File name:

GDA4.11.exe

Full analysis: https://app.any.run/tasks/aaa8d138-ef1d-47a5-8173-3ba2bf482394
Verdict: Malicious activity
Analysis date: May 17, 2025, 08:28:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
vmprotect
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

61955E5DC20738A3AF9E6A3D19F3C24D

SHA1:

1C9285861A978213EDA408488F3228AFDFA32659

SHA256:

59E320FDB6A2FFC971934450541E0BD1DF4C0442BCA5C7549559109BF7553DD4

SSDEEP:

98304:38dEjwM8xCMqlovj0jUjo7eSsNu3x4+P17bRn1xu/9I/dQNRjpZhnDjVfileW6UG:rCRijgqQTadpSHcY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • GDA4.11.exe (PID: 5072)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • GDA4.11.exe (PID: 5072)

    • Reads security settings of Internet Explorer

      • GDA4.11.exe (PID: 5072)

    • Connects to unusual port

      • GDA4.11.exe (PID: 5072)

    • Found regular expressions for crypto-addresses (YARA)

      • GDA4.11.exe (PID: 5072)

  • INFO

    • The sample compiled with chinese language support

      • GDA4.11.exe (PID: 5072)

    • Checks supported languages

      • GDA4.11.exe (PID: 5072)

    • The sample compiled with english language support

      • GDA4.11.exe (PID: 5072)

    • Creates files or folders in the user directory

      • GDA4.11.exe (PID: 5072)

    • Reads the computer name

      • GDA4.11.exe (PID: 5072)

    • Checks proxy server information

      • GDA4.11.exe (PID: 5072)

    • VMProtect protector has been detected

      • GDA4.11.exe (PID: 5072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:08 09:14:18+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 1818624
InitializedDataSize: 2433024
UninitializedDataSize: -
EntryPoint: 0xa76ae7
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 4.1.1.0
ProductVersionNumber: 4.1.1.0
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
Comments: -
CompanyName: www.gda.wiki
FileDescription: GDA Interactive Decompiler for Android
FileVersion: 4, 1, 1, 0
InternalName: Android Decompiler
LegalCopyright: Copyright 2015-2085 GJDEN(CHARLES GAN). All rights reserved.
LegalTrademarks: -
OriginalFileName: GDA.EXE
PrivateBuild: GDA VFE4110
ProductName: Gjoy Dex Analysizer
ProductVersion: 4, 1, 1, 0
SpecialBuild: -
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gda4.11.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2316C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5072"C:\Users\admin\AppData\Local\Temp\GDA4.11.exe" C:\Users\admin\AppData\Local\Temp\GDA4.11.exe
explorer.exe
User:
admin
Company:
www.gda.wiki
Integrity Level:
MEDIUM
Description:
GDA Interactive Decompiler for Android
Version:
4, 1, 1, 0
Modules
Images
c:\users\admin\appdata\local\temp\gda4.11.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7148"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
624
Read events
621
Write events
3
Delete events
0

Modification events

(PID) Process:(5072) GDA4.11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5072) GDA4.11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5072) GDA4.11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
5
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\AdbWinUsbApi.dllexecutable
MD5:5F23F2F936BDFAC90BB0A4970AD365CF
SHA256:041C6859BB4FC78D3A903DD901298CD1ECFB75B6BE0646B74954CD722280A407
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\Gdump64binary
MD5:A2AD72975D9E4DFF70860934996E8212
SHA256:A030BE9338287FBEA9B876DB1E51703A251553A64B303A2D5F4DB55B1C81D360
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\Gdumpx86binary
MD5:4318D8704D0C50D60AEF17DD8E82A048
SHA256:E6E94E39052662E1B9C3D40707B7EA9BF850722C902B2443677F3DFB7C217436
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\dx.jarjava
MD5:1E17553F369C57488B091A42842E174F
SHA256:552F1801057C541E3C9DB2298C05CAEE587091041834409E7739850B8C317236
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\Gdump32binary
MD5:139FE23D2EE2849F497E329E2AE9C12D
SHA256:B09F74B17247E8E7D0550AC2B666E81ACE95C77DCF8CF3DA2BA5FC1972819C1D
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\adb.exeexecutable
MD5:C4BE24DF324EE7892EFA1FA1871B9BC0
SHA256:AD5D27384D1B5BCEB6342BB3204FEE977217422BCAFD252AB18F763A3DE43931
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\AdbWinApi.dllexecutable
MD5:47A6EE3F186B2C2F5057028906BAC0C6
SHA256:14A51482AA003DB79A400F4B15C158397FE6D57EE6606B3D633FA431A7BFDF4B
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\config.dattext
MD5:FD095E8BF364CAD08338533872245BB1
SHA256:3F8CFD29BA5F2E96CFF539DEC3F1001255A57DA360B95634DC8B2EEC7EC0DDC7
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\sig\platform.pk8binary
MD5:6D1611FF6C2201B5EDB8C4906B8ADCFA
SHA256:1AD8EF556870EDB70F69A9D3C112544C07DE5162BA440D84D33F8BB0C5962875
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdalib\GdaImport.pytext
MD5:E515E5278DDBE25614004F6424F75975
SHA256:4D848E03A1351D3036A007D7FEF6C8FCE18384DE19DD40955489C8C2AB296186
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.41:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
516
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
516
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.41:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5072
GDA4.11.exe
114.246.99.104:9090
www.gda.wiki
China Unicom Beijing Province Network
CN
unknown
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.41
  • 23.216.77.22
  • 23.216.77.30
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.gda.wiki
  • 114.246.99.104
unknown
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.64
  • 20.190.159.131
  • 40.126.31.71
  • 20.190.159.129
  • 20.190.159.73
  • 40.126.31.2
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GDA4.11.exe