File name: | primus.exe |
Full analysis: | https://app.any.run/tasks/7e2ea2be-541b-47cc-b6cb-cbfffff2e591 |
Verdict: | Malicious activity |
Analysis date: | April 23, 2019, 13:18:14 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
MD5: | 06C8582542C38B38ED2DB672868DE8AA |
SHA1: | 0C2C4B7F4E35170B4C8D749CADA3200E901F7108 |
SHA256: | 7FB015F1DBD8DDB3EA6F1BAB82746F00B5756D24335DA8B541D3874648D222CA |
SSDEEP: | 49152:oh/12ZwmDT6B5cfD2aOA6MLZnWbqfl25B6EQOX1oHKHFlVEHWW:A/0v6B5sS260ZWM06EQOFJveHWW |
.exe | | | UPX compressed Win32 Executable (71.8) |
---|---|---|
.exe | | | Win32 Executable (generic) (11.9) |
.exe | | | Win16/32 Executable Delphi generic (5.5) |
.exe | | | Generic Win/DOS Executable (5.3) |
.exe | | | DOS Executable Generic (5.3) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2019:04:23 08:42:37+02:00 |
PEType: | PE32 |
LinkerVersion: | 2.25 |
CodeSize: | 2617344 |
InitializedDataSize: | 77824 |
UninitializedDataSize: | 6881280 |
EntryPoint: | 0x90f740 |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
FileVersionNumber: | 2.0.0.3 |
ProductVersionNumber: | 1.0.0.0 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Windows, Latin1 |
FileDescription: | primus |
FileVersion: | 2.0.0.3 |
ProgramID: | com.embarcadero.primus |
ProductName: | primus |
ProductVersion: | 1.0.0.0 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 23-Apr-2019 06:42:37 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 23-Apr-2019 06:42:37 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x00690000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x00691000 | 0x0027F000 | 0x0027EC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.93046 |
.rsrc | 0x00910000 | 0x00013000 | 0x00012C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.25292 |
KERNEL32.DLL |
SHFolder.dll |
advapi32.dll |
comctl32.dll |
gdi32.dll |
msvcrt.dll |
netapi32.dll |
ole32.dll |
oleaut32.dll |
shell32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2560 | "C:\Users\admin\AppData\Local\Temp\primus.exe" | C:\Users\admin\AppData\Local\Temp\primus.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Description: primus Exit code: 3221226540 Version: 2.0.0.3 | ||||
2832 | "C:\Users\admin\AppData\Local\Temp\primus.exe" | C:\Users\admin\AppData\Local\Temp\primus.exe | explorer.exe | |
User: admin Integrity Level: HIGH Description: primus Exit code: 0 Version: 2.0.0.3 | ||||
3840 | "C:\Program Files\PariMatch\Installer\RetailInstall.exe" /selfupdate /admin | C:\Program Files\PariMatch\Installer\RetailInstall.exe | primus.exe | |
User: admin Integrity Level: HIGH Description: RetailInstall Exit code: 0 Version: 2.0.0.15 | ||||
2068 | "C:\Program Files\PariMatch\Installer\primus.exe" /admin | C:\Program Files\PariMatch\Installer\primus.exe | RetailInstall.exe | |
User: admin Integrity Level: HIGH Description: primus Version: 2.0.0.3 |
(PID) Process: | (2832) primus.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2832) primus.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 |
Operation: | write | Name: | Blob |
Value: 0F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE09000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C01400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB5748501D00000001000000100000005B3B67000EEB80022E42605B6B3B72400B000000010000000E000000740068006100770074006500000003000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B812000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68 | |||
(PID) Process: | (2832) primus.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 |
Operation: | write | Name: | Blob |
Value: 190000000100000010000000DC73F9B71E16D51D26527D32B11A6A3D03000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B810B000000010000000E00000074006800610077007400650000001D00000001000000100000005B3B67000EEB80022E42605B6B3B72401400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB57485053000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C009000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B060105050703030F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE2000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68 | |||
(PID) Process: | (2832) primus.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2832) primus.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (3840) RetailInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
Operation: | write | Name: | Name |
Value: RetailInstall.exe | |||
(PID) Process: | (3840) RetailInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3840) RetailInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2068) primus.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US |
PID | Process | Filename | Type | |
---|---|---|---|---|
2832 | primus.exe | C:\Program Files\PariMatch\Installer\RetailInstall.$$ | — | |
MD5:— | SHA256:— | |||
2068 | primus.exe | C:\Program Files\PariMatch\Installer\packages.ini | text | |
MD5:DCB0D635CB5CCF0A5D3017254D7411D0 | SHA256:6C36385C7CDE09537A7D91FA6C4B27A7BD76F71969126D704086317FFAD2BFFA | |||
3840 | RetailInstall.exe | C:\Program Files\PariMatch\Installer\primus.exe | executable | |
MD5:06C8582542C38B38ED2DB672868DE8AA | SHA256:7FB015F1DBD8DDB3EA6F1BAB82746F00B5756D24335DA8B541D3874648D222CA | |||
2832 | primus.exe | C:\Program Files\PariMatch\Installer\primus.$$ | executable | |
MD5:06C8582542C38B38ED2DB672868DE8AA | SHA256:7FB015F1DBD8DDB3EA6F1BAB82746F00B5756D24335DA8B541D3874648D222CA | |||
2832 | primus.exe | C:\Users\admin\AppData\Local\Temp\packages.ini | text | |
MD5:774B157E2B4AD27F033FE2B070E64228 | SHA256:EB20EB67B21EB481AA391B707C3FA6FE9EAAF4D1997F6240C2FC400FDFEFFB6F | |||
2832 | primus.exe | C:\Program Files\PariMatch\Installer\RetailInstall.exe | executable | |
MD5:1B4DC7F47BBA9E25CEAC6E9F9DD50393 | SHA256:8C88C85540D9A3AD28713FAFE055823B39309CFD55FEC8B25112378F86F9C509 | |||
2832 | primus.exe | C:\Users\admin\AppData\Local\Temp\log.db | sqlite | |
MD5:FFAA13C4540F864EAC003C10B5CB73F6 | SHA256:4DFC1B011C6727DE0995A5CFB8BA3166100B0C5765244BF50BA5A170576191ED | |||
3840 | RetailInstall.exe | C:\Program Files\PariMatch\Installer\packages.ini | text | |
MD5:5A443B37716CC0A037F4C0240C8DB292 | SHA256:8A18F990E8F6A8327DB3FF33B7DBE34B7BEDB0485CF57F977B07282F05CCB783 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2068 | primus.exe | 104.25.236.115:443 | rtlpm.com | Cloudflare Inc | US | shared |
2832 | primus.exe | 104.25.236.115:443 | rtlpm.com | Cloudflare Inc | US | shared |
— | — | 104.25.236.115:443 | rtlpm.com | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
rtlpm.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
2832 | primus.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |