File name: | video.mkv.zip |
Full analysis: | https://app.any.run/tasks/d2287893-c64c-431a-8cc3-c491a28b95b8 |
Verdict: | Malicious activity |
Analysis date: | April 12, 2020, 12:46:29 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | D044B11C365FFA6792F6E2CD3196C7D9 |
SHA1: | DB62743E9973624E8EB6794B0F59A768839A83DA |
SHA256: | 6D0027A89B959821BCB9E2A9E1B58169658000CC391A79DD6E23592EA39E100D |
SSDEEP: | 49152:YTQR/8OxPM2iLE5o8nT1DZ49+bMO+SaFIsAP8xaV3bRlktZ0/Au:Y4lBMbE/nTNBMO4F+dRli+/h |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 788 |
---|---|
ZipBitFlag: | 0x0001 |
ZipCompression: | Deflated |
ZipModifyDate: | 2020:04:12 14:46:02 |
ZipCRC: | 0x3450bb78 |
ZipCompressedSize: | 3360602 |
ZipUncompressedSize: | 3402084 |
ZipFileName: | video.mkv |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3884 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\video.mkv.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3028 | "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\admin\Desktop\video.mkv" | C:\Program Files\VideoLAN\VLC\vlc.exe | explorer.exe | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Exit code: 0 Version: 2.2.6 | ||||
2640 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1064 | "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\admin\Desktop\video.mkv" | C:\Program Files\VideoLAN\VLC\vlc.exe | explorer.exe | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Exit code: 0 Version: 2.2.6 | ||||
1748 | "C:\Users\admin\AppData\Local\Temp\vlc-3.0.8-win32.exe" | C:\Users\admin\AppData\Local\Temp\vlc-3.0.8-win32.exe | — | vlc.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
2684 | "C:\Users\admin\AppData\Local\Temp\vlc-3.0.8-win32.exe" | C:\Users\admin\AppData\Local\Temp\vlc-3.0.8-win32.exe | vlc.exe | |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
3528 | "C:\Users\admin\AppData\Local\Temp\nsf29A1.tmp\ns642A.tmp" "C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe" C:\Program Files\VideoLAN\VLC\plugins | C:\Users\admin\AppData\Local\Temp\nsf29A1.tmp\ns642A.tmp | — | vlc-3.0.8-win32.exe |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
348 | "C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe" C:\Program Files\VideoLAN\VLC\plugins | C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe | ns642A.tmp | |
User: admin Company: VideoLAN Integrity Level: HIGH Description: VLC media player Exit code: 0 Version: 3.0.8 | ||||
780 | "C:\Windows\explorer.exe" "C:\Program Files\VideoLAN\VLC\vlc.exe" | C:\Windows\explorer.exe | — | vlc-3.0.8-win32.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4000 | C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding | C:\Windows\explorer.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3884 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb3884.44302\video.mkv | — | |
MD5:— | SHA256:— | |||
3028 | vlc.exe | C:\Users\admin\AppData\Local\Temp\VLC2128.tmp | — | |
MD5:— | SHA256:— | |||
3028 | vlc.exe | C:\Users\admin\AppData\Local\Temp\VLC2196.tmp | — | |
MD5:— | SHA256:— | |||
3028 | vlc.exe | C:\Users\admin\AppData\Local\Temp\VLC2197.tmp | — | |
MD5:— | SHA256:— | |||
3028 | vlc.exe | C:\Users\admin\AppData\Local\Temp\VLC2198.tmp | — | |
MD5:— | SHA256:— | |||
3028 | vlc.exe | C:\Users\admin\AppData\Local\Temp\VLC2199.tmp | — | |
MD5:— | SHA256:— | |||
3028 | vlc.exe | C:\Users\admin\AppData\Local\Temp\VLC21AA.tmp | — | |
MD5:— | SHA256:— | |||
3028 | vlc.exe | C:\Users\admin\AppData\Local\Temp\VLC21AB.tmp | — | |
MD5:— | SHA256:— | |||
3028 | vlc.exe | C:\Users\admin\AppData\Local\Temp\VLC21AC.tmp | — | |
MD5:— | SHA256:— | |||
3028 | vlc.exe | C:\Users\admin\AppData\Local\Temp\VLC21AD.tmp | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1064 | vlc.exe | GET | 302 | 62.210.246.226:80 | http://get.videolan.org/vlc/3.0.8/win32/vlc-3.0.8-win32.exe | FR | html | 113 b | malicious |
1064 | vlc.exe | GET | 302 | 62.210.246.226:80 | http://get.videolan.org/vlc/3.0.8/win32/vlc-3.0.8-win32.exe.asc | FR | html | 118 b | malicious |
1064 | vlc.exe | GET | 206 | 77.244.244.134:80 | http://mirror.easyname.ch/videolan/vlc/3.0.8/win32/vlc-3.0.8-win32.exe.asc | AT | asc | 195 b | suspicious |
1064 | vlc.exe | GET | 206 | 213.36.253.2:80 | http://update.videolan.org/vlc/status-win-x86.asc | FR | asc | 195 b | malicious |
1064 | vlc.exe | GET | 206 | 213.36.253.2:80 | http://update.videolan.org/vlc/status-win-x86 | FR | text | 287 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1064 | vlc.exe | 62.210.246.226:80 | get.videolan.org | Online S.a.s. | FR | malicious |
1064 | vlc.exe | 109.202.202.202:443 | mirror.init7.net | Nexanet GmbH | CH | suspicious |
1064 | vlc.exe | 213.36.253.2:80 | update.videolan.org | Free SAS | FR | malicious |
1064 | vlc.exe | 77.244.244.134:80 | mirror.easyname.ch | Nessus GmbH | AT | suspicious |
Domain | IP | Reputation |
---|---|---|
update.videolan.org |
| unknown |
get.videolan.org |
| unknown |
mirror.init7.net |
| suspicious |
mirror.easyname.ch |
| suspicious |
Process | Message |
---|---|
vlc.exe | core libvlc: one instance mode ENABLED
|
vlc.exe | core libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
|
vlc.exe | direct3d vout display error: Could not read adapter capabilities. (hr=0x8876086A)
|
vlc.exe | direct3d vout display error: Direct3D could not be initialized
|
vlc.exe | core libvlc: one instance mode ENABLED
|
vlc.exe | core libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
|
vlc.exe | core libvlc: Status file authenticated
|
vlc.exe | direct3d vout display error: Could not read adapter capabilities. (hr=0x8876086A)
|
vlc.exe | direct3d vout display error: Direct3D could not be initialized
|
vlc.exe | core update download: C:\Users\admin\AppData\Local\Temp\vlc-3.0.8-win32.exe authenticated
|