download: | boost-speed-setup.exe |
Full analysis: | https://app.any.run/tasks/f9f9350c-908d-437b-bf3b-e5318d4f5c2d |
Verdict: | Malicious activity |
Analysis date: | November 16, 2019, 10:44:39 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 216DBD252F6B6070CFAD9DBDF6538821 |
SHA1: | DA3A10C68DDD044FABF9E26C27A2E789F4CAF4B9 |
SHA256: | 7CD3896E267DCC1157C8FF705426F770E41E7753563DFF9E6003999EABB85A88 |
SSDEEP: | 393216:J5oCTAcvSiO39D1fpjFbiY+532mm8I7XdVADC7vPXjSW5OCZRuUPY20wCsDLI4p7:pEND1xpBbD8I7NV1PzX0iXPGqD7 |
.exe | | | Win32 Executable (generic) (42.6) |
---|---|---|
.exe | | | Win16/32 Executable Delphi generic (19.5) |
.exe | | | Generic Win/DOS Executable (18.9) |
.exe | | | DOS Executable Generic (18.9) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2016:04:06 16:39:04+02:00 |
PEType: | PE32 |
LinkerVersion: | 2.25 |
CodeSize: | 66560 |
InitializedDataSize: | 438272 |
UninitializedDataSize: | - |
EntryPoint: | 0x117dc |
OSVersion: | 5 |
ImageVersion: | 6 |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
FileVersionNumber: | 11.2.0.2 |
ProductVersionNumber: | 11.2.0.2 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | Neutral |
CharacterSet: | Unicode |
Comments: | This installation was built with Inno Setup. |
CompanyName: | Auslogics |
FileDescription: | Auslogics BoostSpeed Installation File |
FileVersion: | 11.x |
LegalCopyright: | Copyright © 2008-2019 Auslogics Labs Pty Ltd |
ProductName: | Auslogics BoostSpeed |
ProductVersion: | 11.2.0.2 |
OriginalFileName: | boost-speed-setup.exe |
InternalName: | boost-speed-setup |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 06-Apr-2016 14:39:04 |
Detected languages: |
|
Comments: | This installation was built with Inno Setup. |
CompanyName: | Auslogics |
FileDescription: | Auslogics BoostSpeed Installation File |
FileVersion: | 11.x |
LegalCopyright: | Copyright © 2008-2019 Auslogics Labs Pty Ltd |
ProductName: | Auslogics BoostSpeed |
ProductVersion: | 11.2.0.2 |
OriginalFilename: | boost-speed-setup.exe |
InternalName: | boost-speed-setup |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 8 |
Time date stamp: | 06-Apr-2016 14:39:04 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0000F244 | 0x0000F400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.37521 |
.itext | 0x00011000 | 0x00000F64 | 0x00001000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.7322 |
.data | 0x00012000 | 0x00000C88 | 0x00000E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.29672 |
.bss | 0x00013000 | 0x000056BC | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x00019000 | 0x00000E04 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.59781 |
.tls | 0x0001A000 | 0x00000008 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x0001B000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.204488 |
.rsrc | 0x0001C000 | 0x00068F68 | 0x00069000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.46286 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.13965 | 1580 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 6.04236 | 1720 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 5.92044 | 2440 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 6.43388 | 2848 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 6.30676 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 6.40418 | 4936 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 6.37889 | 6760 | Latin 1 / Western European | English - United States | RT_ICON |
8 | 6.33423 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
9 | 6.39285 | 16936 | Latin 1 / Western European | English - United States | RT_ICON |
10 | 6.35555 | 67624 | Latin 1 / Western European | English - United States | RT_ICON |
advapi32.dll |
comctl32.dll |
kernel32.dll |
oleaut32.dll |
user32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2080 | "C:\Users\admin\Desktop\boost-speed-setup.exe" | C:\Users\admin\Desktop\boost-speed-setup.exe | explorer.exe | ||||||||||||
User: admin Company: Auslogics Integrity Level: MEDIUM Description: Auslogics BoostSpeed Installation File Exit code: 0 Version: 11.x Modules
| |||||||||||||||
3888 | "C:\Users\admin\AppData\Local\Temp\is-Q9E58.tmp\boost-speed-setup.tmp" /SL5="$5012C,26574312,505856,C:\Users\admin\Desktop\boost-speed-setup.exe" | C:\Users\admin\AppData\Local\Temp\is-Q9E58.tmp\boost-speed-setup.tmp | — | boost-speed-setup.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
2512 | "C:\Users\admin\Desktop\boost-speed-setup.exe" /SPAWNWND=$40126 /NOTIFYWND=$5012C | C:\Users\admin\Desktop\boost-speed-setup.exe | boost-speed-setup.tmp | ||||||||||||
User: admin Company: Auslogics Integrity Level: HIGH Description: Auslogics BoostSpeed Installation File Exit code: 0 Version: 11.x Modules
| |||||||||||||||
2344 | "C:\Users\admin\AppData\Local\Temp\is-H7QCA.tmp\boost-speed-setup.tmp" /SL5="$40136,26574312,505856,C:\Users\admin\Desktop\boost-speed-setup.exe" /SPAWNWND=$40126 /NOTIFYWND=$5012C | C:\Users\admin\AppData\Local\Temp\is-H7QCA.tmp\boost-speed-setup.tmp | boost-speed-setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
2492 | "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Auslogics\BoostSpeed\DiskDoctorChecker.x32.dll" | C:\Windows\system32\regsvr32.exe | — | boost-speed-setup.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1952 | "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Auslogics\BoostSpeed\TaskManagerHelper.Agent.x32.dll" | C:\Windows\system32\regsvr32.exe | — | boost-speed-setup.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3876 | "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Auslogics\BoostSpeed\BrowserPluginsHelper.Agent.x32.dll" | C:\Windows\system32\regsvr32.exe | — | boost-speed-setup.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3732 | "C:\Program Files\Auslogics\BoostSpeed\Integrator.exe" /install /setscheduledefault /setautostart | C:\Program Files\Auslogics\BoostSpeed\Integrator.exe | boost-speed-setup.tmp | ||||||||||||
User: admin Company: Auslogics Integrity Level: HIGH Description: BoostSpeed Exit code: 0 Version: 11.2.0.2 Modules
| |||||||||||||||
2508 | "C:\Program Files\Auslogics\BoostSpeed\DiskDefrag.exe" /install | C:\Program Files\Auslogics\BoostSpeed\DiskDefrag.exe | — | boost-speed-setup.tmp | |||||||||||
User: admin Company: Auslogics Integrity Level: HIGH Description: Disk Defrag Exit code: 0 Version: 11.2.0.2 Modules
| |||||||||||||||
2472 | "C:\Program Files\Auslogics\BoostSpeed\Integrator.exe" /FromInstall | C:\Program Files\Auslogics\BoostSpeed\Integrator.exe | boost-speed-setup.tmp | ||||||||||||
User: admin Company: Auslogics Integrity Level: HIGH Description: BoostSpeed Version: 11.2.0.2 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2344 | boost-speed-setup.tmp | C:\Users\admin\AppData\Local\Temp\is-57S73.tmp\CFAHelper.dll | executable | |
MD5:5026291C239E430DF29BB309AB8D7582 | SHA256:9DE4DFA8048A04499B9621431BA85F4E26447F89DA6200F24AB4DE47D216F86F | |||
2512 | boost-speed-setup.exe | C:\Users\admin\AppData\Local\Temp\is-H7QCA.tmp\boost-speed-setup.tmp | executable | |
MD5:D888C2ACFAE2AE00ABE6B5FD9C08ACA2 | SHA256:9A137027142CC1636602EF7435343CE1E6E1925208F5BF6915503767973068AE | |||
2344 | boost-speed-setup.tmp | C:\Users\admin\AppData\Local\Temp\is-57S73.tmp\fra.lng | binary | |
MD5:EF9E5724564C0F7BFF99055F7044EED0 | SHA256:55100F93CF651DC0792FA386EE00084E59B8852FC33D57244910D1A0BD40C594 | |||
2344 | boost-speed-setup.tmp | C:\Users\admin\AppData\Local\Temp\is-57S73.tmp\BrowserHelper.dll | executable | |
MD5:D16EC91386C16315CE0F472189B31DF7 | SHA256:28F0EFB0E9B391E59AB9060060E4172FB8CEBBD35C304C2E93EAF665B1D91699 | |||
2080 | boost-speed-setup.exe | C:\Users\admin\AppData\Local\Temp\is-Q9E58.tmp\boost-speed-setup.tmp | executable | |
MD5:D888C2ACFAE2AE00ABE6B5FD9C08ACA2 | SHA256:9A137027142CC1636602EF7435343CE1E6E1925208F5BF6915503767973068AE | |||
2344 | boost-speed-setup.tmp | C:\Users\admin\AppData\Local\Temp\is-57S73.tmp\SetupCustom.dll | executable | |
MD5:5460FB8C451125EF43D9AD1E9C1E81F5 | SHA256:1E151E8F4A4FB4ED429C7569B23A1840BFD5CDD4C76A1C5B5EF8DE6D0DC3498C | |||
2344 | boost-speed-setup.tmp | C:\Users\admin\AppData\Local\Temp\is-57S73.tmp\sqlite3.dll | executable | |
MD5:9CBC0FBF86BF517D06408DBDE3E6D8CF | SHA256:E9C161E318CD9E7B9382580C6CFEA3EBD0E1B99C4A464B80E76AC8DFCCD4A44E | |||
2344 | boost-speed-setup.tmp | C:\Users\admin\AppData\Local\Temp\is-57S73.tmp\CommonForms.Site.dll | executable | |
MD5:56A741EB7310A5B1ECA2000DC008F987 | SHA256:D7495719F774E3B59C2F806BECA7B504A8F0A1A7055BCB2917D777644E635760 | |||
2344 | boost-speed-setup.tmp | C:\Users\admin\AppData\Local\Temp\is-57S73.tmp\AxComponentsRTL.bpl | executable | |
MD5:023C1AD5A3A996D38D8BE853E5933577 | SHA256:9877CE414937EBBA831E9D1C2B05D1DD63C138AD4A68F9647524C30F6F3E39B8 | |||
2344 | boost-speed-setup.tmp | C:\Users\admin\AppData\Local\Temp\is-57S73.tmp\enu.lng | binary | |
MD5:F778C6AB286CE52179863D47D4456D86 | SHA256:19F7FE9B2C8227330E9C2F3A1412FB543947880C8953ED71C84E0B790CDAE567 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2472 | Integrator.exe | HEAD | 200 | 45.33.8.241:80 | http://ads.auslogics.com/uploads/6ff90f947de7860380fc36999d560096.png | US | — | — | whitelisted |
— | — | GET | 200 | 143.204.222.58:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
— | — | GET | 200 | 13.32.211.227:80 | http://x.ss2.us/x.cer | US | der | 1.27 Kb | whitelisted |
— | — | GET | 200 | 143.204.222.82:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D | US | der | 1.39 Kb | shared |
2472 | Integrator.exe | HEAD | 200 | 45.33.8.241:80 | http://ads.auslogics.com/uploads/41805583d966a7122b2997becbfb0ad6.png | US | — | — | whitelisted |
3464 | tabdashboard.exe | HEAD | 200 | 45.33.8.241:80 | http://ads.auslogics.com/uploads/bf11d4822c024e6783715b218ffff527.png | US | — | — | whitelisted |
3464 | tabdashboard.exe | HEAD | 200 | 45.33.8.241:80 | http://ads.auslogics.com/uploads/83bb8664bcbba05a69bb303e82a55175.png | US | — | — | whitelisted |
3464 | tabdashboard.exe | HEAD | 200 | 45.33.8.241:80 | http://ads.auslogics.com/uploads/179b7e32b1d1cad171f837d5fab6c5ee.png | US | — | — | whitelisted |
— | — | GET | 200 | 143.204.222.156:80 | http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D | US | der | 1.51 Kb | whitelisted |
— | — | GET | 200 | 13.225.30.150:80 | http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA4vBMJJxPg6SKCVbxEbKkA%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2344 | boost-speed-setup.tmp | 216.58.205.238:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
3732 | Integrator.exe | 216.58.205.238:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
2344 | boost-speed-setup.tmp | 45.33.8.241:443 | www.auslogics.com | Linode, LLC | US | malicious |
2472 | Integrator.exe | 3.223.118.140:443 | abs.aslgics.com | — | US | unknown |
— | — | 143.204.222.58:80 | o.ss2.us | — | US | unknown |
— | — | 205.185.216.42:80 | www.download.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
— | — | 13.32.211.227:80 | x.ss2.us | Amazon.com, Inc. | US | unknown |
— | — | 143.204.222.156:80 | ocsp.rootg2.amazontrust.com | — | US | whitelisted |
2472 | Integrator.exe | 45.33.8.241:80 | www.auslogics.com | Linode, LLC | US | malicious |
— | — | 143.204.222.82:80 | ocsp.rootg2.amazontrust.com | — | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.google-analytics.com |
| whitelisted |
www.auslogics.com |
| whitelisted |
abs.aslgics.com |
| unknown |
x.ss2.us |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |
o.ss2.us |
| whitelisted |
ocsp.rootg2.amazontrust.com |
| whitelisted |
ocsp.rootca1.amazontrust.com |
| shared |
ocsp.sca1b.amazontrust.com |
| whitelisted |
ads.auslogics.com |
| whitelisted |