File name:

PracticalMalwareAnalysis-Labs.exe

Full analysis: https://app.any.run/tasks/5c31b8c7-9516-464d-b91e-e76d29edb7b4
Verdict: Malicious activity
Analysis date: April 13, 2018, 08:05:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5:

9D9C90870BC46AD65BAF0F3977E7590F

SHA1:

DEC5842D07BBD00EDF564FE27C14118EC9ECC77F

SHA256:

704138BEC89CF9E7F00FBCE100DBC09CF133D16DC0203806392F0E153C43C68C

SSDEEP:

24576:uxaVxr53s2QByK9VHFsZ+Ykyxm7g8LVYD/rh6m6er9wgwGe66hXS:u6QXHFsrxKY70neru/66dS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application loaded dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3012)

  • SUSPICIOUS

    • Reads internet explorer settings

      • PracticalMalwareAnalysis-Labs.exe (PID: 3188)

  • INFO

    • Loads rich edit control libraries

      • PracticalMalwareAnalysis-Labs.exe (PID: 3188)

    • Dropped object may contain URL's

      • PracticalMalwareAnalysis-Labs.exe (PID: 3188)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2376)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:01:09 14:44:06+01:00
PEType: PE32
LinkerVersion: 9
CodeSize: 72704
InitializedDataSize: 25600
UninitializedDataSize: -
EntryPoint: 0xb3c1
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 09-Jan-2012 13:44:06
Detected languages:
  • English - United States
  • Process Default Language
Debug artifacts:
  • d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 09-Jan-2012 13:44:06
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00011A70
0x00011C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.55432
.rdata
0x00013000
0x00001C05
0x00001E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.8666
.data
0x00015000
0x000156FC
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.57792
.CRT
0x0002B000
0x00000010
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.213101
.rsrc
0x0002C000
0x00004110
0x00004200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.07771

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.20816
1464
Latin 1 / Western European
English - United States
RT_MANIFEST
7
3.24143
556
Latin 1 / Western European
English - United States
RT_STRING
8
3.26996
974
Latin 1 / Western European
English - United States
RT_STRING
9
3.04375
530
Latin 1 / Western European
English - United States
RT_STRING
10
3.16254
776
Latin 1 / Western European
English - United States
RT_STRING
11
3.06352
380
Latin 1 / Western European
English - United States
RT_STRING
12
2.33959
102
Latin 1 / Western European
English - United States
RT_STRING
100
1.91924
20
Latin 1 / Western European
Process Default Language
RT_GROUP_ICON
101
4.19099
2998
Latin 1 / Western European
English - United States
RT_BITMAP
ASKNEXTVOL
3.42597
646
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start practicalmalwareanalysis-labs.exe searchprotocolhost.exe no specs PhotoViewer.dll no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2376"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\bluecomment.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
3012"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3188"C:\Users\admin\AppData\Local\Temp\PracticalMalwareAnalysis-Labs.exe" C:\Users\admin\AppData\Local\Temp\PracticalMalwareAnalysis-Labs.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\practicalmalwareanalysis-labs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3220C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 453
Read events
1 389
Write events
58
Delete events
6

Modification events

(PID) Process:(3188) PracticalMalwareAnalysis-Labs.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3188) PracticalMalwareAnalysis-Labs.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3188) PracticalMalwareAnalysis-Labs.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\91\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3188) PracticalMalwareAnalysis-Labs.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\91\52C64B7E
Operation:writeName:@%CommonProgramFiles%\system\wab32res.dll,-10200
Value:
Contains Contact files.
(PID) Process:(3188) PracticalMalwareAnalysis-Labs.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Width
Value:
318
(PID) Process:(3188) PracticalMalwareAnalysis-Labs.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Height
Value:
288
(PID) Process:(3012) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\91\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3012) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\91\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(3220) DllHost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
DllHost.exe
(PID) Process:(3220) DllHost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Photo Viewer\Viewer
Operation:writeName:MainWndPos
Value:
6000000034000000A00400008002000000000000
Executable files
65
Suspicious files
4
Text files
6
Unknown types
4

Dropped files

PID
Process
Filename
Type
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_10L\Lab10-01.exeexecutable
MD5:795F093A536F118FB4C34FCEDFA42165
SHA256:E55CFA92ACC2FAC8B3B41002EBBEF343BFDB61ABF876E9C713F323E143D5E451
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_10L\Lab10-02.exeexecutable
MD5:3F3A29CA2467D2D05FEAC9D233366F45
SHA256:20BF5D516F3F3EF4C9453437211486B73D519FF97D8659851012ADFF8E84E0A9
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_12L\Lab12-01.dllexecutable
MD5:A6FB0D8FDEA1C15AFBA7A5DDB3D2867B
SHA256:0EA89A83B84B8D20E259BACB6B0D1B176C8327F097C54749AE832981F2A0095A
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-03.exeexecutable
MD5:18EC5BECFA3991FB654E105BAFBD5A4B
SHA256:BF023FF344EFE2DB0E0A963869368F0EF352764666BC368AD61B7A4C1D9F5975
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-03.dllexecutable
MD5:BBD65FCAD68E5A3CD1457E2EE05D1F2E
SHA256:F11FA868AC3DEE1E5FBD985FE15BA6D34C7EC0ABB47BABE0D34A35514C49C86A
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-02.dllexecutable
MD5:BE4F4B9E88F2E1B1C38E0A0858EB3DD9
SHA256:DF899256C4A9FC0E550C62B84AB9CB8ACD8D18683F0A41C98BA83F0487D4766E
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_10L\Lab10-01.sysexecutable
MD5:3D3D1A8145E3237183984FAED04E052E
SHA256:D12A2C116A12993CFCF2F432A4FE53F8F6B3686E33ED8F7E8FF4628A37BD616E
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_13L\Lab13-02.exeexecutable
MD5:B65C4D7CBC4069DDBFF665370201E588
SHA256:598F21F1E6F4D5829BA8CFBA19D361E09DE510493DF8472A605F46DBF7927030
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-02.inibinary
MD5:B61964305851A7AB4179067C231B4D97
SHA256:0493C7167AE07704ED41FE4D43333165F3167ACA8547B6F1D2C67592ECCC6FA2
3188PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\PMA\Practical Malware Analysis Labs\BinaryCollection\Chapter_10L\Lab10-03.exeexecutable
MD5:F72D773F13CEB6B842A9D29C56F8880F
SHA256:D66E15EEA51EBD4BFD13F8C97646253740B1E6A99328D22232FD01AE13EF5D05
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PracticalMalwareAnalysis-Labs.exe