Malware analysis NewActive.exe Malicious activity | ANY.RUN

Add for printing

download:	NewActive.exe
Full analysis:	https://app.any.run/tasks/18e20aa3-3de7-4315-8531-cf96c8d37a33
Verdict:	Malicious activity
Analysis date:	June 07, 2018, 20:19:24
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	088C81181A70CEBE8152FD5DEC3FC0F0
SHA1:	27B3C97D077D7A681C883E34AAD010C45D28E2FF
SHA256:	637864B8060F8C8ACDBEE10AC3AC616BFF23129C6DEB82B116A51C0E8973E0AE
SSDEEP:	49152:wl8eOf6vOOzque2/5q8W41ionBl1ngK8ZGUyFSZrs4NkQKjdn1GF/4WnQ:wZPOOteYM41X2K80UsEsektjJ0/4g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:

Software preset

Internet Explorer 8.0.7601.17514 undefined
7-Zip 16.04 (16.04)
Adobe Acrobat Reader DC MUI (15.007.20033)
Adobe Flash Player 26 ActiveX (26.0.0.137)
CCleaner (5.35)
FileZilla Client 3.31.0 (3.31.0)
Google Chrome (61.0.3163.100)
Google Update Helper (1.3.33.5)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Home and Business 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2005 Redistributable (8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (11.0.61030.0)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (11.0.61030)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (11.0.61030)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.12.25810 (14.12.25810.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.12.25810 (14.12.25810)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.12.25810 (14.12.25810)
Mozilla Firefox 55.0.3 (x86 en-US) (55.0.3)
Mozilla Maintenance Service (55.0.3)
Notepad++ (32-bit x86) (7.5.4)
Opera 12.15 (12.15.1748)
Skype™ 7.39 (7.39.102)
VLC media player (2.2.6)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition
WinMan WinIP Package TopLevel

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - irsetup.exe (PID: 184)
- Registers / Runs the DLL via REGSVR32.EXE
  - irsetup.exe (PID: 184)
- Loads dropped or rewritten executable
  - regsvr32.exe (PID: 3220)
SUSPICIOUS
- Executable content was dropped or overwritten
  - NewActive.exe (PID: 3680)
  - irsetup.exe (PID: 184)
- Removes files from Windows directory
  - irsetup.exe (PID: 184)
- Creates a software uninstall entry
  - irsetup.exe (PID: 184)
- Creates files in the Windows directory
  - irsetup.exe (PID: 184)
- Creates files in the program directory
  - irsetup.exe (PID: 184)
- Starts CMD.EXE for commands execution
  - irsetup.exe (PID: 184)
- Uses REG.EXE to modify Windows registry
  - cmd.exe (PID: 3796)
INFO
- Dropped object may contain URL's
  - irsetup.exe (PID: 184)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.ax	\|	DirectShow filter (37.8)
.ocx	\|	Windows ActiveX control (21.8)
.exe	\|	Win32 EXE PECompact compressed (v2.x) (11)
.exe	\|	Win32 EXE PECompact compressed (generic) (7.8)
.exe	\|	Win32 Executable MS Visual C++ (generic) (5.8)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2004:10:13 17:10:17+02:00
PEType:	PE32
LinkerVersion:	6
CodeSize:	20480
InitializedDataSize:	49152
UninitializedDataSize:	-
EntryPoint:	0x1d9d
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	7.0.1.0
ProductVersionNumber:	7.0.1.0
FileFlagsMask:	0x003f
FileFlags:	Private build
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Windows, Latin1
Comments:	Created with Setup Factory 7.0
CompanyName:	-
FileDescription:	Setup Application
FileVersion:	7.0.1.0
InternalName:	suf70_launch
LegalCopyright:	Setup Engine Copyright © 2004 Indigo Rose Corporation
LegalTrademarks:	Setup Factory is a trademark of Indigo Rose Corporation.
OriginalFileName:	suf70_launch.exe
PrivateBuild:	-
ProductName:	Setup Factory 7.0 Runtime
ProductVersion:	7.0.1.0
SpecialBuild:	-

Summary

Architecture:	IMAGE_FILE_MACHINE_I386
Subsystem:	IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:	13-Oct-2004 15:10:17
Detected languages:	English - United States
Comments:	Created with Setup Factory 7.0
CompanyName:	-
FileDescription:	Setup Application
FileVersion:	7.0.1.0
InternalName:	suf70_launch
LegalCopyright:	Setup Engine Copyright © 2004 Indigo Rose Corporation
LegalTrademarks:	Setup Factory is a trademark of Indigo Rose Corporation.
OriginalFilename:	suf70_launch.exe
PrivateBuild:	-
ProductName:	Setup Factory 7.0 Runtime
ProductVersion:	7.0.1.0
SpecialBuild:	-

DOS Header

Magic number:	MZ
Bytes on last page of file:	0x0090
Pages in file:	0x0003
Relocations:	0x0000
Size of header:	0x0004
Min extra paragraphs:	0x0000
Max extra paragraphs:	0xFFFF
Initial SS value:	0x0000
Initial SP value:	0x00B8
Checksum:	0x0000
Initial IP value:	0x0000
Initial CS value:	0x0000
Overlay number:	0x0000
OEM identifier:	0x0000
OEM information:	0x0000
Address of NE header:	0x000000E8

PE Headers

Signature:	PE
Machine:	IMAGE_FILE_MACHINE_I386
Number of sections:	4
Time date stamp:	13-Oct-2004 15:10:17
Pointer to Symbol Table:	0x00000000
Number of symbols:	0
Size of Optional Header:	0x00E0
Characteristics:	IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_RELOCS_STRIPPED

Sections

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
.text	0x00001000	0x0000489A	0x00005000	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.285
.rdata	0x00006000	0x00000D64	0x00001000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.71217
.data	0x00007000	0x00003300	0x00003000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	1.02244
.rsrc	0x0000B000	0x00006930	0x00007000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.41148

Resources

Title	Entropy	Size	Codepage	Language	Type
1	3.39248	1100	UNKNOWN	English - United States	RT_VERSION
2	4.31421	1384	UNKNOWN	English - United States	RT_ICON
3	5.9477	1128	UNKNOWN	English - United States	RT_ICON
4	3.78233	744	UNKNOWN	English - United States	RT_ICON
5	6.14953	2216	UNKNOWN	English - United States	RT_ICON
6	5.83714	4264	UNKNOWN	English - United States	RT_ICON
7	3.64397	1640	UNKNOWN	English - United States	RT_ICON
8	5.84115	3752	UNKNOWN	English - United States	RT_ICON
9	5.41049	9640	UNKNOWN	English - United States	RT_ICON
101	2.89097	132	UNKNOWN	English - United States	RT_GROUP_ICON

Imports


KERNEL32.dll
USER32.dll

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

184

__IRAOFF:520716 "__IRAFN:C:\Users\admin\AppData\Local\Temp\NewActive.exe"

C:\Users\admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe

NewActive.exe

User:

admin

Integrity Level:

HIGH

Description:

Setup Application

Exit code:

Version:

7.0.1.0

Modules

Images
c:\users\admin\appdata\local\temp\_ir_sf7_temp_0\irsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll

2828

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\JFWeb" /v Path /t REG_SZ /d "C:\Program Files\NetSurveillance\CMS\npWebPlugin.dll" /f

C:\Windows\system32\reg.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Registry Console Tool

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

2872

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\JFGuide" /v Path /t REG_SZ /d "C:\Program Files\NetSurveillance\CMS\npGuide.dll" /f

C:\Windows\system32\reg.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Registry Console Tool

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3032

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\JFWeb" /v Path /t REG_SZ /d "C:\Program Files\NetSurveillance\CMS\npWebPlugin.dll" /f

C:\Windows\system32\reg.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Registry Console Tool

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3220

"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\NetSurveillance\CMS\web.ocx"

C:\Windows\System32\regsvr32.exe

—

irsetup.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Microsoft(C) Register Server

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3680

"C:\Users\admin\AppData\Local\Temp\NewActive.exe"

C:\Users\admin\AppData\Local\Temp\NewActive.exe

explorer.exe

User:

admin

Integrity Level:

HIGH

Description:

Setup Application

Exit code:

Version:

7.0.1.0

Modules

Images
c:\users\admin\appdata\local\temp\newactive.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll

3796

cmd /c ""C:\Program Files\NetSurveillance\CMS\reg.bat" "

C:\Windows\system32\cmd.exe

—

irsetup.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

6.1.7601.17514 (win7sp1_rtm.101119-1850)

Modules

Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll

3896

"C:\Users\admin\AppData\Local\Temp\NewActive.exe"

C:\Users\admin\AppData\Local\Temp\NewActive.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

Setup Application

Exit code:

3221226540

Version:

7.0.1.0

Modules

Images
c:\users\admin\appdata\local\temp\newactive.exe
c:\systemroot\system32\ntdll.dll

4028

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\JFGuide" /v Path /t REG_SZ /d "C:\Program Files\NetSurveillance\CMS\npGuide.dll" /f

C:\Windows\system32\reg.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Registry Console Tool

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

Add for printing

Total events

246

Read events

202

Write events

Delete events

Modification events


(PID) Process:	(184) irsetup.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetSurveillance
Operation:	write	Name:	DisplayName
Value: NetSurveillance
(PID) Process:	(184) irsetup.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetSurveillance
Operation:	write	Name:	NoModify
Value: 1
(PID) Process:	(184) irsetup.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetSurveillance
Operation:	write	Name:	NoRepair
Value: 1
(PID) Process:	(184) irsetup.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetSurveillance
Operation:	write	Name:	UninstallString
Value: "C:\Windows\NetSurveillance\uninstall.exe" "/U:C:\Windows\NetSurveillance\Uninstall\uninstall.xml"
(PID) Process:	(184) irsetup.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetSurveillance
Operation:	write	Name:	Contact
Value: Ö§³Ö²¿ÃÅ
(PID) Process:	(184) irsetup.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetSurveillance
Operation:	write	Name:	DisplayIcon
Value: "C:\Windows\NetSurveillance\uninstall.exe"
(PID) Process:	(184) irsetup.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0
(PID) Process:	(184) irsetup.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 1
(PID) Process:	(2872) reg.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\JFGuide
Operation:	write	Name:	Path
Value: C:\Program Files\NetSurveillance\CMS\npGuide.dll
(PID) Process:	(3032) reg.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\MozillaPlugins\JFWeb
Operation:	write	Name:	Path
Value: C:\Program Files\NetSurveillance\CMS\npWebPlugin.dll

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
184	irsetup.exe	C:\Users\admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.dat		—
		MD5:—	SHA256:—
184	irsetup.exe	C:\Windows\NetSurveillance\Uninstall\uni4506.tmp		—
		MD5:—	SHA256:—
184	irsetup.exe	C:\Windows\NetSurveillance\uninstall.exe		executable
		MD5:75CA7FF96BF5A316C3AF2DE6A412BD54	SHA256:D95B5BF9CA97C1900DE5357743282BAB655D61D616606485088E1708559B7CF1
184	irsetup.exe	C:\Users\admin\AppData\Local\Temp\_ir_sf7_temp_0\IRIMG1.JPG		image
		MD5:977A39DF5F3A185495A661947F960FEE	SHA256:D47D72BB6F9F3667CA83B5F7F25D76CAA305B495C8F265EF467575D6BC5B2A35
184	irsetup.exe	C:\Windows\NetSurveillance\Uninstall\uninstall.dat		binary
		MD5:78643A71C644BB7514837D54F61A1363	SHA256:FF73206F49AAF1B11B1118E31C89C1EC07CE712080DBFB2368611AB646988AA9
184	irsetup.exe	C:\Windows\NetSurveillance\Uninstall\uninstall.xml		text
		MD5:84C48D7985B781D3784A4319FE34F04A	SHA256:FA6A97EDB7C2C20E82220F05EDEE434FA6A96EDAC0C7347454B7A6004C38A26E
184	irsetup.exe	C:\Program Files\NetSurveillance\CMS\dlg_right.bmp		image
		MD5:43D2127525BDF1D889FB3446AB89C08C	SHA256:BFE6B2D6E7A25E8CA44A09476CCDFAC4AA87EC77D88CC39CE0FC2B389AA601C2
184	irsetup.exe	C:\Users\admin\AppData\Local\Temp\_ir_sf7_temp_0\IRIMG2.JPG		image
		MD5:8D774F6D54492A39B8C10832BDFE44FA	SHA256:F68D37B790E727228A0846996024F7624CDDD463730CD087123A4BD9B3ED4389
184	irsetup.exe	C:\Program Files\NetSurveillance\CMS\x1_01.JPG		image
		MD5:8018A66FC8DC31AA3810A02E19C70A85	SHA256:46820C881FA87F88B0441DE5AAE98D0625E081431FD2A7FE89A59B94235F1455
184	irsetup.exe	C:\Program Files\NetSurveillance\CMS\mp_thumb.JPG		image
		MD5:019B6EF1743DD24A6D9A970979B65255	SHA256:5079C33ACED132997F65C49BB70ADCA663C565B2A6653E29705720D1AD265192

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

No HTTP requests

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected

Add for printing

No debug info

General Info

NewActive.exe

088C81181A70CEBE8152FD5DEC3FC0F0

27B3C97D077D7A681C883E34AAD010C45D28E2FF

637864B8060F8C8ACDBEE10AC3AC616BFF23129C6DEB82B116A51C0E8973E0AE

49152:wl8eOf6vOOzque2/5q8W41ionBl1ngK8ZGUyFSZrs4NkQKjdn1GF/4WnQ:wZPOOteYM41X2K80UsEsektjJ0/4g

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Registers / Runs the DLL via REGSVR32.EXE

Loads dropped or rewritten executable

SUSPICIOUS

Executable content was dropped or overwritten

Removes files from Windows directory

Creates a software uninstall entry

Creates files in the Windows directory

Creates files in the program directory

Starts CMD.EXE for commands execution

Uses REG.EXE to modify Windows registry

INFO

Dropped object may contain URL's

Malware configuration

Static information

TRiD

EXIF

EXE

Summary

DOS Header

PE Headers

Sections

Resources

Imports

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings