| File name: | IDM Full Toolkit 4.7.exe |
| Full analysis: | https://app.any.run/tasks/521a2f93-ae6f-48f4-9601-05958eb9170b |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | March 28, 2022, 02:53:46 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5: | 942C6DDA690E7151CADF07BC304F41CA |
| SHA1: | 261B42D6790F6801420EF93F72763CC84479C789 |
| SHA256: | 6F9946C3B77815299A6A98FAC8E33D5DF83E5D05613052BD9439D526D076F10E |
| SSDEEP: | 24576:b4GHnhIzOaDdF+AzJj1lElVA495a2HgJ2A8+3d21Juzg5z5a2HgJ2A8+3dklMJg9:kshdaDdwAFefPAv3M1Juzg5RAv3ilMJc |
MALICIOUS
Loads dropped or rewritten executable
- IDM Full Toolkit 4.7.exe (PID: 3936)
- IDMFUL~1.EXE (PID: 2036)
Writes to the hosts file
- IDM Full Toolkit 4.7.exe (PID: 3936)
SUSPICIOUS
Checks supported languages
- IDM Full Toolkit 4.7.exe (PID: 3936)
- IDMFUL~1.EXE (PID: 2036)
Executable content was dropped or overwritten
- IDM Full Toolkit 4.7.exe (PID: 3936)
- IDMFUL~1.EXE (PID: 2036)
Reads the computer name
- IDM Full Toolkit 4.7.exe (PID: 3936)
- IDMFUL~1.EXE (PID: 2036)
Reads mouse settings
- IDM Full Toolkit 4.7.exe (PID: 3936)
- IDMFUL~1.EXE (PID: 2036)
Drops a file with too old compile date
- IDM Full Toolkit 4.7.exe (PID: 3936)
- IDMFUL~1.EXE (PID: 2036)
Drops a file with a compile date too recent
- IDM Full Toolkit 4.7.exe (PID: 3936)
Starts itself from another location
- IDM Full Toolkit 4.7.exe (PID: 3936)
Creates files in the user directory
- IDM Full Toolkit 4.7.exe (PID: 3936)
INFO
Reads settings of System Certificates
- IDM Full Toolkit 4.7.exe (PID: 3936)
- IDMFUL~1.EXE (PID: 2036)
Reads the hosts file
- IDM Full Toolkit 4.7.exe (PID: 3936)
Checks Windows Trust Settings
- IDM Full Toolkit 4.7.exe (PID: 3936)
- IDMFUL~1.EXE (PID: 2036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (28.6) |
|---|---|---|
| .exe | | | UPX compressed Win32 Executable (28) |
| .exe | | | Win32 EXE Yoda's Crypter (27.5) |
| .dll | | | Win32 Dynamic Link Library (generic) (6.8) |
| .exe | | | Win32 Executable (generic) (4.6) |
EXIF
EXE
| CompanyName: | ptk911 |
|---|---|
| LegalCopyright: | ptk911@2017-2020 |
| ProductVersion: | 4.7.0.0 |
| FileDescription: | IDM Full Toolkit |
| Comments: | IDM Full Toolkit is a free tool |
| FileVersion: | 4.7.0.0 |
| CharacterSet: | Unicode |
| LanguageCode: | English (British) |
| FileSubtype: | - |
| ObjectFileType: | Unknown |
| FileOS: | Win32 |
| FileFlags: | (none) |
| FileFlagsMask: | 0x0000 |
| ProductVersionNumber: | 4.7.0.0 |
| FileVersionNumber: | 4.7.0.0 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 5.1 |
| ImageVersion: | - |
| OSVersion: | 5.1 |
| EntryPoint: | 0x1f1b60 |
| UninitializedDataSize: | 1683456 |
| InitializedDataSize: | 1155072 |
| CodeSize: | 352256 |
| LinkerVersion: | 12 |
| PEType: | PE32 |
| TimeStamp: | 2020:10:08 10:40:55+02:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 08-Oct-2020 08:40:55 |
| Detected languages: |
|
| FileVersion: | 4.7.0.0 |
| Comments: | IDM Full Toolkit is a free tool |
| FileDescription: | IDM Full Toolkit |
| ProductVersion: | 4.7.0.0 |
| LegalCopyright: | ptk911@2017-2020 |
| CompanyName: | ptk911 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000110 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 08-Oct-2020 08:40:55 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x0019B000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x0019C000 | 0x00056000 | 0x00055E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.93644 |
.rsrc | 0x001F2000 | 0x0011A000 | 0x00119400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.99526 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.39264 | 1018 | Latin 1 / Western European | English - United Kingdom | RT_MANIFEST |
2 | 2.05883 | 296 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
3 | 2.25499 | 296 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
4 | 3.26791 | 9640 | Latin 1 / Western European | English - United Kingdom | RT_ICON |
7 | 7.88163 | 1428 | Latin 1 / Western European | English - United Kingdom | RT_STRING |
8 | 7.89696 | 1674 | Latin 1 / Western European | English - United Kingdom | RT_STRING |
9 | 7.84542 | 1168 | Latin 1 / Western European | English - United Kingdom | RT_STRING |
10 | 7.88732 | 1532 | Latin 1 / Western European | English - United Kingdom | RT_STRING |
11 | 7.87311 | 1628 | Latin 1 / Western European | English - United Kingdom | RT_STRING |
12 | 7.81159 | 1126 | Latin 1 / Western European | English - United Kingdom | RT_STRING |
Imports
ADVAPI32.dll |
COMCTL32.dll |
COMDLG32.dll |
GDI32.dll |
IPHLPAPI.DLL |
KERNEL32.DLL |
MPR.dll |
OLEAUT32.dll |
PSAPI.DLL |
SHELL32.dll |
Total processes
41
Monitored processes
3
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 960 | "C:\Users\admin\Desktop\IDM Full Toolkit 4.7.exe" | C:\Users\admin\Desktop\IDM Full Toolkit 4.7.exe | — | Explorer.EXE | |||||||||||
User: admin Company: ptk911 Integrity Level: MEDIUM Description: IDM Full Toolkit Exit code: 3221226540 Version: 4.7.0.0 Modules
| |||||||||||||||
| 2036 | C:\Users\admin\Desktop\IDMFUL~1.EXE | C:\Users\admin\Desktop\IDMFUL~1.EXE | IDM Full Toolkit 4.7.exe | ||||||||||||
User: admin Company: ptk911 Integrity Level: HIGH Description: IDM Full Toolkit Exit code: 0 Version: 4.7.0.0 Modules
| |||||||||||||||
| 3936 | "C:\Users\admin\Desktop\IDM Full Toolkit 4.7.exe" | C:\Users\admin\Desktop\IDM Full Toolkit 4.7.exe | Explorer.EXE | ||||||||||||
User: admin Company: ptk911 Integrity Level: HIGH Description: IDM Full Toolkit Exit code: 0 Version: 4.7.0.0 Modules
| |||||||||||||||
Total events
8 233
Read events
8 152
Write events
80
Delete events
1
Modification events
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\DownloadManager |
| Operation: | write | Name: | toolkit |
Value: Vi | |||
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\DownloadManager |
| Operation: | write | Name: | toolkitchkup |
Value: 1 | |||
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3936) IDM Full Toolkit 4.7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
Executable files
4
Suspicious files
6
Text files
18
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\Local\Temp\youtube.ico | image | |
MD5:0B1F66EA0440908E8DF89D1565A82297 | SHA256:B80BCED7965735FB76222D1217E743FFF7FEDCEC150058D55B22913A1F107533 | |||
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E11E75149C17A93653DA7DC0B8CF53F_C65B017DD57571D31EF6E1153CE29ED8 | binary | |
MD5:— | SHA256:— | |||
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\RDMGEZBC.htm | html | |
MD5:— | SHA256:— | |||
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\raw[1].txt | text | |
MD5:— | SHA256:— | |||
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 | binary | |
MD5:— | SHA256:— | |||
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 | der | |
MD5:— | SHA256:— | |||
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 | binary | |
MD5:— | SHA256:— | |||
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E11E75149C17A93653DA7DC0B8CF53F_C65B017DD57571D31EF6E1153CE29ED8 | der | |
MD5:— | SHA256:— | |||
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\XJSV6UKH.txt | text | |
MD5:— | SHA256:— | |||
| 3936 | IDM Full Toolkit 4.7.exe | C:\Users\admin\AppData\Local\Temp\arrow.ico | image | |
MD5:9AE32643C4230380CFD51CAD83B26273 | SHA256:F659FE725FA34DCE0C25CD2FD3D450EBBBA176DC957D527016FA10E7A1AFBB83 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
7
DNS requests
8
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3936 | IDM Full Toolkit 4.7.exe | GET | — | 174.127.113.77:80 | http://mirror2.internetdownloadmanager.com/idman640build11.exe | US | — | — | malicious |
3936 | IDM Full Toolkit 4.7.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D | US | der | 471 b | whitelisted |
3936 | IDM Full Toolkit 4.7.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAlIiODT1zvFUhmYonmCN%2Bw%3D | US | der | 471 b | whitelisted |
3936 | IDM Full Toolkit 4.7.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f19a590d8c050ac5 | US | compressed | 4.70 Kb | whitelisted |
3936 | IDM Full Toolkit 4.7.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | US | der | 471 b | whitelisted |
3936 | IDM Full Toolkit 4.7.exe | GET | 200 | 174.127.113.77:80 | http://mirror2.internetdownloadmanager.com/idman640build11.exe | US | executable | 10.7 Mb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3936 | IDM Full Toolkit 4.7.exe | 185.199.110.133:443 | gist.githubusercontent.com | GitHub, Inc. | NL | malicious |
3936 | IDM Full Toolkit 4.7.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
3936 | IDM Full Toolkit 4.7.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2036 | IDMFUL~1.EXE | 185.199.110.133:443 | gist.githubusercontent.com | GitHub, Inc. | NL | malicious |
3936 | IDM Full Toolkit 4.7.exe | 174.127.113.77:80 | mirror2.internetdownloadmanager.com | WestHost, Inc. | US | malicious |
3936 | IDM Full Toolkit 4.7.exe | 169.60.186.153:443 | internetdownloadmanager.com | SoftLayer Technologies Inc. | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
gist.githubusercontent.com |
| shared |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
internetdownloadmanager.com |
| suspicious |
mirror2.internetdownloadmanager.com |
| unknown |
google.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |
— | — | A Network Trojan was detected | ET INFO AutoIt User Agent Executable Request |
— | — | Potential Corporate Privacy Violation | ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |
— | — | A Network Trojan was detected | ET INFO AutoIt User Agent Executable Request |