File name: | HPPSdr.exe |
Full analysis: | https://app.any.run/tasks/38a2c5bc-0a87-4151-b886-9298985099ac |
Verdict: | Malicious activity |
Analysis date: | June 19, 2019, 15:57:11 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 1274ADE28FF713640BD6E3BD22858BEE |
SHA1: | 6EFB3613280BA805504FB0B459507EE7E7A565B1 |
SHA256: | 825D160C33EB3092D448A6E0C65687C2E7D2D752064765A6A0349E86CF62978A |
SSDEEP: | 196608:c1ll1nJVh/8dn97pALQET75DVD9nlE6cW6b/MeY1OA0YC:c13Nmd6LT1hD9lE6l6TVX |
.exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (14.2) |
.exe | | | Win32 Executable (generic) (9.7) |
.exe | | | Generic Win/DOS Executable (4.3) |
.exe | | | DOS Executable Generic (4.3) |
ProductVersion: | 1.4.1926.0 |
---|---|
ProductName: | HP Webpack |
OriginalFileName: | 7zS.sfx |
LegalCopyright: | Hewlett-Packard Company |
InternalName: | 7zS.sfx |
FileVersion: | 1.4.1926.0 |
FileDescription: | HP Webpack |
CompanyName: | Hewlett-Packard Company |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.4.1926.0 |
FileVersionNumber: | 1.4.1926.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5 |
ImageVersion: | - |
OSVersion: | 5 |
EntryPoint: | 0x1ccbd |
UninitializedDataSize: | - |
InitializedDataSize: | 116224 |
CodeSize: | 156672 |
LinkerVersion: | 9 |
PEType: | PE32 |
TimeStamp: | 2011:10:20 21:48:23+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 20-Oct-2011 19:48:23 |
Detected languages: |
|
CompanyName: | Hewlett-Packard Company |
FileDescription: | HP Webpack |
FileVersion: | 1.4.1926.0 |
InternalName: | 7zS.sfx |
LegalCopyright: | Hewlett-Packard Company |
OriginalFilename: | 7zS.sfx |
ProductName: | HP Webpack |
ProductVersion: | 1.4.1926.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000D8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 4 |
Time date stamp: | 20-Oct-2011 19:48:23 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0002628C | 0x00026400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.56232 |
.rdata | 0x00028000 | 0x0000834A | 0x00008400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.67339 |
.data | 0x00031000 | 0x000042C0 | 0x00002200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.95511 |
.rsrc | 0x00036000 | 0x00011E68 | 0x00012000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.57539 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.20865 | 703 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 3.18403 | 296 | Latin 1 / Western European | English - United States | RT_ICON |
31 | 3.2232 | 106 | Latin 1 / Western European | English - United States | RT_STRING |
32 | 3.95495 | 214 | Latin 1 / Western European | English - United States | RT_STRING |
33 | 2.44941 | 66 | Latin 1 / Western European | English - United States | RT_STRING |
45 | 0.903812 | 36 | Latin 1 / Western European | English - United States | RT_STRING |
51 | 2.11194 | 76 | Latin 1 / Western European | English - United States | RT_STRING |
94 | 4.22574 | 396 | Latin 1 / Western European | English - United States | RT_STRING |
95 | 4.09247 | 346 | Latin 1 / Western European | English - United States | RT_STRING |
108 | 1.86128 | 46 | Latin 1 / Western European | English - United States | RT_STRING |
ADVAPI32.dll |
COMCTL32.dll |
KERNEL32.dll |
OLEAUT32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3404 | "C:\Users\admin\AppData\Local\Temp\HPPSdr.exe" | C:\Users\admin\AppData\Local\Temp\HPPSdr.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1560 | "C:\Users\admin\AppData\Local\Temp\7zS3B90\FileExtractor.exe" | C:\Users\admin\AppData\Local\Temp\7zS3B90\FileExtractor.exe | — | HPPSdr.exe |
User: admin Company: HPDC LP Integrity Level: MEDIUM Description: HP Print and Scan Doctor 5.2.1 Exit code: 3221226540 Version: 1.0.0.2 | ||||
1388 | "C:\Users\admin\AppData\Local\Temp\7zS3B90\FileExtractor.exe" | C:\Users\admin\AppData\Local\Temp\7zS3B90\FileExtractor.exe | HPPSdr.exe | |
User: admin Company: HPDC LP Integrity Level: HIGH Description: HP Print and Scan Doctor 5.2.1 Exit code: 0 Version: 1.0.0.2 | ||||
3540 | "C:\Users\admin\AppData\Local\Temp\7zS3B90\HPDiagnosticCoreUI.exe" | C:\Users\admin\AppData\Local\Temp\7zS3B90\HPDiagnosticCoreUI.exe | — | FileExtractor.exe |
User: admin Company: HPDC LP Integrity Level: HIGH Description: HP Print and Scan Doctor 5.2.1 Exit code: 0 Version: 5.2.1.002 | ||||
3116 | "C:\Users\admin\AppData\Local\Temp\7zS3B90\HPDiagnosticCoreUI.exe" | C:\Users\admin\AppData\Local\Temp\7zS3B90\HPDiagnosticCoreUI.exe | HPDiagnosticCoreUI.exe | |
User: admin Company: HPDC LP Integrity Level: HIGH Description: HP Print and Scan Doctor 5.2.1 Version: 5.2.1.002 |
(PID) Process: | (3404) HPPSdr.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3404) HPPSdr.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (1388) FileExtractor.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (1388) FileExtractor.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (3540) HPDiagnosticCoreUI.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3540) HPDiagnosticCoreUI.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (3540) HPDiagnosticCoreUI.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3540) HPDiagnosticCoreUI.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 |
Operation: | write | Name: | Blob |
Value: 0F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE09000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C01400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB5748501D00000001000000100000005B3B67000EEB80022E42605B6B3B72400B000000010000000E000000740068006100770074006500000003000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B812000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68 | |||
(PID) Process: | (3540) HPDiagnosticCoreUI.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 |
Operation: | write | Name: | Blob |
Value: 190000000100000010000000DC73F9B71E16D51D26527D32B11A6A3D03000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B810B000000010000000E00000074006800610077007400650000001D00000001000000100000005B3B67000EEB80022E42605B6B3B72401400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB57485053000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C009000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B060105050703030F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE2000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68 | |||
(PID) Process: | (3540) HPDiagnosticCoreUI.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
Operation: | write | Name: | Name |
Value: HPDiagnosticCoreUI.exe |
PID | Process | Filename | Type | |
---|---|---|---|---|
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1034\ndu_firewall.chm | chm | |
MD5:37A3CA5C4AE35B1B4BA9FA83F4427534 | SHA256:DE01F7846378175050717C3BB7876E03B0260A3D31352A794ECBA0797DEE53B8 | |||
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1033\ndu_firewall.chm | chm | |
MD5:0B98650C63C1D07AA22EA9E24627418F | SHA256:452F45E5937A80DF4A81DC58E7D2DD7F5A47D1F39E4D6047DB44B61EC95E34D1 | |||
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1053\ndu_firewall.chm | chm | |
MD5:A97D17A04A493D114D805E564FB471AA | SHA256:BEE5A0B5CD804B3D9AE44BB846A84E7D7C350BF48EC334636814283F73CF8C52 | |||
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1043\ndu_firewall.chm | chm | |
MD5:49AEA0EDC8071DF7AE9D30B3F4246AC0 | SHA256:506E3E0B1D5CF5DC85728E28500E13D95453879C7F939B4728DF7D3325327AA8 | |||
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1037\ndu_firewall.chm | chm | |
MD5:7BBB78DF372C20327061AE7E5B2BB596 | SHA256:818D69F45ADE71B22251C048919B375B0286F1AAE79E20C594F8C1397CDE548E | |||
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1030\ndu_firewall.chm | chm | |
MD5:73D8024987151A49BC8D821609A9BC07 | SHA256:15FE05930F8E06955C9A405F8B26C012441B292D7A141D7949B5ABF6F837931E | |||
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1035\ndu_firewall.chm | chm | |
MD5:93F9A8AFD7BBBCFA86814F1AB8C5EC5B | SHA256:E1FF52A1EF93EC3D38EEBB5AF6EBBB819873AB2EFC9B325C1F6DC1FDCB04976B | |||
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1025\ndu_firewall.chm | chm | |
MD5:5DB4574DC67604873C3A5BDAE114BB78 | SHA256:4FB1B4CC7892625E1AE1842B47A1C873F9AB1BBFEC68FF6D66557684C82EC836 | |||
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1040\ndu_firewall.chm | chm | |
MD5:F511DEAAEEFFA7CA8D00213D05A8B647 | SHA256:F591B09D3918804C82002A9F7541DE32693828E20B0F7E4AB40BFAEB2D373C29 | |||
3404 | HPPSdr.exe | C:\Users\admin\AppData\Local\Temp\7zS3B90\help\1032\ndu_firewall.chm | chm | |
MD5:2EF3B036FA90ADE4021E7AA64B1B3E17 | SHA256:31FC0B144D73F12F2EF4CD0F8F9B3EBF6EA908CA446BE1DC79947B73A018FA89 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3116 | HPDiagnosticCoreUI.exe | GET | 200 | 15.73.192.108:80 | http://www1.hp.com/ | US | html | 617 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3116 | HPDiagnosticCoreUI.exe | 143.204.214.91:443 | static.dataservices.hp.com | — | US | suspicious |
3116 | HPDiagnosticCoreUI.exe | 143.204.214.101:443 | static.dataservices.hp.com | — | US | unknown |
3116 | HPDiagnosticCoreUI.exe | 15.73.192.108:80 | www1.hp.com | Hewlett-Packard Company | US | malicious |
3116 | HPDiagnosticCoreUI.exe | 34.212.128.49:443 | mq.dataservices.hp.com | Amazon.com, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
www1.hp.com |
| unknown |
static.dataservices.hp.com |
| shared |
mq.dataservices.hp.com |
| unknown |