download:

12345.exe

Full analysis: https://app.any.run/tasks/3f9b1fe6-237d-483a-88f2-4381beed5ac2
Verdict: Malicious activity
Analysis date: March 29, 2018, 13:42:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

003EF696CF5492DCE79173BDCB3659C5

SHA1:

074323ACD6D6F1DDC763D6DB73E8BF65ECB3E67F

SHA256:

589FD9D9BA715A4C134FC12502ACABA6E07B48B2CA538C157629B355C471E8AF

SSDEEP:

393216:bA/U/4iO9RoJjxWRZfrIdjeCNvSkK+759BB4bOBE76O1wtlMO4MddKYvob5YvkOy:2iwRcjxWIdu6598bOBE7T16xHKYvouvm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application loaded dropped or rewritten executable

      • 12345.exe (PID: 680)
      • HaoZipLoader.exe (PID: 3412)
      • HaozipSvc.exe (PID: 1972)
      • HaoZipLoader.exe (PID: 312)
      • HaoZipUpdate.exe (PID: 2056)

    • Loads the Task Scheduler COM API

      • HaoZipLoader.exe (PID: 3412)

    • Application was dropped or rewritten from another process

      • ServiceManager.exe (PID: 1300)
      • HaozipSvc.exe (PID: 1972)
      • HaoZipLoader.exe (PID: 3412)
      • HaoZipLoader.exe (PID: 312)
      • HaoZipUpdate.exe (PID: 2056)

  • SUSPICIOUS

    • Creates files in the user directory

      • 12345.exe (PID: 680)
      • HaoZipLoader.exe (PID: 3412)
      • HaoZipLoader.exe (PID: 312)
      • HaoZipUpdate.exe (PID: 2056)

    • Creates COM task schedule object

      • 12345.exe (PID: 680)
      • HaoZipLoader.exe (PID: 3412)

    • Creates a software uninstall entry

      • 12345.exe (PID: 680)

    • Creates files in the program directory

      • 12345.exe (PID: 680)
      • HaozipSvc.exe (PID: 1972)

    • Application launched itself

      • HaoZipLoader.exe (PID: 3412)

    • Modifies the open verb of a shell class

      • HaoZipLoader.exe (PID: 3412)

  • INFO

    • Loads rich edit control libraries

      • 12345.exe (PID: 680)

    • Reads settings of System Certificates

      • 12345.exe (PID: 680)

    • Dropped object may contain URL's

      • 12345.exe (PID: 680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:05:25 11:20:13+02:00
PEType: PE32
LinkerVersion: 12
CodeSize: 44032
InitializedDataSize: 190976
UninitializedDataSize: 4096
EntryPoint: 0x4f00
OSVersion: 5.1
ImageVersion: 6
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 5.9.7.10871
ProductVersionNumber: 5.9.7.10871
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
Comments: 2345好压 v5.9
CompanyName: 2345.com
FileDescription: 2345好压 v5.9 安装程序
FileVersion: 5.9.7.10871
LegalCopyright: 版权所有 © 2018, 2345.com
ProductName: 2345好压
ProductVersion: 5.9.7.10871
SpecialBuild: 000000

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-May-2017 09:20:13
Detected languages:
  • Chinese - PRC
  • English - United States
Comments: 2345好压 v5.9
CompanyName: 2345.com
FileDescription: 2345好压 v5.9 安装程序
FileVersion: 5.9.7.10871
LegalCopyright: 版权所有 © 2018, 2345.com
ProductName: 2345好压
ProductVersion: 5.9.7.10871
SpecialBuild: 000000

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 25-May-2017 09:20:13
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000AAF2
0x0000AC00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.40243
.rdata
0x0000C000
0x00001D26
0x00001E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.94521
.data
0x0000E000
0x0002B640
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.8005
.CRT
0x0003A000
0x00000004
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.0611629
.ndata
0x0003B000
0x0004A000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00085000
0x00004520
0x00004600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14435

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29695
1081
UNKNOWN
English - United States
RT_MANIFEST
2
5.4592
4264
UNKNOWN
English - United States
RT_ICON
3
5.30901
1128
UNKNOWN
English - United States
RT_ICON
103
2.45849
48
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.55952
236
UNKNOWN
English - United States
RT_DIALOG
111
2.36476
76
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start 12345.exe haoziploader.exe no specs servicemanager.exe no specs haoziploader.exe no specs haozipupdate.exe no specs haozipsvc.exe no specs 12345.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
312"C:\Program Files\2345Soft\HaoZip\HaoZipLoader.exe" --rescue --invoke-point=1C:\Program Files\2345Soft\HaoZip\HaoZipLoader.exe—HaoZipLoader.exe
User:
admin
Company:
2345.com
Integrity Level:
HIGH
Description:
2345好压-Windows扩展加载程序
Exit code:
0
Version:
5.9.7.10871
Modules
Images
c:\program files\2345soft\haozip\haoziploader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
680"C:\Users\admin\Downloads\12345.exe" C:\Users\admin\Downloads\12345.exe
explorer.exe
User:
admin
Company:
2345.com
Integrity Level:
HIGH
Description:
2345好压 v5.9 安装程序
Exit code:
0
Version:
5.9.7.10871
Modules
Images
c:\users\admin\downloads\12345.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1300"C:\Program Files\2345Soft\HaoZip\protect\ServiceManager.exe" install "C:\Program Files\2345Soft\HaoZip\protect\HaozipSvc.exe"C:\Program Files\2345Soft\HaoZip\protect\ServiceManager.exe—HaoZipLoader.exe
User:
admin
Company:
2345.com
Integrity Level:
HIGH
Description:
好压核心服务
Exit code:
0
Version:
6.0.0.17212
Modules
Images
c:\program files\2345soft\haozip\protect\servicemanager.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
1972"C:\Program Files\2345Soft\HaoZip\protect\HaozipSvc.exe"C:\Program Files\2345Soft\HaoZip\protect\HaozipSvc.exe—services.exe
User:
SYSTEM
Company:
2345.com
Integrity Level:
SYSTEM
Description:
好压核心服务
Exit code:
0
Version:
6.0.0.17212
Modules
Images
c:\program files\2345soft\haozip\protect\haozipsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2056"C:\Program Files\2345Soft\HaoZip\HaoZipUpdate.exe" -update-force-configC:\Program Files\2345Soft\HaoZip\HaoZipUpdate.exe—HaoZipLoader.exe
User:
admin
Company:
2345.com
Integrity Level:
HIGH
Description:
2345好压-在线升级程序
Exit code:
0
Version:
5.9.7.10871
Modules
Images
c:\program files\2345soft\haozip\haozipupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3412"C:\Program Files\2345Soft\HaoZip\HaoZipLoader.exe" -install02 0 7C:\Program Files\2345Soft\HaoZip\HaoZipLoader.exe—12345.exe
User:
admin
Company:
2345.com
Integrity Level:
HIGH
Description:
2345好压-Windows扩展加载程序
Exit code:
0
Version:
5.9.7.10871
Modules
Images
c:\program files\2345soft\haozip\haoziploader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
3616"C:\Users\admin\Downloads\12345.exe" C:\Users\admin\Downloads\12345.exe—explorer.exe
User:
admin
Company:
2345.com
Integrity Level:
MEDIUM
Description:
2345好压 v5.9 安装程序
Exit code:
3221226540
Version:
5.9.7.10871
Total events
1 795
Read events
624
Write events
1 132
Delete events
39

Modification events

(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(680) 12345.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\12345_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
43
Suspicious files
11
Text files
6
Unknown types
13

Dropped files

PID
Process
Filename
Type
68012345.exeC:\Users\admin\AppData\Local\Temp\RI~FDE2.tmpexecutable
MD5:—
SHA256:—
68012345.exeC:\Program Files\2345Soft\HaoZip\HaoZipUpdate.exeexecutable
MD5:—
SHA256:—
68012345.exeC:\Users\admin\AppData\Local\Temp\nsrFC3B.tmp\FileInfo.dllexecutable
MD5:80FE0F9702D94BB88515F42BF8A4ED34
SHA256:8F7D75E4EA90962C8438785B8F32B0069D0402F8BEFED741A3A98391E478B090
68012345.exeC:\Program Files\2345Soft\HaoZip\HaoZipEditor.dllexecutable
MD5:—
SHA256:—
68012345.exeC:\Program Files\2345Soft\HaoZip\HaoZipRename.exeexecutable
MD5:—
SHA256:—
68012345.exeC:\Program Files\2345Soft\HaoZip\HaoZipLoader.exeexecutable
MD5:—
SHA256:—
68012345.exeC:\Program Files\2345Soft\HaoZip\HaoZipTool.exeexecutable
MD5:—
SHA256:—
68012345.exeC:\Program Files\2345Soft\HaoZip\HaoZipFormats.dllexecutable
MD5:—
SHA256:—
68012345.exeC:\Program Files\2345Soft\HaoZip\HaoZipReplace.exeexecutable
MD5:—
SHA256:—
68012345.exeC:\Program Files\2345Soft\HaoZip\HaoZipMd5.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
221.228.75.133:80
update.inst.2345.com
No.31,Jin-rong Street
CN
suspicious
—
—
42.62.30.188:80
update.haozip.2345.com
China Unicom Beijing Province Network
CN
unknown

DNS requests

Domain
IP
Reputation
update.inst.2345.com
  • 221.228.75.133
malicious
update.haozip.2345.com
  • 42.62.30.188
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
12345.exe