File name:

680467c7f952e4407c159e89174ef5acc7162cd9.exe

Full analysis: https://app.any.run/tasks/ab9ed939-cee3-41cc-a7fc-7fc01a7c4908
Verdict: Malicious activity
Analysis date: July 16, 2019, 09:16:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D9DA8871F5888ED669F9F4171B7562EB

SHA1:

680467C7F952E4407C159E89174EF5ACC7162CD9

SHA256:

6AF1BDDD7239C0FF3F12A0CD112FCA41618BE64064E6826A21B05B479673B7FF

SSDEEP:

49152:3O1WBdAXN8W2c2Ywo+8reWV237lSGsY+BGgmRAMMiu+pj/Pxh7kQpN35O:3kWTAXNrH+rWqxqY+kb0iVpj/ZmQVO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • pack.exe (PID: 2988)
      • bd_rem_tool.exe (PID: 2820)

    • Loads dropped or rewritten executable

      • bd_rem_tool.exe (PID: 2820)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • 680467c7f952e4407c159e89174ef5acc7162cd9.exe (PID: 3648)
      • pack.exe (PID: 2988)

    • Executable content was dropped or overwritten

      • 680467c7f952e4407c159e89174ef5acc7162cd9.exe (PID: 3648)
      • pack.exe (PID: 2988)

    • Starts CMD.EXE for commands execution

      • 680467c7f952e4407c159e89174ef5acc7162cd9.exe (PID: 3648)

    • Removes files from Windows directory

      • pack.exe (PID: 2988)
      • 680467c7f952e4407c159e89174ef5acc7162cd9.exe (PID: 3648)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:03:12 13:16:57+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 102400
InitializedDataSize: 2818048
UninitializedDataSize: -
EntryPoint: 0xa09b
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 12-Mar-2009 12:16:57
Detected languages:
  • English - United States
Debug artifacts:
  • d:\projects\em\branches\3.0.5.3.downadup\bin\win32\release\bitdefender deployment tool\BDDepSrv.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 12-Mar-2009 12:16:57
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001887B
0x00019000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.61255
.rdata
0x0001A000
0x00006498
0x00007000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.37053
.data
0x00021000
0x00003A54
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.37113
.rsrc
0x00025000
0x002A63EC
0x002A7000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.98266

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.65542
86
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.60579
1128
Latin 1 / Western European
English - United States
RT_ICON
3
4.9907
2216
Latin 1 / Western European
English - United States
RT_ICON
4
5.32412
4264
Latin 1 / Western European
English - United States
RT_ICON
5
5.7695
3752
Latin 1 / Western European
English - United States
RT_ICON
6
5.30896
9640
Latin 1 / Western European
English - United States
RT_ICON
7
3.69457
1384
Latin 1 / Western European
English - United States
RT_ICON
8
5.60579
1128
Latin 1 / Western European
English - United States
RT_ICON
9
4.9907
2216
Latin 1 / Western European
English - United States
RT_ICON
10
5.32412
4264
Latin 1 / Western European
English - United States
RT_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
SHLWAPI.dll
USER32.dll
WTSAPI32.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 680467c7f952e4407c159e89174ef5acc7162cd9.exe cmd.exe no specs pack.exe bd_rem_tool.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2336cmd /c C:\Windows\TEMP\_bddep_\run.batC:\Windows\system32\cmd.exe—680467c7f952e4407c159e89174ef5acc7162cd9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2820C:\Windows\temp\_bddep_\bd_rem_tool.exe C:\Windows\temp\_bddep_\bd_rem_tool.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\temp\_bddep_\bd_rem_tool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shell32.dll
2988C:\Windows\temp\_bddep_\pack.exe C:\Windows\temp\_bddep_\pack.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\temp\_bddep_\pack.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
3648"C:\Users\admin\AppData\Local\Temp\680467c7f952e4407c159e89174ef5acc7162cd9.exe" C:\Users\admin\AppData\Local\Temp\680467c7f952e4407c159e89174ef5acc7162cd9.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\680467c7f952e4407c159e89174ef5acc7162cd9.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
57
Read events
57
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
13
Text files
71
Unknown types
8

Dropped files

PID
Process
Filename
Type
3648680467c7f952e4407c159e89174ef5acc7162cd9.exeC:\windows\temp\_bddep_\1970fe6a.bhvtext
MD5:—
SHA256:—
3648680467c7f952e4407c159e89174ef5acc7162cd9.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\bddep.logtext
MD5:—
SHA256:—
2988pack.exeC:\Windows\Temp\_bddep_\libfn.dllexecutable
MD5:C022B72435CCD829DB83759B278C93CE
SHA256:45F9269D7E55D38E0D2600946662C513F28F7AC17B8B3051E6B57DA68CCA3903
2988pack.exeC:\Windows\Temp\_bddep_\plugins\ceva_dll.cvdbinary
MD5:38117AD1558A7B5523658BA6F4F9B1F8
SHA256:24B0AE0CF1A8BE5C7A0477678097FA81D41141951254F7F50A6A5121BB716ACD
2988pack.exeC:\Windows\Temp\_bddep_\plugins\cevakrnl.rvdxmd
MD5:95F086C4B1C9818EE4E5C9FE9E6D669F
SHA256:DE9CC19D7BB43497D83E81D5E8EB9EED00470E58D0BF2241A6C997562BAD0712
2988pack.exeC:\Windows\Temp\_bddep_\plugins\cevakrnl.rvd.1xmd
MD5:D4DEE993E9DD656F170D3116116325D7
SHA256:61F5931CD7D6A5314A515306234665DC68EEA5EF6794E6DD3978567D1E0EB0A2
2988pack.exeC:\Windows\Temp\_bddep_\plugins\cevakrnl.xmdxmd
MD5:C6D6971F05A6CB96A1600D215EEE5659
SHA256:7F072E754C7F245AE048CC0A7AEDB32A0CB2F049A94470629AAB190F6AFD973C
2988pack.exeC:\Windows\Temp\_bddep_\plugins\ceva_emu.cvdxmd
MD5:609DF546556B12BBCB1B5DD9EBDB5189
SHA256:3EDB43B17AEF5DAB16BAF54074A9A691E8BAE514A501BD951C1D9BB36893AD67
2988pack.exeC:\Windows\Temp\_bddep_\plugins\orice.rvdbinary
MD5:FE04F643C070658ACCC047E531F19F5C
SHA256:3D7257DE95755835E0E5D62D7D9447118B7CA0ECCABAF0A33246D4E2DCB97A0E
2988pack.exeC:\Windows\Temp\_bddep_\plugins\ceva_vfs.cvdbinary
MD5:AE61F61A136D16293C3B86E4EC7E7418
SHA256:E113AE476542EBF9D754AD2F2E0053F133C7A612DC87B83409435EDCB7BB06C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
680467c7f952e4407c159e89174ef5acc7162cd9.exe
dummy
680467c7f952e4407c159e89174ef5acc7162cd9.exe
dummy
680467c7f952e4407c159e89174ef5acc7162cd9.exe
-------------------------------- new session ---------------------------------------- bddep_main -> starting...
680467c7f952e4407c159e89174ef5acc7162cd9.exe
-------------------------------- new session ---------------------------------------- bddep_main -> starting...
680467c7f952e4407c159e89174ef5acc7162cd9.exe
bddep_main -> createtempdir
680467c7f952e4407c159e89174ef5acc7162cd9.exe
bddep_main -> init dropper
680467c7f952e4407c159e89174ef5acc7162cd9.exe
RESOURCEENUMERATOR: RES = [BDDROPPERCFGTYPE].[BDDROPPERCFGNAME]
680467c7f952e4407c159e89174ef5acc7162cd9.exe
RESOURCEENUMERATOR: RES = [BDDROPPERCMD].[NUMECMD]
680467c7f952e4407c159e89174ef5acc7162cd9.exe
RESOURCEENUMERATOR: RES = [BDDROPPEREXE].[1970FE6A.BHV]
680467c7f952e4407c159e89174ef5acc7162cd9.exe
RESOURCEENUMERATOR: RES = [BDDROPPEREXE].[PACK.EXE]
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
680467c7f952e4407c159e89174ef5acc7162cd9.exe