analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Dork Searcher EZ by VoidPrince.rar

Full analysis: https://app.any.run/tasks/c3c0e30c-8d63-46ba-a7ce-07d4c3ecfcf9
Verdict: Suspicious activity
Analysis date: January 14, 2020, 12:55:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

D6B94CAEB36B37010765ED878F834863

SHA1:

79AF739BFDE5F1930470DADC5DE28C97193E2278

SHA256:

7CDB5FDE86E5C12BEF81C54005C078DFEBDD19483D56031BC7DA5E9FC019652A

SSDEEP:

98304:7Rcr5A6I7SZrCA9aIv3oL7zd6KekcMs3eceAhZtgxoij+rVDFqe09bbPBMQ6f0BK:ir5t3Da6udSRmAhvesEbbn6f0zIfaLmb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Searcher.exe (PID: 3960)

    • Loads dropped or rewritten executable

      • Searcher.exe (PID: 3960)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1948)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe searcher.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1948"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Dork Searcher EZ by VoidPrince.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3960"C:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Searcher.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Searcher.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Searcher
Version:
4.2.2.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1948.8267\dork searcher ez by voidprince\searcher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
493
Read events
477
Write events
16
Delete events
0

Modification events

(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1948) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Dork Searcher EZ by VoidPrince.rar
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
13
Suspicious files
2
Text files
6
Unknown types
4

Dropped files

PID
Process
Filename
Type
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Key.txttext
MD5:69E41005F04DEF3F58DE7A087993C416
SHA256:C70E0FB02B2E232A88812A77CC8628BE077DA4593B86C968D8538E4FBB898B11
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Newtonsoft.Json.dllexecutable
MD5:C53737821B861D454D5248034C3C097C
SHA256:575E30F98E4EA42C9E516EDC8BBB29AD8B50B173A3E6B36B5BA39E133CCE9406
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\System.Data.SQLite.Linq.dllexecutable
MD5:0FA3A80CE77A716AF650173656E37404
SHA256:2859ED64F5D0A430E726253B2F4258AD53B8EBD41A61AD0537104C5C86E3E7BB
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\blacktext
MD5:8F161398F61DCEE24D2F3284F4DB1D0C
SHA256:0DFAE6BF57B4F5DD68896C3DF7E7110B380DBBC8BA69D8372455027E15AFBD9A
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\EntityFramework.dllexecutable
MD5:470BE89A6DB2444175461B54AD00EC72
SHA256:A963696A7C3C3424A566644900FEC5528D0CF1BD66033A0E2D36B6E4882A7D3A
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\mes.dattext
MD5:AD86B0700A8A522111743BB48298A304
SHA256:D92B9B8FAD1E11B3A62063CE0CC73BDC4FAD214B6CEB247086588BF1E10F767D
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\Setting.dattext
MD5:4E67A003766F07388A7023EAE7AD4952
SHA256:A70DD83772D968CF0BDD5F14FAE030EDDCF2C46731CC41BAF4B85B172422AE71
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\AntiPublic\link.dbsqlite
MD5:AECECEE2C7B44FA2EEE601469AA374AB
SHA256:2AFF4F903986614C4E535D8D38BFC93EFC353DC4A9846D386EFC9521C95BFA68
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\War.dllexecutable
MD5:B06AB846E14C6DFE0FBD20BA0E62E56B
SHA256:76ED40D5774A0167E2A111E7A4E90D346AED800C38E4980BF38D9E3DEADB14E8
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1948.8267\Dork Searcher EZ by VoidPrince\System.Data.SQLite.dllexecutable
MD5:7C680B024E667410C463AE38A92F8621
SHA256:ED8A3599BE994C4BA948932332610F59069996DF47478B569790984871E0A4F5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Dork Searcher EZ by VoidPrince.rar