File name:

Bulk Whatsapp Sender 5.6.exe

Full analysis: https://app.any.run/tasks/40473516-645c-441e-b1a3-933e7703c6e2
Verdict: Malicious activity
Analysis date: March 19, 2024, 21:26:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
MD5:

F756FAC7049AFF1B33F9748285CD05BE

SHA1:

35FDE4CC4C1F334F445731B2D41C710F9AB109C1

SHA256:

6628A13D7B4B6567675CBE49AC3F6BE3F3412FF4697C0252BE2C23DD433A013F

SSDEEP:

98304:tKaUvaz7CuZUSaz7CuZUBrrSjKzlLt5wJ5cAhk8xawmicl+Pknd+RajTOdzv/bxD:VZ9rzTNtg5btWb3xPLfa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Bulk Whatsapp Sender 5.6.exe (PID: 2208)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Bulk Whatsapp Sender 5.6.exe (PID: 2208)

    • Creates a software uninstall entry

      • Bulk Whatsapp Sender 5.6.exe (PID: 2208)

    • Reads the Internet Settings

      • BulkWhatsappSender.exe (PID: 3516)

    • Process drops legitimate windows executable

      • Bulk Whatsapp Sender 5.6.exe (PID: 2208)

    • The process creates files with name similar to system file names

      • Bulk Whatsapp Sender 5.6.exe (PID: 2208)

    • Reads security settings of Internet Explorer

      • BulkWhatsappSender.exe (PID: 3516)

  • INFO

    • Checks supported languages

      • Bulk Whatsapp Sender 5.6.exe (PID: 2208)
      • chromedriver.exe (PID: 2148)
      • BulkWhatsappSender.exe (PID: 3516)

    • Reads the computer name

      • Bulk Whatsapp Sender 5.6.exe (PID: 2208)
      • chromedriver.exe (PID: 2148)
      • BulkWhatsappSender.exe (PID: 3516)

    • Create files in a temporary directory

      • Bulk Whatsapp Sender 5.6.exe (PID: 2208)
      • chromedriver.exe (PID: 2148)

    • Creates files in the program directory

      • Bulk Whatsapp Sender 5.6.exe (PID: 2208)

    • Reads Environment values

      • BulkWhatsappSender.exe (PID: 3516)

    • Application launched itself

      • chrome.exe (PID: 2904)

    • Reads the machine GUID from the registry

      • BulkWhatsappSender.exe (PID: 3516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:09:03 22:28:04+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 2.5
CodeSize: 201728
InitializedDataSize: 259072
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
11
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bulk whatsapp sender 5.6.exe bulkwhatsappsender.exe chromedriver.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs bulk whatsapp sender 5.6.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
568"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --lang=en-US --first-renderer-process --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1700 --field-trial-handle=940,i,17592474658309545639,3548589553312149210,131072 --disable-features=PaintHolding /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
880"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-logging --ignore-certificate-errors --log-level=0 --use-angle=swiftshader-webgl --use-gl=angle --ignore-certificate-errors --headless --enable-logging --log-level=0 --mojo-platform-channel-handle=1236 --field-trial-handle=940,i,17592474658309545639,3548589553312149210,131072 --disable-features=PaintHolding /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1236"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\Temp\scoped_dir2148_26581 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\Temp\scoped_dir2148_26581\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xd0,0xd4,0xd8,0xa4,0xdc,0x69678b38,0x69678b48,0x69678b54C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1692"C:\Users\admin\Desktop\Bulk Whatsapp Sender 5.6.exe" C:\Users\admin\Desktop\Bulk Whatsapp Sender 5.6.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\bulk whatsapp sender 5.6.exe
c:\windows\system32\ntdll.dll
2148"C:\Program Files\Bulk Whatsapp\Bulk Whatsapp Sender\chromedriver.exe" --port=49207C:\Program Files\Bulk Whatsapp\Bulk Whatsapp Sender\chromedriver.exe—BulkWhatsappSender.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\bulk whatsapp\bulk whatsapp sender\chromedriver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2208"C:\Users\admin\Desktop\Bulk Whatsapp Sender 5.6.exe" C:\Users\admin\Desktop\Bulk Whatsapp Sender 5.6.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\bulk whatsapp sender 5.6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
2888"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --enable-logging --headless --log-level=0 --use-angle=swiftshader-webgl --headless --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --enable-logging --log-level=0 --mojo-platform-channel-handle=896 --field-trial-handle=940,i,17592474658309545639,3548589553312149210,131072 --disable-features=PaintHolding /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2904"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --disable-web-resources --enable-automation --enable-logging --force-fieldtrials=SiteIsolationExtensions/Control --headless --ignore-certificate-errors --load-extension="C:\Users\admin\AppData\Local\Temp\scoped_dir2148_21952\internal" --log-level=0 --metrics-recording-only --no-first-run --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir2148_26581" data:,C:\Program Files\Google\Chrome\Application\chrome.exe
chromedriver.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3132"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --lang=en-US --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=904 --field-trial-handle=940,i,17592474658309545639,3548589553312149210,131072 --disable-features=PaintHolding /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3516"C:\Program Files\Bulk Whatsapp\Bulk Whatsapp Sender\BulkWhatsappSender.exe"C:\Program Files\Bulk Whatsapp\Bulk Whatsapp Sender\BulkWhatsappSender.exe
Bulk Whatsapp Sender 5.6.exe
User:
admin
Company:
MediaPlus.me
Integrity Level:
HIGH
Description:
BulkWhatsappSender
Exit code:
0
Version:
5.6.0.1
Modules
Images
c:\program files\bulk whatsapp\bulk whatsapp sender\bulkwhatsappsender.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
4 070
Read events
4 037
Write events
33
Delete events
0

Modification events

(PID) Process:(2208) Bulk Whatsapp Sender 5.6.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Whatsapp Sender
Operation:writeName:DisplayName
Value:
Bulk Whatsapp Sender
(PID) Process:(2208) Bulk Whatsapp Sender 5.6.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Whatsapp Sender
Operation:writeName:DisplayVersion
Value:
5.6
(PID) Process:(2208) Bulk Whatsapp Sender 5.6.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Whatsapp Sender
Operation:writeName:HelpLink
Value:
(PID) Process:(2208) Bulk Whatsapp Sender 5.6.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Whatsapp Sender
Operation:writeName:Publisher
Value:
Bulk Whatsapp
(PID) Process:(2208) Bulk Whatsapp Sender 5.6.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Whatsapp Sender
Operation:writeName:UninstallString
Value:
C:\Program Files\Bulk Whatsapp\Bulk Whatsapp Sender\Uninstall.exe
(PID) Process:(2208) Bulk Whatsapp Sender 5.6.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bulk Whatsapp Sender
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Bulk Whatsapp\Bulk Whatsapp Sender\Uninstall.exe
(PID) Process:(3516) BulkWhatsappSender.exeKey:HKEY_CURRENT_USER\Software\VB and VBA Program Settings\wapi\api
Operation:writeName:port
Value:
1
(PID) Process:(3516) BulkWhatsappSender.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3516) BulkWhatsappSender.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3516) BulkWhatsappSender.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
8
Suspicious files
25
Text files
23
Unknown types
9

Dropped files

PID
Process
Filename
Type
2208Bulk Whatsapp Sender 5.6.exeC:\Users\admin\AppData\Local\Temp\IF{48256522-66D1-4197-8D11-28FBCF0BF061}\Setup.cabcompressed
MD5:4BBD243A590AA0478868EE5ECB93CFB1
SHA256:3A6AC7C9925880F1A9B640C56F4B5C388866C4E4D37657657A48DFF2FE3B5230
2208Bulk Whatsapp Sender 5.6.exeC:\Users\admin\AppData\Local\Temp\IF{48256522-66D1-4197-8D11-28FBCF0BF061}\Desktop.dattext
MD5:150BBD0BB22CF618ED3F980D576B4E83
SHA256:FF75C57EFFA5AE7944FEDE56FDD46014B041966635BAAAEB3D64F314907D6D08
2208Bulk Whatsapp Sender 5.6.exeC:\Users\admin\AppData\Local\Temp\IF{48256522-66D1-4197-8D11-28FBCF0BF061}\OS.dattext
MD5:34C275EE1F7992EA61B44D72C8ED6DB5
SHA256:8819195120405611C3FCFF1FB1DB3AB0BA10370A5CAD6DA249158327B1A457D3
2208Bulk Whatsapp Sender 5.6.exeC:\Users\admin\AppData\Local\Temp\IF{48256522-66D1-4197-8D11-28FBCF0BF061}\default.ifltext
MD5:DC51022CF78C9B519F2058983A773119
SHA256:93E28A5125B4864773F53D1C5F87C1756EFA0C2D60D5C3FD6B34AA920080F568
2208Bulk Whatsapp Sender 5.6.exeC:\Users\admin\AppData\Local\Temp\IF{48256522-66D1-4197-8D11-28FBCF0BF061}\Image_Top.jpgbinary
MD5:4AE65BA99FB788D962860EC9ED14F2A7
SHA256:6D118DC765ED52458079F8F588B7E144B02AA8E564F06726AADE9CA7D77EF0A3
2208Bulk Whatsapp Sender 5.6.exeC:\Program Files\Bulk Whatsapp\Bulk Whatsapp Sender\uninstall_l.ifltext
MD5:DC51022CF78C9B519F2058983A773119
SHA256:93E28A5125B4864773F53D1C5F87C1756EFA0C2D60D5C3FD6B34AA920080F568
2208Bulk Whatsapp Sender 5.6.exeC:\Users\admin\AppData\Local\Temp\IF{48256522-66D1-4197-8D11-28FBCF0BF061}\licence.rtftext
MD5:969D154352C0FAFB84B27B8CAF22D504
SHA256:CFEEE7E71A82187371519F9A0C232FACF5E82889C2E4AE7BB57532E09A5C30C0
2208Bulk Whatsapp Sender 5.6.exeC:\Users\admin\AppData\Local\Temp\IF{48256522-66D1-4197-8D11-28FBCF0BF061}\Image_Left.jpgbinary
MD5:D4C6925A72BB9F71A5A9BC8FE2022F9B
SHA256:C5D0EA0D4E4CCA82C72045AE40D0FFB68C6E9DE6304C3DFAA17D99FAB03E47E5
2208Bulk Whatsapp Sender 5.6.exeC:\Program Files\Bulk Whatsapp\Bulk Whatsapp Sender\Uninstall.exeexecutable
MD5:7AE89C6074B7CF3D03081EA6616D873B
SHA256:AE326F86AA8BBB88831B0339C820859467EF910DADED5B430DC88DA97D203772
2208Bulk Whatsapp Sender 5.6.exeC:\Users\admin\AppData\Local\Temp\IF{48256522-66D1-4197-8D11-28FBCF0BF061}\icon.datimage
MD5:FA63A0160B9FF05DC70CFBCA82B465B6
SHA256:D3A14188ECCD7761CD20CE86237F481A4BCDDFFCD460871BD7B4504F6162D9DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
9
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
880
chrome.exe
GET
—
72.18.134.37:80
http://shop.mediaplus.me/
unknown
—
—
unknown
3516
BulkWhatsappSender.exe
GET
200
173.248.130.117:80
http://www.mediaplus.me/bws/ver/getdateex2.ashx
unknown
text
24 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
880
chrome.exe
72.18.134.37:80
shop.mediaplus.me
WEHOSTWEBSITES-COM
US
unknown
3516
BulkWhatsappSender.exe
173.248.130.117:80
www.mediaplus.me
WEHOSTWEBSITES-COM
US
unknown

DNS requests

Domain
IP
Reputation
shop.mediaplus.me
  • 72.18.134.37
unknown
dns.msftncsi.com
  • 131.107.255.255
shared
www.mediaplus.me
  • 173.248.130.117
unknown

Threats

No threats detected
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\scoped_dir2148_26581 directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bulk Whatsapp Sender 5.6.exe