File name:

GDA4.11.exe

Full analysis: https://app.any.run/tasks/aaa8d138-ef1d-47a5-8173-3ba2bf482394
Verdict: Malicious activity
Analysis date: May 17, 2025, 08:28:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
vmprotect
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

61955E5DC20738A3AF9E6A3D19F3C24D

SHA1:

1C9285861A978213EDA408488F3228AFDFA32659

SHA256:

59E320FDB6A2FFC971934450541E0BD1DF4C0442BCA5C7549559109BF7553DD4

SSDEEP:

98304:38dEjwM8xCMqlovj0jUjo7eSsNu3x4+P17bRn1xu/9I/dQNRjpZhnDjVfileW6UG:rCRijgqQTadpSHcY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • GDA4.11.exe (PID: 5072)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • GDA4.11.exe (PID: 5072)

    • Reads security settings of Internet Explorer

      • GDA4.11.exe (PID: 5072)

    • Connects to unusual port

      • GDA4.11.exe (PID: 5072)

    • Found regular expressions for crypto-addresses (YARA)

      • GDA4.11.exe (PID: 5072)

  • INFO

    • The sample compiled with chinese language support

      • GDA4.11.exe (PID: 5072)

    • Creates files or folders in the user directory

      • GDA4.11.exe (PID: 5072)

    • Reads the computer name

      • GDA4.11.exe (PID: 5072)

    • The sample compiled with english language support

      • GDA4.11.exe (PID: 5072)

    • Checks supported languages

      • GDA4.11.exe (PID: 5072)

    • Checks proxy server information

      • GDA4.11.exe (PID: 5072)

    • VMProtect protector has been detected

      • GDA4.11.exe (PID: 5072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:08 09:14:18+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 1818624
InitializedDataSize: 2433024
UninitializedDataSize: -
EntryPoint: 0xa76ae7
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 4.1.1.0
ProductVersionNumber: 4.1.1.0
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
Comments: -
CompanyName: www.gda.wiki
FileDescription: GDA Interactive Decompiler for Android
FileVersion: 4, 1, 1, 0
InternalName: Android Decompiler
LegalCopyright: Copyright 2015-2085 GJDEN(CHARLES GAN). All rights reserved.
LegalTrademarks: -
OriginalFileName: GDA.EXE
PrivateBuild: GDA VFE4110
ProductName: Gjoy Dex Analysizer
ProductVersion: 4, 1, 1, 0
SpecialBuild: -
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gda4.11.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2316C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5072"C:\Users\admin\AppData\Local\Temp\GDA4.11.exe" C:\Users\admin\AppData\Local\Temp\GDA4.11.exe
explorer.exe
User:
admin
Company:
www.gda.wiki
Integrity Level:
MEDIUM
Description:
GDA Interactive Decompiler for Android
Version:
4, 1, 1, 0
Modules
Images
c:\users\admin\appdata\local\temp\gda4.11.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7148"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
624
Read events
621
Write events
3
Delete events
0

Modification events

(PID) Process:(5072) GDA4.11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5072) GDA4.11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5072) GDA4.11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
5
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\AdbWinApi.dllexecutable
MD5:47A6EE3F186B2C2F5057028906BAC0C6
SHA256:14A51482AA003DB79A400F4B15C158397FE6D57EE6606B3D633FA431A7BFDF4B
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\adb.exeexecutable
MD5:C4BE24DF324EE7892EFA1FA1871B9BC0
SHA256:AD5D27384D1B5BCEB6342BB3204FEE977217422BCAFD252AB18F763A3DE43931
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\config.dattext
MD5:FD095E8BF364CAD08338533872245BB1
SHA256:3F8CFD29BA5F2E96CFF539DEC3F1001255A57DA360B95634DC8B2EEC7EC0DDC7
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\sig\platform.x509.pemtext
MD5:23E9A8B69D126350BA96A04FE1946CEE
SHA256:9837DE028F460C35CC8D3FA45F14EECCE30F6FBFE4B93D399AEF1ACB80C20D14
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\sig\platform.pk8binary
MD5:6D1611FF6C2201B5EDB8C4906B8ADCFA
SHA256:1AD8EF556870EDB70F69A9D3C112544C07DE5162BA440D84D33F8BB0C5962875
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\sig\testkey.x509.pemtext
MD5:4033DAFC873DC7271E205B83CC9B4B17
SHA256:A4384BA815B9499A5CE349B4E33C1755278873FE2EAC150A068823F526E6DBDE
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\sig\testkey.pk8binary
MD5:1823E4BCADB53E275A8FF8E1B261B7AD
SHA256:495675D32E89A149D5ABE191F4E9C0E218B9068714E9B53A7C91E164A0741A23
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\AdbWinUsbApi.dllexecutable
MD5:5F23F2F936BDFAC90BB0A4970AD365CF
SHA256:041C6859BB4FC78D3A903DD901298CD1ECFB75B6BE0646B74954CD722280A407
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdalib\GdaImport.pytext
MD5:E515E5278DDBE25614004F6424F75975
SHA256:4D848E03A1351D3036A007D7FEF6C8FCE18384DE19DD40955489C8C2AB296186
5072GDA4.11.exeC:\Users\admin\AppData\Roaming\GDA\gdatmp\Gdumpx86binary
MD5:4318D8704D0C50D60AEF17DD8E82A048
SHA256:E6E94E39052662E1B9C3D40707B7EA9BF850722C902B2443677F3DFB7C217436
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.41:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
516
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
516
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.41:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5072
GDA4.11.exe
114.246.99.104:9090
www.gda.wiki
China Unicom Beijing Province Network
CN
unknown
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.41
  • 23.216.77.22
  • 23.216.77.30
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.gda.wiki
  • 114.246.99.104
unknown
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.64
  • 20.190.159.131
  • 40.126.31.71
  • 20.190.159.129
  • 20.190.159.73
  • 40.126.31.2
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GDA4.11.exe