URL:

https://codeload.github.com/PhonePCB/PhonePCB/zip/refs/heads/master

Full analysis: https://app.any.run/tasks/aefcd6cc-2700-4328-a1c5-fcc5eeca70c4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 22, 2024, 02:04:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

8ECA5D787CF4A6AB71C48115574C1836

SHA1:

6215A0EB88CC1C40267A7E5AA9EAC985F0BD64DD

SHA256:

6C2A33AA16E60C5FEAE1FE7CD4DD90C4ABBA40937E2F028FA61994790A3575D1

SSDEEP:

3:N8X2EFQCrd6L+HQAdMUL6X:2m88Kw+MUL6X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)

    • Registers / Runs the DLL via REGSVR32.EXE

      • DZKJ[1].exe (PID: 120)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)

    • Creates/Modifies COM task schedule object

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 3056)
      • DZClient.exe (PID: 2420)
      • regsvr32.exe (PID: 3164)

    • Reads the Internet Settings

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)
      • DZClient.exe (PID: 2420)

    • Reads security settings of Internet Explorer

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)
      • DZClient.exe (PID: 2420)

    • Reads Microsoft Outlook installation path

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 3056)
      • DZClient.exe (PID: 2420)
      • DZKJ[1].exe (PID: 120)

    • Process requests binary or script from the Internet

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)

    • Reads settings of System Certificates

      • PhonePCB.exe (PID: 1888)

    • Reads Internet Explorer settings

      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 3056)
      • DZClient.exe (PID: 2420)
      • DZKJ[1].exe (PID: 120)

    • Checks Windows Trust Settings

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 3056)

    • Reads the BIOS version

      • DZKJ[1].exe (PID: 120)

  • INFO

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3672)

    • Application launched itself

      • iexplore.exe (PID: 3672)

    • Checks supported languages

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 3056)
      • DZClient.exe (PID: 2420)
      • DZKJ[1].exe (PID: 120)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3672)
      • WinRAR.exe (PID: 1836)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)

    • Manual execution by a user

      • PhonePCB.exe (PID: 2064)
      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 1484)
      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 1408)
      • PhonePCB.exe (PID: 3056)
      • DZClient.exe (PID: 2860)
      • DZClient.exe (PID: 2420)

    • Creates files in the program directory

      • PhonePCB.exe (PID: 1888)
      • DZClient.exe (PID: 2420)

    • Reads the computer name

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)
      • DZClient.exe (PID: 2420)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1836)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1836)

    • Creates files or folders in the user directory

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)
      • DZClient.exe (PID: 2420)

    • Checks proxy server information

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)
      • DZClient.exe (PID: 2420)

    • Reads the machine GUID from the registry

      • PhonePCB.exe (PID: 1888)
      • PhonePCB.exe (PID: 1840)
      • PhonePCB.exe (PID: 3056)
      • DZKJ[1].exe (PID: 120)
      • DZClient.exe (PID: 2420)

    • Reads the software policy settings

      • PhonePCB.exe (PID: 1888)

    • Reads Environment values

      • PhonePCB.exe (PID: 1888)

    • Process checks whether UAC notifications are on

      • DZKJ[1].exe (PID: 120)

    • Create files in a temporary directory

      • DZKJ[1].exe (PID: 120)

    • Reads CPU info

      • DZKJ[1].exe (PID: 120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
75
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe no specs iexplore.exe winrar.exe phonepcb.exe no specs phonepcb.exe phonepcb.exe no specs phonepcb.exe phonepcb.exe no specs phonepcb.exe dzkj[1].exe dzclient.exe no specs dzclient.exe regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\DZKJ[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\DZKJ[1].exe
PhonePCB.exe
User:
admin
Company:
DZKJ Schematics
Integrity Level:
HIGH
Description:
DZKJ Schematics & PCB Layout
Exit code:
0
Version:
1.0.0.52
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\dzkj[1].exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1408"C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe" C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe—explorer.exe
User:
admin
Company:
DZKJ PhoneRepair Tools
Integrity Level:
MEDIUM
Description:
DZKJ PhoneRepair
Exit code:
3221226540
Version:
1.0.0.23
Modules
Images
c:\users\admin\desktop\phonepcb-master\phonepcb.exe
c:\windows\system32\ntdll.dll
1484"C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe" C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe—explorer.exe
User:
admin
Company:
DZKJ PhoneRepair Tools
Integrity Level:
MEDIUM
Description:
DZKJ PhoneRepair
Exit code:
3221226540
Version:
1.0.0.23
Modules
Images
c:\users\admin\desktop\phonepcb-master\phonepcb.exe
c:\windows\system32\ntdll.dll
1836"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\PhonePCB-master.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1840"C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe" C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe
explorer.exe
User:
admin
Company:
DZKJ PhoneRepair Tools
Integrity Level:
HIGH
Description:
DZKJ PhoneRepair
Exit code:
0
Version:
1.0.0.23
Modules
Images
c:\users\admin\desktop\phonepcb-master\phonepcb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
1888"C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe" C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe
explorer.exe
User:
admin
Company:
DZKJ PhoneRepair Tools
Integrity Level:
HIGH
Description:
DZKJ PhoneRepair
Exit code:
0
Version:
1.0.0.23
Modules
Images
c:\users\admin\desktop\phonepcb-master\phonepcb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
2064"C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe" C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe—explorer.exe
User:
admin
Company:
DZKJ PhoneRepair Tools
Integrity Level:
MEDIUM
Description:
DZKJ PhoneRepair
Exit code:
3221226540
Version:
1.0.0.23
Modules
Images
c:\users\admin\desktop\phonepcb-master\phonepcb.exe
c:\windows\system32\ntdll.dll
2420"C:\Program Files\dz\DZClient.exe" C:\Program Files\dz\DZClient.exe
explorer.exe
User:
admin
Company:
DZKJ PhoneRepair Tools
Integrity Level:
HIGH
Description:
DZKJ PhoneRepair
Exit code:
0
Version:
1.0.0.23
Modules
Images
c:\program files\dz\dzclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
2860"C:\Program Files\dz\DZClient.exe" C:\Program Files\dz\DZClient.exe—explorer.exe
User:
admin
Company:
DZKJ PhoneRepair Tools
Integrity Level:
MEDIUM
Description:
DZKJ PhoneRepair
Exit code:
3221226540
Version:
1.0.0.23
Modules
Images
c:\program files\dz\dzclient.exe
c:\windows\system32\ntdll.dll
3056"C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe" C:\Users\admin\Desktop\PhonePCB-master\PhonePCB.exe
explorer.exe
User:
admin
Company:
DZKJ PhoneRepair Tools
Integrity Level:
HIGH
Description:
DZKJ PhoneRepair
Exit code:
0
Version:
1.0.0.23
Modules
Images
c:\users\admin\desktop\phonepcb-master\phonepcb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
Total events
31 683
Read events
31 381
Write events
249
Delete events
53

Modification events

(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31089971
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31089971
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
6
Suspicious files
20
Text files
64
Unknown types
16

Dropped files

PID
Process
Filename
Type
3672iexplore.exeC:\Users\admin\Downloads\PhonePCB-master.zip.e33mz4f.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3952iexplore.exeC:\Users\admin\Downloads\PhonePCB-master.zip.e33mz4f.partialcompressed
MD5:F5C9C60A93FF227DB70EB0E4FD74D95D
SHA256:236F37B52FF87C93E3428C157DC8CC03FF2853E9B1CBD324A23A8575635F063A
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1836.319\PhonePCB-master\PhonePCB.pngimage
MD5:D8AD9328B3850C214884034029CC7CC6
SHA256:8C8E52D11E889F8D118CD361687F5489CC4817C6D651C37644A5C6F4DD35E2D8
3672iexplore.exeC:\Users\admin\Downloads\PhonePCB-master.zipcompressed
MD5:F5C9C60A93FF227DB70EB0E4FD74D95D
SHA256:236F37B52FF87C93E3428C157DC8CC03FF2853E9B1CBD324A23A8575635F063A
3672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{C67B5D01-D126-11EE-AE0A-12A9866C77DE}.datbinary
MD5:77E0775F009BA037BCA1532564FE162D
SHA256:2AB568EDF7FE1082C122AAD2EB665B218A08B2824FC20A4DFAFED65917D1F5BA
3672iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF2B514BA8A5D1B2CB.TMPgmc
MD5:6CED07C2E85D3021FF494C8795269F64
SHA256:396557F44673726274171474123B3C12A6BBD260E0B60352DE9D3B9FCD9D1771
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565binary
MD5:BCDF46672109571B84B5E8A71B053E5A
SHA256:B5FF2C06059105AAFBDD6BE62CD84F05D20CB10BA7AFF3896C150EF8949943DC
1836WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1836.319\PhonePCB-master\PhonePCB.exeexecutable
MD5:3CDBAEFF09B921EC604C74FAF96C8591
SHA256:9CABB9568A53F56CA71863FA1B62D1B49FD4D26C0AC80D596E03F761A555B521
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565der
MD5:15DE8FBB24FC0A78D44D1795AEE6B172
SHA256:41E1DFCA6AB6D5E6CBB0CCCDD46A64D0207ABAC4DF74D55BBEB1F8052452B45E
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:49DD24A23D05E382926B1D0D40F83916
SHA256:D61FDBBB09EA5DE697613069206FB29A3A8A8051F3255DFCEE4A74042F7FA548
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
85
TCP/UDP connections
54
DNS requests
24
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3952
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c70275e956f241e7
unknown
—
—
unknown
3952
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?927e0d673a39dd41
unknown
—
—
unknown
3952
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
binary
471 b
unknown
3952
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrHR6YzPN2BNbByL0VoiTIBBMAOAQUCrwIKReMpTlteg7OM8cus%2B37w3oCEAuJBTcSX0UQ1jcqECipKaU%3D
unknown
binary
313 b
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?89bca2e7018c82c0
unknown
compressed
65.2 Kb
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1b8fee253118cbef
unknown
compressed
65.2 Kb
unknown
1888
PhonePCB.exe
POST
200
136.244.97.116:80
http://down.dzkj16888.com/tg/jh.php
unknown
text
3 b
unknown
1888
PhonePCB.exe
GET
302
136.244.97.116:80
http://down.dzkj16888.com/main/ad/banner.php?code=PCB
unknown
text
23 b
unknown
1888
PhonePCB.exe
GET
302
136.244.97.116:80
http://down.dzkj16888.com/main/ad/main.php?code=PCB
unknown
text
23 b
unknown
1888
PhonePCB.exe
GET
200
136.244.97.116:80
http://www.dzkj16888.com/main/gg/banner.php
unknown
html
371 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3952
iexplore.exe
140.82.121.9:443
codeload.github.com
GITHUB
US
unknown
3952
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3952
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1080
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1888
PhonePCB.exe
136.244.97.116:80
down.dzkj16888.com
AS-CHOOPA
NL
unknown
1888
PhonePCB.exe
103.235.46.40:80
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
1888
PhonePCB.exe
157.240.0.6:443
connect.facebook.net
FACEBOOK
US
unknown

DNS requests

Domain
IP
Reputation
codeload.github.com
  • 140.82.121.9
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
down.dzkj16888.com
  • 136.244.97.116
unknown
www.dzkj16888.com
  • 136.244.97.116
unknown
www.baidu.com
  • 103.235.46.40
whitelisted
connect.facebook.net
  • 157.240.0.6
  • 157.240.252.13
whitelisted
sdk.51.la
  • 47.246.50.37
unknown
collect-v6.51.la
  • 203.107.86.226
unknown
do.nanzhao.cn
  • 154.211.5.161
unknown

Threats

PID
Process
Class
Message
1888
PhonePCB.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
1888
PhonePCB.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
1888
PhonePCB.exe
Potential Corporate Privacy Violation
ET POLICY Http Client Body contains pwd= in cleartext
1888
PhonePCB.exe
Potential Corporate Privacy Violation
ET POLICY Http Client Body contains pwd= in cleartext
1888
PhonePCB.exe
Potential Corporate Privacy Violation
ET POLICY Http Client Body contains pwd= in cleartext
3056
PhonePCB.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3056
PhonePCB.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3056
PhonePCB.exe
Misc activity
ET INFO Packed Executable Download
3056
PhonePCB.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://codeload.github.com/PhonePCB/PhonePCB/zip/refs/heads/master