download: | download |
Full analysis: | https://app.any.run/tasks/4e1526c6-975a-4a30-87d9-3518f4a68c54 |
Verdict: | Malicious activity |
Analysis date: | June 15, 2018, 20:30:14 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | E82261F069369C6747514D3846F1F52F |
SHA1: | 05F6884AA37F10C0210C812E66510E89F61FE1E1 |
SHA256: | 664C14F7A2312137EE8524A4DEEE8448B6290A85C10957938C6648CFE980623B |
SSDEEP: | 24576:e5b2/IyLyoLb1lc8s4FeimMKkpLxjozQGm9Mq8J2HdC8jvcLiahC:HIloLb1lc8s4FeimM/8zQqqQ6dvbcLFM |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
ProductVersion: | 19.0.0.1 |
---|---|
ProductName: | WordPerfectOffice |
LegalCopyright: | Copyright (C) 2018 Corel Corporation. All rights reserved. |
InternalName: | WPO_X9.exe |
FileVersion: | 19.0.0.1 |
FileDescription: | WordPerfectOffice |
CompanyName: | Corel Corporation |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 19.0.7.1 |
FileVersionNumber: | 19.0.7.1 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x4ab13 |
UninitializedDataSize: | - |
InitializedDataSize: | 206336 |
CodeSize: | 486400 |
LinkerVersion: | 14 |
PEType: | PE32 |
TimeStamp: | 2018:05:11 16:50:24+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 11-May-2018 14:50:24 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | Corel Corporation |
FileDescription: | WordPerfectOffice |
FileVersion: | 19.0.0.1 |
InternalName: | WPO_X9.exe |
LegalCopyright: | Copyright (C) 2018 Corel Corporation. All rights reserved. |
ProductName: | WordPerfectOffice |
ProductVersion: | 19.0.0.1 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000108 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 7 |
Time date stamp: | 11-May-2018 14:50:24 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00076BDC | 0x00076C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.62655 |
.rdata | 0x00078000 | 0x0001F1BE | 0x0001F200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.02045 |
.data | 0x00098000 | 0x00003B0C | 0x00002E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.66141 |
.gfids | 0x0009C000 | 0x000007CC | 0x00000800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.97305 |
.tls | 0x0009D000 | 0x00000009 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 0x0009E000 | 0x000089B0 | 0x00008A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.36023 |
.reloc | 0x000A7000 | 0x0000624C | 0x00006400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.59037 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.16947 | 2013 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 4.16586 | 9640 | UNKNOWN | English - United States | RT_ICON |
3 | 4.18397 | 4264 | UNKNOWN | English - United States | RT_ICON |
4 | 4.51828 | 1128 | UNKNOWN | English - United States | RT_ICON |
101 | 2.62308 | 62 | UNKNOWN | English - United States | RT_GROUP_ICON |
ADVAPI32.dll |
KERNEL32.dll |
RPCRT4.dll |
USER32.dll (delay-loaded) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3676 | "C:\Users\admin\AppData\Local\Temp\download.exe" | C:\Users\admin\AppData\Local\Temp\download.exe | — | explorer.exe |
User: admin Company: Corel Corporation Integrity Level: MEDIUM Description: WordPerfectOffice Exit code: 3221226540 Version: 19.0.0.1 | ||||
2024 | "C:\Users\admin\AppData\Local\Temp\download.exe" | C:\Users\admin\AppData\Local\Temp\download.exe | explorer.exe | |
User: admin Company: Corel Corporation Integrity Level: HIGH Description: WordPerfectOffice Exit code: 0 Version: 19.0.0.1 | ||||
2508 | run=1 shortcut="C:\Users\admin\AppData\Local\Temp\download.exe" | C:\Users\admin\AppData\Local\Temp\13f705\download.exe | download.exe | |
User: admin Company: Corel Corporation Integrity Level: HIGH Description: WordPerfectOffice Exit code: 1 Version: 19.0.0.1 | ||||
2824 | "C:\Users\admin\AppData\Local\Temp\14ceb8\\setup.exe" /l* "C:\Users\admin\AppData\Local\Temp\WPO_log\log_20180615203134.txt" LAUNCHED_FROM_STUB=1 STUB_PATH="C:\Users\admin\AppData\Local\Temp\download.exe" LAUNCHONEXIT=\Corel\Installer\7cb01e43-4f18-45d8-a920-8d4d553023b7\LaunchOnExit x-at=wpox9-xx-ppc_brkws x-channel=ppc_brkws | C:\Users\admin\AppData\Local\Temp\14ceb8\setup.exe | download.exe | |
User: admin Company: Corel Corporation Integrity Level: HIGH Description: Setup.exe Exit code: 0 Version: 2.5.3.50 | ||||
788 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
1500 | C:\Windows\system32\MsiExec.exe -Embedding 0E2727E1B62E6EAD9FBA1551B1725321 C | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
4052 | c:\Windows\system32\MsiExec.exe -Embedding 490054DC38FC1BA7A5C0CE5C81A703DF | c:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2596 | c:\Windows\system32\MsiExec.exe -Embedding 717B29A49E5799D0F1D4DB4779235186 | c:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
1380 | "c:\Program Files\Common Files\Borland Shared\BDE\Cfg_BDE.exe" -MA "\DRIVERS\PARADOX\INIT" -MI "NET DIR" -RV c:\PROGRA~2\Borland\NetDir\ | c:\Program Files\Common Files\Borland Shared\BDE\Cfg_BDE.exe | — | msiexec.exe |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
2612 | c:\Windows\system32\MsiExec.exe -Embedding 24C1C8F75EDCC26663BB425C29310F50 | c:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\common\img\progress_background.png | image | |
MD5:E8AE28AB7407927A88E1E54F2A680B10 | SHA256:2391D27CA6FBBB18B87EC6D34D8C1F70B1F032D6075C027226A01755F045BBE4 | |||
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\common\js\common.js | text | |
MD5:D61F73359D092188DA4204C735C63C4F | SHA256:803A1C716A7D2BDEB834BE7C78CF5AC7CDCA81A897015E201E46C1790207EC6A | |||
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\common\js\stubparams.js | text | |
MD5:3D2E7913944163DB86EA4C7B9BA428A2 | SHA256:284F5875B854D72149E173BF60EABB15BBDC35689BFB1E0B8B0A0EA16524BE07 | |||
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\config\lang.js | text | |
MD5:A31DE25B669E2EEC8EA237793570A4A5 | SHA256:3672A30F4827A3901FB17A3B35EEAA1B0D2C1B3CC0BB06AAB6CBF358057194A6 | |||
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\common\img\close_hover.png | image | |
MD5:5D79E2175E6F02D441656D3334693783 | SHA256:25264FDDF7457AD4CA1438D57058540C2F2BE3C0B9E61EBBB149020BEC15EE62 | |||
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\config\config.js | text | |
MD5:1E9B529550B8026EE4058C4AE6EB593C | SHA256:BD87F536B197FD673A4D2579B7986D1593C42A28A0D998ED7D4A1E2285BB0090 | |||
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\common\img\BG.png | image | |
MD5:E3C190735B7443416ACDD8915065792B | SHA256:BCF3BCEDBC53E6A8E4A04C2290F489D68BCDE9E7BC028809D2611B507B9326D1 | |||
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\common\css\common.css | text | |
MD5:5520224B941F128F7F12B64F095D65ED | SHA256:700D9F894A85B653624255F0BC8FBAC4CAAA3D44064FEDFD7D1607E0B10A7BB3 | |||
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\Load.html | html | |
MD5:3C5F1F31D4F05E12625A9FB3E6E37034 | SHA256:A3DEB1AB42EC10AB64D1E46F055E16B786FBEED9950D5DB52384D9641C7D7B29 | |||
2508 | download.exe | C:\Users\admin\AppData\Local\Temp\13f87c\common\img\close.png | image | |
MD5:FDE10DC070AC14EDA212A9E3736D3EE7 | SHA256:6ECB0F0EA0CF48CB55A9555968F4F1AB045869619E9B61D8F0E6C7459DA05252 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2508 | download.exe | GET | — | 23.67.142.164:80 | http://www.corel.com/akdlm/6763/downloads/pd/esd/WordPerfect/X9/Stub/Trial/WordPerfectOfficeX9STD_en.zip?__gda__=1529526636_56543bb3d91c16700e389d5ceb76b56e&ext=.zip | NL | — | — | whitelisted |
2508 | download.exe | GET | — | 23.67.142.164:80 | http://www.corel.com/akdlm/6763/downloads/pd/esd/WordPerfect/X9/Stub/Trial/WordPerfectOfficeX9STD_en.zip?__gda__=1529526636_56543bb3d91c16700e389d5ceb76b56e&ext=.zip | NL | — | — | whitelisted |
2508 | download.exe | GET | 200 | 23.67.142.164:80 | http://www.corel.com/akdlm/6763/downloads/pd/esd/WordPerfect/X9/Stub/Trial/WordPerfectOfficeX9STD_en.zip.meta?__gda__=1529526636_016ee60c10d1bbe6076ccad5254af48e&ext=.meta | NL | binary | 7.49 Kb | whitelisted |
2508 | download.exe | POST | 200 | 52.35.122.223:80 | http://www.installportal.com/v1/token | US | text | 245 b | malicious |
2508 | download.exe | POST | 200 | 52.35.122.223:80 | http://www.installportal.com/v1/token | US | text | 239 b | malicious |
2508 | download.exe | POST | 200 | 52.35.122.223:80 | http://i.installportal.com/v1/logAnalytics | US | xml | 204 b | malicious |
2508 | download.exe | POST | 200 | 52.35.122.223:80 | http://www.installportal.com/v1/token | US | text | 245 b | malicious |
2508 | download.exe | POST | 200 | 52.35.122.223:80 | http://www.installportal.com/v1/token | US | text | 239 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2508 | download.exe | 52.35.122.223:80 | i.installportal.com | Amazon.com, Inc. | US | malicious |
2508 | download.exe | 23.67.142.164:80 | www.corel.com | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
i.installportal.com |
| unknown |
www.installportal.com |
| unknown |
www.corel.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
3560 | CUH.EXE | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3560 | CUH.EXE | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |