analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

维护通知.bin

Full analysis: https://app.any.run/tasks/c1550d08-fa74-42c3-b321-2e226303d5fa
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: August 08, 2020, 11:25:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

010913338CF84943976371EE6BD42C49

SHA1:

5322DEDDD89734A3998BE517C1B77DEFDEC6A625

SHA256:

5809A13718B24A61B70121CCC78D00657D6C17AD4B00B940640D8C8DADCCF7A8

SSDEEP:

24576:XIONmSNEfZY2DfwrDLdX+VScHDlb59wsjg6tdWTlXcFyRO:XfVNEfZpwrDYESlb597iZswO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • jy.exe (PID: 996)
      • jy.exe (PID: 3364)
      • DingDebug.exe (PID: 2968)
      • DingDebug.exe (PID: 3928)

    • Writes to a start menu file

      • 维护通知.bin.exe (PID: 3760)
      • jy.exe (PID: 3364)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3464)
      • DingDebug.exe (PID: 2968)
      • explorer.exe (PID: 352)
      • DingDebug.exe (PID: 3928)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • 维护通知.bin.exe (PID: 3760)

    • Starts CMD.EXE for commands execution

      • 维护通知.bin.exe (PID: 3760)
      • DingDebug.exe (PID: 2968)

    • Executable content was dropped or overwritten

      • 维护通知.bin.exe (PID: 3760)
      • cmd.exe (PID: 2708)

    • Creates files in the user directory

      • cmd.exe (PID: 2708)
      • jy.exe (PID: 3364)
      • DingDebug.exe (PID: 2968)

    • Executed via COM

      • mmc.exe (PID: 2736)
      • explorer.exe (PID: 3616)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 2280)

  • INFO

    • Manual execution by user

      • taskmgr.exe (PID: 1900)
      • DingDebug.exe (PID: 3928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (54.3)
.exe | Win64 Executable (generic) (34.8)
.exe | Win32 Executable (generic) (5.6)
.exe | Generic Win/DOS Executable (2.5)
.exe | DOS Executable Generic (2.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x3b923
UninitializedDataSize: -
InitializedDataSize: 801792
CodeSize: 327680
LinkerVersion: 9
PEType: PE32
TimeStamp: 2020:08:04 14:06:56+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Aug-2020 12:06:56
Detected languages:
  • English - United States
Debug artifacts:
  • D:\Administrator\Desktop\网易CC\collector\Release\collector.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 04-Aug-2020 12:06:56
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0004FFA3
0x00050000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.52367
.rdata
0x00051000
0x00014F26
0x00015000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.89542
.data
0x00066000
0x0008A0B8
0x00086400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.7315
.rsrc
0x000F1000
0x0001CD84
0x0001CE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.62696
.reloc
0x0010E000
0x0000B848
0x0000BA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.40208

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.01229
633
Latin 1 / Western European
English - United States
RT_MANIFEST
2
2.68944
744
Latin 1 / Western European
English - United States
RT_ICON
3
2.74803
296
Latin 1 / Western European
English - United States
RT_ICON
4
2.73679
3752
Latin 1 / Western European
English - United States
RT_ICON
5
2.38649
2216
Latin 1 / Western European
English - United States
RT_ICON
6
1.64388
1384
Latin 1 / Western European
English - United States
RT_ICON
7
2.7403
202
Latin 1 / Western European
English - United States
RT_STRING
8
3.09995
9640
Latin 1 / Western European
English - United States
RT_ICON
9
2.33229
152
Latin 1 / Western European
English - United States
RT_STRING
10
4.09871
1128
Latin 1 / Western European
English - United States
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.dll
OLEACC.dll (delay-loaded)
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
648
Monitored processes
602
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start 维护通知.bin.exe no specs 维护通知.bin.exe jy.exe no specs cmd.exe taskmgr.exe no specs mmc.exe no specs explorer.exe no specs explorer.exe no specs jy.exe searchprotocolhost.exe no specs dingdebug.exe cmd.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs dingdebug.exe find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs explorer.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2268"C:\Users\admin\AppData\Local\Temp\维护通知.bin.exe" C:\Users\admin\AppData\Local\Temp\维护通知.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
3760"C:\Users\admin\AppData\Local\Temp\维护通知.bin.exe" C:\Users\admin\AppData\Local\Temp\维护通知.bin.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
996"C:\Users\Public\Documents\3UO03\jy.exe" a C:\Users\Public\Documents\3UO03\111.zip C:\Users\Public\Documents\3UO03\Roaming\*C:\Users\Public\Documents\3UO03\jy.exe—维护通知.bin.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
2708cmd /c ""C:\Users\Public\Documents\3UO03\copy.bat" "C:\Windows\system32\cmd.exe
维护通知.bin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1900"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2736C:\Windows\system32\mmc.exe -EmbeddingC:\Windows\system32\mmc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2176"C:\Windows\explorer.exe" C:\Users\Public\Documents\3UO03\run.urlC:\Windows\explorer.exe—mmc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3616C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3364"C:\Users\admin\AppData\Roaming\jy.exe" x 111.zip -yC:\Users\admin\AppData\Roaming\jy.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
3464"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Total events
4 245
Read events
3 813
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
4
Text files
6
Unknown types
5

Dropped files

PID
Process
Filename
Type
996jy.exeC:\Users\Public\Documents\3UO03\111.zipcompressed
MD5:B54253613B485F83579517258D6425BD
SHA256:32919C1C85AAD80C62E1DC2FB7A289732EF38355F7A00A3E661462AA16361F8A
2708cmd.exeC:\Users\admin\AppData\Roaming\111.zipcompressed
MD5:B54253613B485F83579517258D6425BD
SHA256:32919C1C85AAD80C62E1DC2FB7A289732EF38355F7A00A3E661462AA16361F8A
3760维护通知.bin.exeC:\Users\Public\Documents\3UO03\DingDebug.exeexecutable
MD5:01D0F51047AEA1A7275F0969DFF052FC
SHA256:2DA870D099A0E1BF40C0D92CACFA873A4624C4A71411818AF9B27499562EBCBE
3760维护通知.bin.exeC:\Users\Public\Documents\3UO03\libcurl.dllexecutable
MD5:058D865CF4AD084E9FEFB69A9C6F6439
SHA256:EB0B96033D6B88EDB6727CAB42947A7FBCE9B39DBF9C1D1F9A9FE3267528A03E
3760维护通知.bin.exeC:\Users\Public\Documents\3UO03\run002.urltext
MD5:6BF9F950F08F473B8A12768301E0CB37
SHA256:4863E86BB8B91A7EBC4AD92AD68CEF96EDE52F2C8854B09547C8AF6DF1E2714A
3760维护通知.bin.exeC:\Users\Public\Documents\3UO03\run.ps1text
MD5:399D1CB1008BC34A93C91C75D9FB3B9C
SHA256:8B4FBC6CA99BB009B9FFABCB47ADEE2520ED90CF4A2E6C02ED99FC52ABFA1D5F
3760维护通知.bin.exeC:\Users\Public\Documents\3UO03\run003.lnklnk
MD5:DA856C86C4A69BB5BA85B8AF1A8DBBFE
SHA256:D14CD22348EF454CE8869B25F390C3108B80477441E356D41D9C33F72B36ABF1
3760维护通知.bin.exeC:\Users\Public\Documents\3UO03\run.battext
MD5:27CE302C84653B433D05B135A3550221
SHA256:024C9FB5F37AECCE6D177BE5062975066B726F9DAF3FD3DF696D14165E6FDD75
3760维护通知.bin.exeC:\Users\Public\Documents\3UO03\run.urltext
MD5:6A319D77F9DAF67937F1D48932BFCA5D
SHA256:2A13A5AC9C32054C133728231FB6AEF9B91CF7E0225E77DAB5D1CCBA8A511921
3760维护通知.bin.exeC:\Users\Public\Documents\3UO03\jy.exeexecutable
MD5:42E83BB2537A79B17E13DD936EC2FEF4
SHA256:00F85BEB322FE51AB3A3B88ABCBBBE40F019A7EE53498E27A507DA6824ADAF76
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3760
维护通知.bin.exe
GET
200
61.147.125.83:80
http://ys-J.ys168.com/436829061/RKWNhTn524L5I3NJN3V/TXX.JPG
CN
compressed
1.65 Mb
malicious
3760
维护通知.bin.exe
GET
209
162.159.236.196:80
http://ck.ys168.com/f_ht/ajcx/wj.aspx?cz=dq&mlbh=1898610&_dlmc=hytl&_dlmm=
unknown
html
1.09 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3760
维护通知.bin.exe
61.147.125.83:80
ys-j.ys168.com
No.31,Jin-rong Street
CN
malicious
2968
DingDebug.exe
45.64.113.192:10086
1777.bzsstw.cn
Cloudie Limited
HK
unknown
3760
维护通知.bin.exe
162.159.236.196:80
ck.ys168.com
Cloudflare Inc
—
malicious

DNS requests

Domain
IP
Reputation
ck.ys168.com
  • 162.159.236.196
  • 162.159.237.196
unknown
ys-j.ys168.com
  • 61.147.125.83
malicious
1777.bzsstw.cn
  • 45.64.113.192
unknown

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
Process
Message
DingDebug.exe
TLS callback: process attach
DingDebug.exe
All seems fine for TLSCallbackProcess.
DingDebug.exe
TLS callback: thread attach
DingDebug.exe
TLS callback: dummy thread launched
DingDebug.exe
All seems fine for TLSCallbackThread.
DingDebug.exe
TLS callback: thread attach
DingDebug.exe
init
DingDebug.exe
TLS callback: thread attach
DingDebug.exe
TLS callback: thread attach
DingDebug.exe
TLS callback: thread attach
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
维护通知.bin