EEC112298D774B4AB04E0C5D3317C4A86D942538CADFF88A35D273DDB3A331C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3752
维护通知.bin.exe
GET
200
61.147.125.83:80
http://ys-J.ys168.com/436829061/RKWNhIj465L2L4MFM7W/TXX.JPG
CN
compressed
1.65 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1412
DingDebug.exe
45.64.113.192:10086
1777.bzsstw.cn
Cloudie Limited
HK
unknown
3752
维护通知.bin.exe
61.147.125.83:80
ys-j.ys168.com
No.31,Jin-rong Street
CN
malicious
3752
维护通知.bin.exe
162.159.236.196:80
ck.ys168.com
Cloudflare Inc
—
malicious

DNS requests

Domain
IP
Reputation
ck.ys168.com
  • 162.159.236.196
  • 162.159.237.196
unknown
ys-j.ys168.com
  • 61.147.125.83
malicious
1777.bzsstw.cn
  • 45.64.113.192
unknown

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
Process
Message
DingDebug.exe
TLS callback: process attach
DingDebug.exe
All seems fine for TLSCallbackProcess.
DingDebug.exe
All seems fine for TLSCallbackThread.
DingDebug.exe
All seems fine for TLSCallbackThread.
DingDebug.exe
TLS callback: dummy thread launched
DingDebug.exe
TLS callback: thread attach
DingDebug.exe
init
DingDebug.exe
TLS callback: thread attach
DingDebug.exe
TLS callback: thread attach
DingDebug.exe
TLS callback: thread attach
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
维护通知.bin