analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

exiftool.exe

Full analysis: https://app.any.run/tasks/dada286c-a424-4968-93f3-56922c759f85
Verdict: Malicious activity
Analysis date: December 14, 2018, 19:47:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

80279A724F7AB594A385B0FC2358EB4A

SHA1:

61CC42982ED84E809E64B1D2769D9CD3FBA3002A

SHA256:

7C6FC5911FC69A33F9D5067B275C1A72AB1FEB59C81593A6AA27D8AC05670B28

SSDEEP:

196608:rhT227p+VDtj4Z/X8SxFC/KnfzNg1mPvKQ2jptOjt6W4vkltTQa97GXmm/zokyf3:7JhltTQa97GXNBruCwZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • exiftool.exe (PID: 2700)

    • Application was dropped or rewritten from another process

      • exiftool.exe (PID: 2700)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • exiftool.exe (PID: 3848)
      • exiftool.exe (PID: 2700)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2496)

    • Starts CMD.EXE for commands execution

      • exiftool.exe (PID: 2700)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • exiftool.exe (PID: 2700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.1)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:11:11 17:04:47+01:00
PEType: PE32
LinkerVersion: 2.23
CodeSize: 16896
InitializedDataSize: 2024960
UninitializedDataSize: 34304
EntryPoint: 0x14e0
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 10.6.1.0
ProductVersionNumber: 10.6.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: -
FileDescription: -
FileVersion: 10.6.1.0
InternalName: exiftool.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: exiftool.exe
ProductName: -
ProductVersion: 10.6.1.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 11-Nov-2016 16:04:47
Detected languages:
  • English - United States
TLS Callbacks: 2 callback(s) detected.
CompanyName: -
FileDescription: -
FileVersion: 10.6.1.0
InternalName: exiftool.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFilename: exiftool.exe
ProductName: -
ProductVersion: 10.6.1.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 11-Nov-2016 16:04:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00004164
0x00004200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.33156
.data
0x00006000
0x001E6A48
0x001E6C00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.10105
.rdata
0x001ED000
0x000005F0
0x00000600
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.39957
.bss
0x001EE000
0x0000840C
0x00000000
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x001F7000
0x00000928
0x00000A00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.76085
.CRT
0x001F8000
0x00000034
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.24913
.tls
0x001F9000
0x00000020
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.22482
.rsrc
0x001FA000
0x000023F0
0x00002400
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.4412

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.94733
830
UNKNOWN
English - United States
RT_MANIFEST
2
6.19723
2216
UNKNOWN
English - United States
RT_ICON
3
2.96054
1384
UNKNOWN
English - United States
RT_ICON
4
6.19723
2216
UNKNOWN
English - United States
RT_ICON
WINEXE
2.48614
62
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
msvcrt.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start exiftool.exe exiftool.exe cmd.exe no specs more.com no specs

Process information

PID
CMD
Path
Indicators
Parent process
3848"C:\Users\admin\AppData\Local\Temp\exiftool.exe" C:\Users\admin\AppData\Local\Temp\exiftool.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
10.6.1.0
2700C:\Users\admin\AppData\Local\Temp\exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\exiftool.exe
exiftool.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
2496cmd.exe /x/d/c "more < "C:\Users\admin\AppData\Local\Temp\par-61646d696e\\exiftool_doc.txt""C:\Windows\system32\cmd.exe—exiftool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2728more C:\Windows\system32\more.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
6
Read events
6
Write events
0
Delete events
0

Modification events

No data
Executable files
40
Suspicious files
0
Text files
897
Unknown types
0

Dropped files

PID
Process
Filename
Type
2700exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\8b4e2b00.dllexecutable
MD5:707F6CD0BA39238095A7CA6925708223
SHA256:FA2960FE31C5DC687D11A93C22DDF03BE20714E7EE038BCEB54EC035CAC086A5
2700exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\a09139d7.dllexecutable
MD5:3B6B94455B45924FA688ECAD75EC182C
SHA256:D3FECA741DDC93F8646E74740BAB7DB17569A7A2594A8FFEA40A73F07B418870
2700exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\7f720997.dllexecutable
MD5:F7992DB1F844A2D9C263C2627BB8A945
SHA256:5CC5AB3445E73175471EDAA84984B3C94DD638877E585DFF084829AC27D78DC3
2700exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\e5acedbf.dllexecutable
MD5:8AB3CDA349CB7B08D5B072587AE2721F
SHA256:26F03B8D47D94A478728EFD0DEBB1F90C8CEFDC25AF54B8D624BF2848E2784C6
2700exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\9e2b3cdd.dllexecutable
MD5:A532ADE5F427A88EADA72EBAD34801A4
SHA256:A8346E9C165D21A9A99313D32C3704DCAAB01F142C3BE0FBC0DEDD39756E3BD5
2700exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\4026afd7.pmtext
MD5:3148B2AE512047849FA6299881F40272
SHA256:2572836037A10B70CAB41DBC4467D284AC5969AEF7E6D2FE02F9467D14FDECB1
2700exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\17d23068.pmtext
MD5:C5E041CA85C3220A127B1800DAC52B42
SHA256:F6EA00190AFC89445065D6C3D66D6B0C257C460294B2B743CEAFC2C89B2620AB
2700exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\349957b9.pmtext
MD5:089971C080D38FF3A2E14F1F2A2D1C33
SHA256:BD51792E348BA19142700D4FC6A04E8CE7A74240C51A8A45291A3DFDC6CB0A8F
3848exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\perl524.dllexecutable
MD5:8C356C17C26109175105543EF9289C3A
SHA256:E7BB8D0C256FFD88D050620D3817EA1699CA4EFAD5D3B4904A854EE88985104C
2700exiftool.exeC:\Users\admin\AppData\Local\Temp\par-61646d696e\cache-exiftool-10.61\0b174c5f.dllexecutable
MD5:00056C438CC32A03F2D924119E3C40BE
SHA256:C665128E6271484B54B9870D64BB3B3C147646DD245F2FAB9911333BED178C6D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
exiftool.exe