File name: | keygen.exe |
Full analysis: | https://app.any.run/tasks/102299cc-e521-488d-a3d6-3474e12285af |
Verdict: | Malicious activity |
Analysis date: | March 22, 2019, 09:10:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 1BA498E748852D62C7CB78015854A924 |
SHA1: | 9AB31DBC1F661FBB13734E684F078A9764EFF0DD |
SHA256: | 5EB8F764E88B9F5AF32A25F57469BE464A0B139305D4359295002015DCB5EE31 |
SSDEEP: | 24576:W1z+GH98GcSIPVICWYRm2ufCyZtqNcGqRoyDEJ:xGHmGNItImRm2gqSG5yAJ |
.exe | | | UPX compressed Win32 Executable (35) |
---|---|---|
.exe | | | Win32 EXE Yoda's Crypter (34.3) |
.scr | | | Windows screen saver (16.9) |
.exe | | | Win32 Executable (generic) (5.8) |
.exe | | | Win16/32 Executable Delphi generic (2.6) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2016:12:29 14:34:07+01:00 |
PEType: | PE32 |
LinkerVersion: | 2.25 |
CodeSize: | 130048 |
InitializedDataSize: | 306688 |
UninitializedDataSize: | - |
EntryPoint: | 0x76684 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 29-Dec-2016 13:34:07 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 10 |
Time date stamp: | 29-Dec-2016 13:34:07 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0001F74C | 0x0001F800 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.51675 |
.itext | 0x00021000 | 0x00000340 | 0x00000400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.5025 |
.data | 0x00022000 | 0x0002AC54 | 0x0002AE00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.75838 |
.bss | 0x0004D000 | 0x00004C58 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x00052000 | 0x0000141A | 0x00001600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.79221 |
.tls | 0x00054000 | 0x0000000C | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x00055000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.210826 |
.reloc | 0x00056000 | 0x000022A0 | 0x00002400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.58612 |
.rsrc | 0x00059000 | 0x0001C400 | 0x0001C400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.26837 |
.DLL | 0x00076000 | 0x00088000 | 0x00087600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.86137 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 1.90513 | 4264 | UNKNOWN | UNKNOWN | RT_ICON |
2 | 3.08485 | 1128 | UNKNOWN | UNKNOWN | RT_ICON |
3 | 2.07909 | 4264 | UNKNOWN | UNKNOWN | RT_ICON |
101 | 3.3085 | 740 | UNKNOWN | English - United States | RT_DIALOG |
130 | 6.6994 | 227 | UNKNOWN | UNKNOWN | RT_RCDATA |
131 | 6.75283 | 222 | UNKNOWN | UNKNOWN | RT_RCDATA |
132 | 6.60631 | 220 | UNKNOWN | UNKNOWN | RT_RCDATA |
140 | 6.29902 | 182 | UNKNOWN | UNKNOWN | RT_RCDATA |
141 | 6.41457 | 180 | UNKNOWN | UNKNOWN | RT_RCDATA |
142 | 6.27976 | 181 | UNKNOWN | UNKNOWN | RT_RCDATA |
ADVAPI32.DLL |
GDI32.DLL |
KERNEL32.DLL |
MSIMG32.DLL |
OLEAUT32.DLL |
USER32.DLL |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1048 | "C:\Users\admin\Desktop\keygen.exe" | C:\Users\admin\Desktop\keygen.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Exit code: 3489660927 | ||||
2852 | C:\Windows\system32\WerFault.exe -u -p 1048 -s 544 | C:\Windows\system32\WerFault.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1892 | "C:\Users\admin\Desktop\keygen.exe" | C:\Users\admin\Desktop\keygen.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
1048 | keygen.exe | C:\Users\admin\AppData\Local\Temp\Test.dat | — | |
MD5:— | SHA256:— | |||
1892 | keygen.exe | C:\Users\admin\AppData\Local\Temp\Test.dat | — | |
MD5:— | SHA256:— | |||
2852 | WerFault.exe | C:\Users\admin\AppData\Local\Temp\WERD846.tmp.WERInternalMetadata.xml | xml | |
MD5:539DC1D7CD03D5BCB7A818E0D82895D0 | SHA256:0A4C58332EE91B8DB232B8EABAB13C35C06E641A34841207D2E6B63E707DC7D1 | |||
2852 | WerFault.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_keygen.exe_e1f9ae1ba398435bf37f86d375c1ae853991b1_0b2bddd4\Report.wer | binary | |
MD5:EC3D929FD08F1AECD1087450FE6B2461 | SHA256:2F127903BEA43CA752D053E11A39C2DA3A8B95AAD3B7CB1CDB28C1B216500C19 | |||
2852 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\keygen.exe.1048.dmp | dmp | |
MD5:A81EE59A154BC9A372F8475EE0CA0380 | SHA256:03FF5A91D13EBC2A936BF6DFB0442FC91EFD70116911D9D8E1AFE9CBBC3DF5C5 | |||
1048 | keygen.exe | C:\Users\admin\AppData\Local\Temp\laRpfGRHnlIIgdYiPTVB.DLL | executable | |
MD5:E6144FB36C1FDC6BA1D1AFA9632588F8 | SHA256:B141412D0611571DF381C26186B3FC438C725D6E45AD66FD76413322C17A9AC6 | |||
1892 | keygen.exe | C:\Users\admin\AppData\Local\Temp\aHkMsEjRGYuOGkswNCrS.DLL | executable | |
MD5:76A9565C5F51775719EEBDA1F25530A5 | SHA256:A1A7C4F74D4FE7784ED03709E5F946B94CC10A64E3AE0AD5A9A3BECE9A8A2C0A | |||
1892 | keygen.exe | C:\Users\admin\AppData\Local\Temp\PijtJXmTOfinwCawiyGr.DLL | executable | |
MD5:E6144FB36C1FDC6BA1D1AFA9632588F8 | SHA256:B141412D0611571DF381C26186B3FC438C725D6E45AD66FD76413322C17A9AC6 | |||
1048 | keygen.exe | C:\Users\admin\AppData\Local\Temp\FbcKWEyFexihaaKoBTpl.DLL | executable | |
MD5:76A9565C5F51775719EEBDA1F25530A5 | SHA256:A1A7C4F74D4FE7784ED03709E5F946B94CC10A64E3AE0AD5A9A3BECE9A8A2C0A | |||
1892 | keygen.exe | C:\Users\admin\AppData\Local\Temp\adACEWQBrU.DLL | executable | |
MD5:E4EC57E8508C5C4040383EBE6D367928 | SHA256:8AD9E47693E292F381DA42DDC13724A3063040E51C26F4CA8E1F8E2F1DDD547F |