File name: | 6d749ee3595ee38f5a236a5bace210cb6b81dffef08a6fc84ff564cde011a94f |
Full analysis: | https://app.any.run/tasks/dbd14eba-0dbe-429b-9e19-89eea8e6b6a2 |
Verdict: | Malicious activity |
Analysis date: | October 04, 2022, 21:49:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | DED9173AF85C51F8A7F8B96EF8161509 |
SHA1: | F4A4458054A43648B58585E84D72D2533E72274B |
SHA256: | 6D749EE3595EE38F5A236A5BACE210CB6B81DFFEF08A6FC84FF564CDE011A94F |
SSDEEP: | 3072:XQIURTXJ8DxghetE1sNevwHXhXq9ekYiHIhrb2QtHbHYU:XseyFxvwHXAjSh/jtHbJ |
.exe | | | NSIS - Nullsoft Scriptable Install System (94.8) |
---|---|---|
.exe | | | Win32 Executable MS Visual C++ (generic) (3.4) |
.dll | | | Win32 Dynamic Link Library (generic) (0.7) |
.exe | | | Win32 Executable (generic) (0.5) |
.exe | | | Generic Win/DOS Executable (0.2) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2009-Dec-05 22:50:46 |
Detected languages: |
|
CompanyName: | 北京迅鲨科技有限公司 |
FileDescription: | 蓝月传奇微端 |
FileVersion: | 2.0.0.0 |
InternalName: | 蓝月传奇 |
LegalCopyright: | 北京迅鲨科技有限公司 |
ProductName: | 蓝月传奇 |
ProductVersion: | 2.0.0.0 |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 216 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 5 |
TimeDateStamp: | 2009-Dec-05 22:50:46 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 23130 | 23552 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.4177 |
.rdata | 28672 | 4496 | 4608 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.18163 |
.data | 36864 | 110488 | 1024 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.70903 |
.ndata | 147456 | 77824 | 0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.rsrc | 225280 | 103152 | 103424 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.05109 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 7.63056 | 67624 | UNKNOWN | English - United States | RT_ICON |
2 | 5.43636 | 16936 | UNKNOWN | English - United States | RT_ICON |
3 | 5.58753 | 9640 | UNKNOWN | English - United States | RT_ICON |
4 | 5.52898 | 4264 | UNKNOWN | English - United States | RT_ICON |
5 | 5.44515 | 1128 | UNKNOWN | English - United States | RT_ICON |
103 | 2.47654 | 268 | UNKNOWN | English - United States | RT_DIALOG |
105 | 2.68733 | 494 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.86626 | 228 | UNKNOWN | English - United States | RT_DIALOG |
111 | 2.9304 | 218 | UNKNOWN | English - United States | RT_DIALOG |
103 (#2) | 2.64638 | 76 | UNKNOWN | English - United States | RT_GROUP_ICON |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3456 | "C:\Users\admin\AppData\Local\Temp\6d749ee3595ee38f5a236a5bace210cb6b81dffef08a6fc84ff564cde011a94f.exe" | C:\Users\admin\AppData\Local\Temp\6d749ee3595ee38f5a236a5bace210cb6b81dffef08a6fc84ff564cde011a94f.exe | — | Explorer.EXE |
User: admin Company: 北京迅鲨科技有限公司 Integrity Level: MEDIUM Description: 蓝月传奇微端 Exit code: 3221226540 Version: 2.0.0.0 | ||||
2152 | "C:\Users\admin\AppData\Local\Temp\6d749ee3595ee38f5a236a5bace210cb6b81dffef08a6fc84ff564cde011a94f.exe" | C:\Users\admin\AppData\Local\Temp\6d749ee3595ee38f5a236a5bace210cb6b81dffef08a6fc84ff564cde011a94f.exe | Explorer.EXE | |
User: admin Company: 北京迅鲨科技有限公司 Integrity Level: HIGH Description: 蓝月传奇微端 Exit code: 0 Version: 2.0.0.0 | ||||
1860 | "C:\Users\admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\admin\AppData\Local\Temp\ | C:\Users\admin\AppData\Local\Temp\~nsu.tmp\Au_.exe | 6d749ee3595ee38f5a236a5bace210cb6b81dffef08a6fc84ff564cde011a94f.exe | |
User: admin Company: 北京迅鲨科技有限公司 Integrity Level: HIGH Description: 蓝月传奇微端 Exit code: 2 Version: 2.0.0.0 |
(PID) Process: | (2152) 6d749ee3595ee38f5a236a5bace210cb6b81dffef08a6fc84ff564cde011a94f.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager |
Operation: | write | Name: | PendingFileRenameOperations |
Value: \??\C:\Users\admin\AppData\Local\Temp\~nsu.tmp\Au_.exe | |||
(PID) Process: | (1860) Au_.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager |
Operation: | write | Name: | PendingFileRenameOperations |
Value: \??\C:\Users\admin\AppData\Local\Temp\~nsu.tmp\Au_.exe |
PID | Process | Filename | Type | |
---|---|---|---|---|
2152 | 6d749ee3595ee38f5a236a5bace210cb6b81dffef08a6fc84ff564cde011a94f.exe | C:\Users\admin\AppData\Local\Temp\nsm3E9.tmp | binary | |
MD5:0ED58406C698419A82C0EC58EF76D4C7 | SHA256:ED2AAE10FEC2E88D63F7ECD64CF3D235CFD4C87334557E3D66FC72A00DF59B93 | |||
2152 | 6d749ee3595ee38f5a236a5bace210cb6b81dffef08a6fc84ff564cde011a94f.exe | C:\Users\admin\AppData\Local\Temp\~nsu.tmp\Au_.exe | executable | |
MD5:DED9173AF85C51F8A7F8B96EF8161509 | SHA256:6D749EE3595EE38F5A236A5BACE210CB6B81DFFEF08A6FC84FF564CDE011A94F | |||
1860 | Au_.exe | C:\Users\admin\AppData\Local\Temp\nss4A5.tmp | binary | |
MD5:0ED58406C698419A82C0EC58EF76D4C7 | SHA256:ED2AAE10FEC2E88D63F7ECD64CF3D235CFD4C87334557E3D66FC72A00DF59B93 | |||
1860 | Au_.exe | C:\Users\admin\AppData\Local\Temp\nsh4B5.tmp\System.dll | executable | |
MD5:C17103AE9072A06DA581DEC998343FC1 | SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F |