download:

NetAddictFree_Install.EXE

Full analysis: https://app.any.run/tasks/7ca20f9e-a847-4b83-8357-92aa9db9b823
Verdict: Malicious activity
Analysis date: January 13, 2020, 07:53:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

13F39FD70C10CB5670C4876EF6EA31D7

SHA1:

E92190DBC748E62F8AF80489996C60578B1CA388

SHA256:

724647C84C4E86E54797453DC3BFBC0B4361CFB56538E63C53616D8751A856F7

SSDEEP:

786432:1NSkQLU2uEhUw8AWd8MKQlczLD3mSyKPzTDY1LsGooh:nT2uEhF8AVQlcCS3Pz3Y9sy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • INSTALL.EXE (PID: 584)
      • WDSetup.EXE (PID: 1904)
      • WDSetup.EXE (PID: 1636)
      • WDCLEAN.EXE (PID: 408)
      • NetworkAdminFolder.exe (PID: 3116)
      • Controle_parental.exe (PID: 836)

    • Loads dropped or rewritten executable

      • WDSetup.EXE (PID: 1904)
      • WDSetup.EXE (PID: 1636)
      • Controle_parental.exe (PID: 836)
      • NetworkAdminFolder.exe (PID: 3116)

    • Changes the autorun value in the registry

      • Controle_parental.exe (PID: 836)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • NetAddictFree_Install.EXE (PID: 4088)
      • INSTALL.EXE (PID: 584)
      • WDSetup.EXE (PID: 1636)

    • Application launched itself

      • WDSetup.EXE (PID: 1904)

    • Creates files in the program directory

      • WDSetup.EXE (PID: 1636)
      • Controle_parental.exe (PID: 836)
      • NetworkAdminFolder.exe (PID: 3116)

    • Creates a software uninstall entry

      • WDSetup.EXE (PID: 1636)

    • Starts application with an unusual extension

      • WDCLEAN.EXE (PID: 408)

    • Creates files in the user directory

      • WDSetup.EXE (PID: 1636)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (46.3)
.exe | Win64 Executable (generic) (41)
.exe | Win32 Executable (generic) (6.6)
.exe | Generic Win/DOS Executable (2.9)
.exe | DOS Executable Generic (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:11:30 11:32:01+01:00
PEType: PE32
LinkerVersion: 7.1
CodeSize: 88064
InitializedDataSize: 123904
UninitializedDataSize: -
EntryPoint: 0x160b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 22.0.2.0
ProductVersionNumber: 22.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: French
CharacterSet: Windows, Latin1
CompanyName: PC SOFT
FileDescription: WDAutoEx.EXE (Executable auto-extractible) - Win32
FileVersion: 22.0.2.0
LegalCopyright: Copyright © PC SOFT 1993-2016
OriginalFileName: WDAutoEx.EXE
Comments: EB Francais
Plateforme: Win32 UNICODE
FileDescriptionUS: WDAutoEx.EXE (Self-extractible archive) - Win32
ProductName: WINDEV
ProductVersion: 22.0 (22.0.2.0) VI xxxxxxxxxxxx
VersionVI: xxxxxxxxxxxx
Version: 22.0.2.0
Checksum: xx

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 30-Nov-2016 10:32:01
Detected languages:
  • English - United States
  • French - France
Debug artifacts:
  • c:\source\source.AV\91330\Release_wdautoex_28\Release\WdAutoEx.pdb
CompanyName: PC SOFT
FileDescription: WDAutoEx.EXE (Executable auto-extractible) - Win32
FileVersion: 22.0.2.0
LegalCopyright: Copyright © PC SOFT 1993-2016
OriginalFilename: WDAutoEx.EXE
Comments: EB Francais
Plateforme: Win32 UNICODE
FileDescriptionUS: WDAutoEx.EXE (Self-extractible archive) - Win32
ProductName: WINDEV
ProductVersion: 22.0 (22.0.2.0) VI xxxxxxxxxxxx
VersionVI: xxxxxxxxxxxx
Version: 22.0.2.0
Checksum: xx

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 30-Nov-2016 10:32:01
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001564A
0x00015800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.60646
.rdata
0x00017000
0x0000754F
0x00007600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.26909
.data
0x0001F000
0x00000530
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.40583
.rsrc
0x00020000
0x00016A98
0x00016C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.03067

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.99496
487
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.04282
9640
Latin 1 / Western European
French - France
RT_ICON
3
5.14795
4264
Latin 1 / Western European
French - France
RT_ICON
4
4.89085
1128
Latin 1 / Western European
French - France
RT_ICON
20
2.87334
202
Latin 1 / Western European
French - France
RT_STRING
21
2.45463
108
Latin 1 / Western European
French - France
RT_STRING
102
2.40454
289
Latin 1 / Western European
French - France
INFOWDZ
103
2.08313
550
Latin 1 / Western European
French - France
INFOWDZ
104
3.44531
664
Latin 1 / Western European
French - France
RT_DIALOG
105
2.65982
62
Latin 1 / Western European
French - France
RT_GROUP_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
MPR.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
ole32.dll

Exports

Title
Ordinal
Address
CommandeComposante
1
0x000071EC
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start netaddictfree_install.exe install.exe wdsetup.exe no specs wdsetup.exe controle_parental.exe wdclean.exe no specs del1207.tmp no specs networkadminfolder.exe

Process information

PID
CMD
Path
Indicators
Parent process
408C:\Users\admin\AppData\Local\Temp\WDCLEAN.EXE 584 C:\Users\admin\AppData\Local\Temp\WDCLEAN.INIC:\Users\admin\AppData\Local\Temp\WDCLEAN.EXE—INSTALL.EXE
User:
admin
Company:
PC SOFT
Integrity Level:
MEDIUM
Description:
WDCLEAN.EXE (Nettoyeur/Cleaning tool) - Win32
Exit code:
0
Version:
22.0.1.0
Modules
Images
c:\users\admin\appdata\local\temp\wdclean.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
584"C:\Users\admin\AppData\Local\Temp\WD_CC05.tmp\INSTALL.EXE" C:\Users\admin\AppData\Local\Temp\WD_CC05.tmp\INSTALL.EXE
NetAddictFree_Install.EXE
User:
admin
Company:
PC SOFT
Integrity Level:
MEDIUM
Description:
INSTALL.EXE (Amorce d'installation) - Win32
Exit code:
0
Version:
22.0.10.0
Modules
Images
c:\users\admin\appdata\local\temp\wd_cc05.tmp\install.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
836"C:\Program Files\Controle_parental\Controle_parental.exe" C:\Program Files\Controle_parental\Controle_parental.exe
WDSetup.EXE
User:
admin
Company:
NetAddictSoft
Integrity Level:
MEDIUM
Description:
Parental Control
Exit code:
0
Version:
9.79.530.0
Modules
Images
c:\program files\controle_parental\controle_parental.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
1636"C:\Users\admin\AppData\Local\Temp\WD_CD8B.tmp\WDSetup.EXE" /IDIPC=374ac1b53938437582de2a8de21de4e2:13546 /NOCHKADMIN /REP="C:\Users\admin\AppData\Local\Temp\WD_CC05.tmp\" /VERSION_PARENT=22 /COMPOSITE=0 C:\Users\admin\AppData\Local\Temp\WD_CD8B.tmp\WDSetup.EXE
WDSetup.EXE
User:
admin
Company:
PC SOFT
Integrity Level:
HIGH
Description:
Outil d'installation
Exit code:
0
Version:
22.0.52.0
Modules
Images
c:\users\admin\appdata\local\temp\wd_cd8b.tmp\wdsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1904"C:\Users\admin\AppData\Local\Temp\WD_CD8B.tmp\WDSetup.EXE" /REP="C:\Users\admin\AppData\Local\Temp\WD_CC05.tmp\" /VERSION_PARENT=22 /COMPOSITE=0 C:\Users\admin\AppData\Local\Temp\WD_CD8B.tmp\WDSetup.EXE—INSTALL.EXE
User:
admin
Company:
PC SOFT
Integrity Level:
MEDIUM
Description:
Outil d'installation
Exit code:
0
Version:
22.0.52.0
Modules
Images
c:\users\admin\appdata\local\temp\wd_cd8b.tmp\wdsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3116"C:\Program Files\Controle_parental\NetworkAdminFolder.exe"C:\Program Files\Controle_parental\NetworkAdminFolder.exe
Controle_parental.exe
User:
admin
Company:
NetAddictSoft
Integrity Level:
MEDIUM
Description:
NetworkAdminFolder
Exit code:
0
Version:
9.79.369.0
Modules
Images
c:\program files\controle_parental\networkadminfolder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3972"C:\Users\admin\AppData\Local\Temp\DEL1207.tmp" 100 "C:\Users\admin\AppData\Local\Temp\WDCLEAN.EXE" /COPIEC:\Users\admin\AppData\Local\Temp\DEL1207.tmp—WDCLEAN.EXE
User:
admin
Company:
PC SOFT
Integrity Level:
MEDIUM
Description:
WDCLEAN.EXE (Nettoyeur/Cleaning tool) - Win32
Exit code:
0
Version:
22.0.1.0
Modules
Images
c:\users\admin\appdata\local\temp\del1207.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4088"C:\Users\admin\AppData\Local\Temp\NetAddictFree_Install.EXE" C:\Users\admin\AppData\Local\Temp\NetAddictFree_Install.EXE
explorer.exe
User:
admin
Company:
PC SOFT
Integrity Level:
MEDIUM
Description:
WDAutoEx.EXE (Executable auto-extractible) - Win32
Exit code:
0
Version:
22.0.2.0
Modules
Images
c:\users\admin\appdata\local\temp\netaddictfree_install.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
Total events
1 464
Read events
1 265
Write events
199
Delete events
0

Modification events

(PID) Process:(4088) NetAddictFree_Install.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(4088) NetAddictFree_Install.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(584) INSTALL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(584) INSTALL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1904) WDSetup.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1904) WDSetup.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1636) WDSetup.EXEKey:HKEY_USERS\.DEFAULT\Control Panel\Desktop
Operation:writeName:WaitToKillAppTimeout
Value:
1000
(PID) Process:(1636) WDSetup.EXEKey:HKEY_USERS\.DEFAULT\Control Panel\Desktop
Operation:writeName:HungAppTimeout
Value:
1000
(PID) Process:(1636) WDSetup.EXEKey:HKEY_USERS\.DEFAULT\Control Panel\Desktop
Operation:writeName:AutoEndTasks
Value:
1
(PID) Process:(1636) WDSetup.EXEKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WaitToKillAppTimeout
Value:
1000
Executable files
77
Suspicious files
21
Text files
451
Unknown types
21

Dropped files

PID
Process
Filename
Type
4088NetAddictFree_Install.EXEC:\Users\admin\AppData\Local\Temp\WD_CC05.tmp\_FRAMEWORK.7z —
MD5:—
SHA256:—
4088NetAddictFree_Install.EXEC:\Users\admin\AppData\Local\Temp\WD_CC05.tmp\__WDINST.7zcompressed
MD5:—
SHA256:—
4088NetAddictFree_Install.EXEC:\Users\admin\AppData\Local\Temp\WD_CC05.tmp\INSTALL.EXEexecutable
MD5:—
SHA256:—
4088NetAddictFree_Install.EXEC:\Users\admin\AppData\Local\Temp\WD_CC05.tmp\INSTALL.ZIPcompressed
MD5:—
SHA256:—
4088NetAddictFree_Install.EXEC:\Users\admin\AppData\Local\Temp\WD_CC05.tmp\WDCLEAN.EXEexecutable
MD5:—
SHA256:—
584INSTALL.EXEC:\Users\admin\AppData\Local\Temp\WD_CD8B.tmp\WDSetup.EXEexecutable
MD5:—
SHA256:—
584INSTALL.EXEC:\Users\admin\AppData\Local\Temp\WD_CD8B.tmp\wd220vm.dllexecutable
MD5:—
SHA256:—
584INSTALL.EXEC:\Users\admin\AppData\Local\Temp\WD_CD8B.tmp\NETADDICTFREELOGO.JPGimage
MD5:—
SHA256:—
584INSTALL.EXEC:\Users\admin\AppData\Local\Temp\WD_CD8B.tmp\INST.WXFtxt
MD5:—
SHA256:—
584INSTALL.EXEC:\Users\admin\AppData\Local\Temp\WD_CD8B.tmp\__GABARIT.ZIPcompressed
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3116
NetworkAdminFolder.exe
GET
200
213.186.33.69:80
http://nafremote.com/FR/Synchro_GET_MOTS_CLES.php?P1=Proc_Traite_erreurReindex
FR
—
—
malicious
3116
NetworkAdminFolder.exe
GET
200
213.186.33.69:80
http://nafremote.com/FR/Synchro_GET_MOTS_CLES.php?P1=Proc_Traite_erreurHF
FR
text
1.46 Kb
malicious
3116
NetworkAdminFolder.exe
GET
200
213.186.33.69:80
http://nafremote.com/FR/Synchro_GET_MOTS_CLES.php?P1=Proc_Traite_erreurFatale
FR
text
1.65 Kb
malicious
3116
NetworkAdminFolder.exe
GET
200
213.186.33.69:80
http://nafremote.com/FR/PAGE_Synchro_Verif.php?P1=1@1.ru&P2=USER-PC&P3=admin&P4=2020-01-13%252007:54:45&P5=BASIC9.79&P6=0;0;0;0;0;0;0;&P7=0;0;0;0;0;0;0;&P8=0&P9=0&P10=0&P11=7&P12=0&P13=0&P14=111&P15=&P16=;&P17=0&P18=0&P19=&P20=&P21=3&P22=0&P23=0&P24=0&P25=0&P26=0&P27=0&P28=0&P29=0&P30=0
FR
html
2.87 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3116
NetworkAdminFolder.exe
213.186.33.69:80
nafremote.com
OVH SAS
FR
malicious

DNS requests

Domain
IP
Reputation
nafremote.com
  • 213.186.33.69
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NetAddictFree_Install.EXE