File name: | eset_nod32_antivirus_live_installer.exe |
Full analysis: | https://app.any.run/tasks/5f624ed0-5470-4aea-90ec-3503d342bf4a |
Verdict: | Malicious activity |
Analysis date: | September 30, 2020, 04:19:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 3B6C4FC7FB566E3E1873BB02F71C7427 |
SHA1: | EC5B09EAE659AF1DD1782018EAFEF7F61F02F839 |
SHA256: | 7FCA690E8B22D9E622C69575E2E20F3530AD8A6E8E06A6021E7416F55F712268 |
SSDEEP: | 196608:y8FWogXjJM+QGhbHUCx6xB8lS73b4DMmujy:/2bqzclS7bwTL |
.exe | | | Win64 Executable (generic) (76.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (12.4) |
.exe | | | Generic Win/DOS Executable (5.5) |
.exe | | | DOS Executable Generic (5.5) |
ProductVersion: | 14.0.1.0 |
---|---|
ProductName: | ESET Security |
OriginalFileName: | Bootstrapper.exe |
LegalTrademarks: | NOD, NOD32, AMON, ESET are registered trademarks of ESET. |
LegalCopyright: | Copyright (c) ESET, spol. s r.o. 1992-2020. All rights reserved. |
InternalName: | Bootstrapper.exe |
FileVersion: | 10.16.31.0 |
FileDescription: | ESET Live Installer |
CompanyName: | ESET |
CharacterSet: | Windows, Latin1 |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 14.0.1.0 |
FileVersionNumber: | 10.16.31.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x28be0 |
UninitializedDataSize: | - |
InitializedDataSize: | 5926912 |
CodeSize: | 395776 |
LinkerVersion: | 14.26 |
PEType: | PE32 |
TimeStamp: | 2020:08:21 12:25:31+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 21-Aug-2020 10:25:31 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | ESET |
FileDescription: | ESET Live Installer |
FileVersion: | 10.16.31.0 |
InternalName: | Bootstrapper.exe |
LegalCopyright: | Copyright (c) ESET, spol. s r.o. 1992-2020. All rights reserved. |
LegalTrademarks: | NOD, NOD32, AMON, ESET are registered trademarks of ESET. |
OriginalFilename: | Bootstrapper.exe |
ProductName: | ESET Security |
ProductVersion: | 14.0.1.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000108 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 21-Aug-2020 10:25:31 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000608AA | 0x00060A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.65607 |
.rdata | 0x00062000 | 0x0001A142 | 0x0001A200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.32456 |
.data | 0x0007D000 | 0x00003EC0 | 0x00002600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.47891 |
.rsrc | 0x00081000 | 0x00585098 | 0x00585200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.97047 |
.reloc | 0x00607000 | 0x00005568 | 0x00005600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.62449 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.32598 | 1057 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 2.25666 | 67624 | Latin 1 / Western European | Vietnamese - Viet Nam | RT_ICON |
3 | 2.66703 | 16936 | Latin 1 / Western European | Vietnamese - Viet Nam | RT_ICON |
4 | 3.04319 | 9640 | Latin 1 / Western European | Vietnamese - Viet Nam | RT_ICON |
5 | 3.37535 | 4264 | Latin 1 / Western European | Vietnamese - Viet Nam | RT_ICON |
6 | 3.81116 | 2440 | Latin 1 / Western European | Vietnamese - Viet Nam | RT_ICON |
7 | 3.11631 | 212 | Latin 1 / Western European | Spanish - Chile | RT_STRING |
9 | 3.14302 | 1606 | Latin 1 / Western European | Spanish - Chile | RT_STRING |
11 | 3.15509 | 492 | Latin 1 / Western European | Spanish - Chile | RT_STRING |
13 | 2.87622 | 324 | Latin 1 / Western European | Spanish - Chile | RT_STRING |
ADVAPI32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
gdiplus.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2272 | "C:\Users\admin\AppData\Local\Temp\eset_nod32_antivirus_live_installer.exe" | C:\Users\admin\AppData\Local\Temp\eset_nod32_antivirus_live_installer.exe | explorer.exe | |
User: admin Company: ESET Integrity Level: MEDIUM Description: ESET Live Installer Exit code: 1019 Version: 10.16.31.0 | ||||
3752 | "C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\eset_nod32_antivirus_live_installer.exe" --bts-container 2272 "C:\Users\admin\AppData\Local\Temp\eset_nod32_antivirus_live_installer.exe" | C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\eset_nod32_antivirus_live_installer.exe | eset_nod32_antivirus_live_installer.exe | |
User: admin Company: ESET Integrity Level: HIGH Description: ESET Live Installer Exit code: 1019 Version: 10.16.31.0 | ||||
2488 | BootHelper.exe --watchdog 3752 --product "ESET Live Installer" 14.0.1.0 1033 | C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\BootHelper.exe | — | eset_nod32_antivirus_live_installer.exe |
User: admin Company: ESET Integrity Level: HIGH Description: ESET Live Installer Exit code: 0 Version: 10.16.31.0 |
(PID) Process: | (2272) eset_nod32_antivirus_live_installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2272) eset_nod32_antivirus_live_installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (3752) eset_nod32_antivirus_live_installer.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3752) eset_nod32_antivirus_live_installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 |
Operation: | write | Name: | Blob |
Value: 04000000010000001000000079E4A9840D7D3A96D7C04FE2434C892E0F0000000100000014000000B34DDD372ED92E8F2ABFBB9E20A9D31F204F194B030000000100000014000000A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C54361D000000010000001000000059779E39E21A2E3DFCED6857ED5C5FD90B000000010000001200000044006900670069004300650072007400000014000000010000001400000003DE503556D14CBB66F0A3E21B1BC397B23DD1556200000001000000200000004348A0E9444C78CB265E058D5E8944B4D84F9662BD26DB257F8934A443C701615300000001000000230000003021301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0090000000100000034000000303206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B060105050703081900000001000000100000000F3A0527D242DE2DC98E5CFCB1E991EE2000000001000000B3030000308203AF30820297A0030201020210083BE056904246B1A1756AC95991C74A300D06092A864886F70D01010505003061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F74204341301E170D3036313131303030303030305A170D3331313131303030303030305A3061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100E23BE11172DEA8A4D3A357AA50A28F0B7790C9A2A5EE12CE965B010920CC0193A74E30B753F743C46900579DE28D22DD870640008109CECE1B83BFDFCD3B7146E2D666C705B37627168F7B9E1E957DEEB748A308DAD6AF7A0C3906657F4A5D1FBC17F8ABBEEE28D7747F7A78995985686E5C23324BBF4EC0E85A6DE370BF7710BFFC01F685D9A844105832A97518D5D1A2BE47E2276AF49A33F84908608BD45FB43A84BFA1AA4A4C7D3ECF4F5F6C765EA04B37919EDC22E66DCE141A8E6ACBFECDB3146417C75B299E32BFF2EEFAD30B42D4ABB74132DA0CD4EFF881D5BB8D583FB51BE84928A270DA3104DDF7B216F24C0A4E07A8ED4A3D5EB57FA390C3AF270203010001A3633061300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E0416041403DE503556D14CBB66F0A3E21B1BC397B23DD155301F0603551D2304183016801403DE503556D14CBB66F0A3E21B1BC397B23DD155300D06092A864886F70D01010505000382010100CB9C37AA4813120AFADD449C4F52B0F4DFAE04F5797908A32418FC4B2B84C02DB9D5C7FEF4C11F58CBB86D9C7A74E79829AB11B5E370A0A1CD4C8899938C9170E2AB0F1CBE93A9FF63D5E40760D3A3BF9D5B09F1D58EE353F48E63FA3FA7DBB466DF6266D6D16E418DF22DB5EA774A9F9D58E22B59C04023ED2D2882453E7954922698E08048A837EFF0D6796016DEACE80ECD6EAC4417382F49DAE1453E2AB93653CF3A5006F72EE8C457496C612118D504AD783C2C3A806BA7EBAF1514E9D889C1B9386CE2916C8AFF64B977255730C01B24A3E1DCE9DF477CB5B424080530EC2DBD0BBF45BF50B9A9F3EB980112ADC888C698345F8D0A3CC6E9D595956DDE | |||
(PID) Process: | (3752) eset_nod32_antivirus_live_installer.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager |
Operation: | write | Name: | PendingFileRenameOperations |
Value: \??\C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\.erm\epi-base.zip |
PID | Process | Filename | Type | |
---|---|---|---|---|
3752 | eset_nod32_antivirus_live_installer.exe | C:\Users\admin\AppData\Local\Temp\eset\bts\bootstrapper_20200930041940.log | text | |
MD5:4ECF6225612AFD7DAC16B17A14646BE3 | SHA256:C2511BB961C43892C7B9F68FA8FA17178084BA85C0233A4232F9DBD38C0B1A35 | |||
3752 | eset_nod32_antivirus_live_installer.exe | C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\eguiActivationLang.dll | executable | |
MD5:FFFC0630474D9F198223F1315F98F308 | SHA256:B08C5CE47908140F6B24FC66FFBACF45C015477D7E8B92EDE8810B1D56919242 | |||
3752 | eset_nod32_antivirus_live_installer.exe | C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\.erm\epi-base.zip | compressed | |
MD5:A7F72D1BA4D0FD8B5906D3BEB4E2D304 | SHA256:4B745E1638BE1FD38F2C341C02FAF336CE1E2BCE224BC7CABDE880079C9F8D3A | |||
3752 | eset_nod32_antivirus_live_installer.exe | C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\BootHelper.exe | executable | |
MD5:82F065F834E934CFE294ECE8B80C3748 | SHA256:DA67B10CCBB8174C4B522B3D3B7B02C48E4CEC6FDC63A8613F1F10E70818DCB9 | |||
3752 | eset_nod32_antivirus_live_installer.exe | C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\eguiActivation.dll | executable | |
MD5:6C4AAD42483BF3179C967D975C50BF3F | SHA256:60D781025B41E16FAB8BFC1992FB86DD14795FE6B4FE113CF31A32ABA4F64FCB | |||
3752 | eset_nod32_antivirus_live_installer.exe | C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\plgInstaller.dll | executable | |
MD5:EFC6D785604256C1507001D74E2965AA | SHA256:BB527146D0F41E94B0EF62FD54C74032C5A901A3C2D2314572FAE9877429F3BB | |||
2272 | eset_nod32_antivirus_live_installer.exe | C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\eset_nod32_antivirus_live_installer.exe | executable | |
MD5:B9D4CB8518574BEF24EA932B40BF9593 | SHA256:842B4383DE3DF7716FFB2A96EA0DD6D8085AB300508547AB770993E1F41B8F4E | |||
3752 | eset_nod32_antivirus_live_installer.exe | C:\Users\admin\AppData\Local\Temp\eset\bts.session\{02D83BBE-0ABF-4738-4774-08CD492CF6F1}\sciter-x.dll | executable | |
MD5:0FA9F1010E7B1C52636FC28E5660346B | SHA256:48B109B4BA4F40796B5B737F6CF8B87DA5CFE027BE27385C8D636E1C2BC26FB4 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3752 | eset_nod32_antivirus_live_installer.exe | GET | 200 | 38.90.226.20:80 | http://repository.eset.com/v1/connectivity_check | US | text | 23 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3752 | eset_nod32_antivirus_live_installer.exe | 38.90.226.20:80 | repository.eset.com | ESET, spol. s r.o. | US | unknown |
3752 | eset_nod32_antivirus_live_installer.exe | 13.91.57.145:443 | edf.eset.com | Microsoft Corporation | US | unknown |
Domain | IP | Reputation |
---|---|---|
repository.eset.com |
| malicious |
edf.eset.com |
| unknown |