File name: | DRevitalize.exe |
Full analysis: | https://app.any.run/tasks/635d86ff-ae15-4106-b976-5abca9536c6e |
Verdict: | Malicious activity |
Analysis date: | January 18, 2020, 08:29:52 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | FA5CB62A89496AC8E246E927C3766D95 |
SHA1: | 50ADF6F5AA1F4F5B0894BD17D0F92824B8E8187F |
SHA256: | 731BB15DD77FBE59626C880CB9356502873AC78179B3C8CF74A9832A0E4047E2 |
SSDEEP: | 24:etGSI/t6dzHaIlvFUGoAZKIQ+XSBjeoH:6muz6YvGG5ZZCBCo |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.3) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x1000 |
UninitializedDataSize: | - |
InitializedDataSize: | 512 |
CodeSize: | 512 |
LinkerVersion: | 2.5 |
PEType: | PE32 |
TimeStamp: | 2017:11:14 18:55:30+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 14-Nov-2017 17:55:30 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 2 |
Time date stamp: | 14-Nov-2017 17:55:30 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000000E2 | 0x00000200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 2.36734 |
.data | 0x00002000 | 0x000001CA | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.475 |
kernel32.dll |
user32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
592 | "C:\Users\admin\Desktop\DRevitalize.exe" | C:\Users\admin\Desktop\DRevitalize.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1916 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3176 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1916 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3000 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131 | ||||
1024 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 68.0.1 | ||||
1956 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 68.0.1 | ||||
1316 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.0.41305597\317599886" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 1168 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 68.0.1 | ||||
3768 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.3.1428846346\487619112" -childID 1 -isForBrowser -prefsHandle 1560 -prefMapHandle 780 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 1716 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 | ||||
3288 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.13.244926003\1546649967" -childID 2 -isForBrowser -prefsHandle 2840 -prefMapHandle 2844 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 2856 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 | ||||
2076 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.20.1759854431\1056667937" -childID 3 -isForBrowser -prefsHandle 3756 -prefMapHandle 3760 -prefsLen 7301 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 3772 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1916 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
1916 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:0ADC32C4DB39528CE919761189F1F815 | SHA256:B5E888240E22D25BC5C2C81605304CEF307A52EB48991597CB35990855F8278B | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TDRYHRER\jquery.mCustomScrollbar[1].js | text | |
MD5:0E1C7C9F7D9C852EA3B2542698F64884 | SHA256:4AB2F5F91961EFEB34D9544498EF6CF1E96ED07651207762BC552454CC88410B | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D89EQNTJ\jquery-ui-1.8.21.custom[1].css | text | |
MD5:B101E1A8239663E1EC310D94446E7935 | SHA256:61818DFBC85C3AB5C86B01C6821A657A94B2EDD4FA6D27F78BAD7FE7901203BA | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZXOQXJVX\new[1].css | text | |
MD5:CB745D6051B36B7D003706F0FA77F44E | SHA256:0ED9B7B906A18B90BC584FA7104D36D504F17A75B40B2EECE2A9938B169DE91B | |||
1916 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\StructuredQuery.log | text | |
MD5:EE129E3340A54A1E917A7A033E1FC62A | SHA256:B7427E0CE7D7FC4F56DF1F12FB81CBE6459BBC91B3EF9CC5845BBBD2E673CCDD | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:FD70CC3B5366844E7EF43221AE8AB6BC | SHA256:44CC84F99DA044FDA88C15B5412B23A8ACC8F9A526855F114227D5A330ABB2AD | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0G5YO6YK\jquery.bxslider[1].css | text | |
MD5:2D56AEAC8E65EAA35A26663F072D478D | SHA256:7D790DE8C9AFCB94529CD7590874D559344E89A43E59DF13F2428F84443FEA0A | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0G5YO6YK\jquery.notification[1].js | text | |
MD5:27F5A2CE6D9B01A639922A14AE979F8A | SHA256:45A9E34652F48773195FE2F44AE358D28C36F6EC4B5971DB7276D5BD464060DC |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3176 | iexplore.exe | GET | — | 64.62.194.28:80 | http://cdn01.foxitsoftware.com/product/reader/desktop/win/9.7.1/C3DE0FFDF926B5E670543028BF47B076/FoxitReader971_L10N_Setup_Prom.exe | US | — | — | suspicious |
1956 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 172.217.22.67:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
1956 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://status.rapidssl.com/ | US | der | 471 b | shared |
1956 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://status.rapidssl.com/ | US | der | 471 b | shared |
1956 | firefox.exe | POST | 200 | 172.217.22.67:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
1916 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
1956 | firefox.exe | GET | 200 | 2.16.186.50:80 | http://detectportal.firefox.com/success.txt | unknown | text | 8 b | whitelisted |
1956 | firefox.exe | POST | 200 | 172.217.22.67:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3176 | iexplore.exe | 216.58.208.34:443 | www.googletagservices.com | Google Inc. | US | whitelisted |
3176 | iexplore.exe | 93.158.134.119:443 | mc.yandex.ru | YANDEX LLC | RU | whitelisted |
3176 | iexplore.exe | 172.217.18.174:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
1916 | iexplore.exe | 176.99.128.18:443 | dropmefiles.com | Inetcom LLC | RU | suspicious |
1956 | firefox.exe | 2.16.186.50:80 | detectportal.firefox.com | Akamai International B.V. | — | whitelisted |
3176 | iexplore.exe | 74.125.206.156:443 | stats.g.doubleclick.net | Google Inc. | US | whitelisted |
1916 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1956 | firefox.exe | 52.35.182.58:443 | search.services.mozilla.com | Amazon.com, Inc. | US | unknown |
3176 | iexplore.exe | 64.62.194.28:80 | cdn01.foxitsoftware.com | Hurricane Electric, Inc. | US | suspicious |
1956 | firefox.exe | 54.186.97.86:443 | push.services.mozilla.com | Amazon.com, Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
cdn01.foxitsoftware.com |
| suspicious |
dropmefiles.com |
| whitelisted |
www.googletagservices.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
mc.yandex.ru |
| whitelisted |
stats.g.doubleclick.net |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
a1089.dscd.akamai.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3176 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
— | — | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |
— | — | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |