File name: | http://ciscobinary.openh264.org/openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip |
Full analysis: | https://app.any.run/tasks/82854a39-31f3-45ef-9612-6cd05e3886e8 |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 17:03:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 29DDFD36F79EAAE39627110A00FF8370 |
SHA1: | F5A0D4EB07B0E6813E64F07C99478B823EEDB82D |
SHA256: | 600552DE4DE554364152ED426D02264E97D76AE1F33AFB1D845A0D25E5E5BA33 |
SSDEEP: | 12288:E9FVnFrhwA7XATekr8IlK1uR/JRtPX/pPPWAyXKh10e+m:EJhv7XAT3r8IlK1uRvdRPPWAZWNm |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | gmpopenh264.dll |
---|---|
ZipUncompressedSize: | 1234896 |
ZipCompressedSize: | 490928 |
ZipCRC: | 0x5f0b62ea |
ZipModifyDate: | 2019:03:02 16:58:07 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2848 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
3620 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) | ||||
1000 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\gmpopenh264.info | C:\Windows\system32\rundll32.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
316 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\gmpopenh264.info | C:\Windows\system32\NOTEPAD.EXE | — | rundll32.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1080 | C:\Windows\Explorer.EXE | C:\Windows\Explorer.EXE | — | — |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1080 | Explorer.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\918e0ecb43d17e23.automaticDestinations-ms | automaticdestinations-ms | |
MD5:1C0D5CB1B35C00D8F9396CBEDB511435 | SHA256:8F9981D85977C085F75451238972D3C41E2485013BE120D7F27D83E758E91967 | |||
1080 | Explorer.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms | automaticdestinations-ms | |
MD5:FFB95A19AB5C44CE29202DE228BC2A8B | SHA256:88404E75582C6683F79A8ED55052EED353627EACD2CB754AC2716B4A2F0E3F60 | |||
1080 | Explorer.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\gmpopenh264.info.lnk | lnk | |
MD5:35C12176C191A41B796D28F5E85936F9 | SHA256:24574EC696CFE7A212B0EAAE169AECB9061ACB2618C369D18A08EB65EB1BD49F | |||
1080 | Explorer.EXE | C:\Users\admin\Desktop\gmpopenh264.info | text | |
MD5:3D33CDC0B3D281E67DD52E14435DD04F | SHA256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B | |||
2848 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2848.37878\gmpopenh264.dll | executable | |
MD5:D23F706F2EACC190F2D4B75B041670D5 | SHA256:CED08CE5BC45DBE505FA94B3A4268C0830CCDA016A23C0ACB16DD7268CFA7A65 | |||
1080 | Explorer.EXE | C:\Users\admin\Desktop\gmpopenh264.dll | executable | |
MD5:D23F706F2EACC190F2D4B75B041670D5 | SHA256:CED08CE5BC45DBE505FA94B3A4268C0830CCDA016A23C0ACB16DD7268CFA7A65 | |||
2848 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2848.38598\gmpopenh264.info | text | |
MD5:3D33CDC0B3D281E67DD52E14435DD04F | SHA256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B | |||
2848 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2848.38417\gmpopenh264.dll | executable | |
MD5:D23F706F2EACC190F2D4B75B041670D5 | SHA256:CED08CE5BC45DBE505FA94B3A4268C0830CCDA016A23C0ACB16DD7268CFA7A65 |