analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PAYMENT ADVICEDF.exe

Full analysis: https://app.any.run/tasks/cfb3c230-ff79-4628-b9f0-2d96bcc7e36e
Verdict: Malicious activity
Analysis date: April 01, 2023, 01:20:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

F8C61898C1AB389DF90D8AF4C8CC089E

SHA1:

6C4090A1186F70820D2310EA97732E14413A41ED

SHA256:

653519CB7879BA9389474AB6FB92AE69475EA3166167E3B9B1E4405E14506F5D

SSDEEP:

12288:lswFjJnKlIZ0G0+IaH8aFwF4I3olFcC+/z:ls6jklIZ0ack0gFcb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • PAYMENT ADVICEDF.exe (PID: 892)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • PAYMENT ADVICEDF.exe (PID: 892)

    • The process creates files with name similar to system file names

      • PAYMENT ADVICEDF.exe (PID: 892)

  • INFO

    • Reads the computer name

      • PAYMENT ADVICEDF.exe (PID: 892)

    • The process checks LSA protection

      • PAYMENT ADVICEDF.exe (PID: 892)

    • Checks supported languages

      • PAYMENT ADVICEDF.exe (PID: 892)

    • Creates files or folders in the user directory

      • PAYMENT ADVICEDF.exe (PID: 892)

    • Create files in a temporary directory

      • PAYMENT ADVICEDF.exe (PID: 892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x33d7
UninitializedDataSize: 2048
InitializedDataSize: 3805696
CodeSize: 26112
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2019:12:16 00:50:33+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Dec-2019 00:50:33
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 16-Dec-2019 00:50:33
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006475
0x00006600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45006
.rdata
0x00008000
0x00001384
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.13881
.data
0x0000A000
0x0039EB58
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.91053
.ndata
0x003A9000
0x00026000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x003CF000
0x00034170
0x00034200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.29979

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29665
1059
UNKNOWN
English - United States
RT_MANIFEST
103
2.01924
20
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
107
2.62276
196
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
27
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start payment advicedf.exe

Process information

PID
CMD
Path
Indicators
Parent process
892"C:\Users\admin\AppData\Local\Temp\PAYMENT ADVICEDF.exe" C:\Users\admin\AppData\Local\Temp\PAYMENT ADVICEDF.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\payment advicedf.exe
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
Total events
1 386
Read events
1 378
Write events
8
Delete events
0

Modification events

(PID) Process:(892) PAYMENT ADVICEDF.exeKey:HKEY_CURRENT_USER\Software\konkurragr
Operation:writeName:Syditalien
Value:
FF8BE019
Executable files
6
Suspicious files
4
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
892PAYMENT ADVICEDF.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Electrodialyzer\Unscrupulousnesses\Motocycle\Genfremsttelses.Hentext
MD5:7780C8E7D03FE58C79A0B40D700E2670
SHA256:494B49E4FF8E96BCFDD63B040C8137F05268667885451FFFA72A6804B7F3D660
892PAYMENT ADVICEDF.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Electrodialyzer\Unscrupulousnesses\Berrugate\pseudocollegiate\Artigst110\mscorrc.dllexecutable
MD5:9EC802DCD5505069BDE135E15FBA4DD2
SHA256:6AFFABE14829AF384687E04E73602BC5CEF846AC9A5E4D37C30DEAEEC7087316
892PAYMENT ADVICEDF.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Electrodialyzer\Unscrupulousnesses\Berrugate\pseudocollegiate\Artigst110\tk.txttext
MD5:75C23D0431BC83CA17308F08D1173C1D
SHA256:75EFF9DE596459F3EBA755B5C4C8CE635AF2CECDBAE40749DF348C97A2E56EE0
892PAYMENT ADVICEDF.exeC:\Users\admin\AppData\Local\Temp\nstDFC8.tmp\System.dllexecutable
MD5:8CF2AC271D7679B1D68EEFC1AE0C5618
SHA256:6950991102462D84FDC0E3B0AE30C95AF8C192F77CE3D78E8D54E6B22F7C09BA
892PAYMENT ADVICEDF.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Electrodialyzer\Unscrupulousnesses\chat-message-new-symbolic.svgxml
MD5:7247F6A7677C2B213B5965B71167D96F
SHA256:FF7C0570F92D23862AE2D9A49A06268EC7E8758519CDB58F8EE164165BF02D32
892PAYMENT ADVICEDF.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Electrodialyzer\Unscrupulousnesses\Motocycle\createdump.exeexecutable
MD5:2C3C756AF3C3E0BA88096647E5D60B56
SHA256:698D32DB7EC0CBB2FBC67559FF1DC4A01BEC3674D5A1CE8B228D041714EE8891
892PAYMENT ADVICEDF.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Electrodialyzer\Unscrupulousnesses\Sammenkdninger.Libbinary
MD5:7D584CBDF2B4CBE68D679E25C3AF2C12
SHA256:294E83E6B0871925B26965EF15485B22C064F59302FA2B4A4495AF2A697FCD95
892PAYMENT ADVICEDF.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Electrodialyzer\Unscrupulousnesses\Berrugate\pseudocollegiate\Artigst110\iso_3166-1.jsonbinary
MD5:062FC6431BF0FF5F8E7E62587FCBD686
SHA256:78FB090F4A54C8B5970EC04C7511F17EB767275A8D5358604A1E335440678617
892PAYMENT ADVICEDF.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Electrodialyzer\Unscrupulousnesses\Motocycle\document-new-symbolic.symbolic.pngimage
MD5:3375017B6C67F7BFA7D588A3BD7D71B4
SHA256:156C0300216C2ECBCFDED92B7C69F4E7C4A8FAFB68C6B31D0079B41F57AA8ADB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PAYMENT ADVICEDF.exe