File name:

83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin

Full analysis: https://app.any.run/tasks/6f1faf3c-0303-42b3-88a5-b87151783ad1
Verdict: Malicious activity
Analysis date: October 23, 2024, 06:37:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
sfx
dropper
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5:

4271B7FCA62304060E97FAA7C92C1BB3

SHA1:

06212D0413554A0F8A7AF77D02310E176C53B12E

SHA256:

83B0F67C1FAD7E6EED8210C999521A9AB9644C49495FA4BACCD0D4F592979E11

SSDEEP:

98304:x2Ols3vKHeZAjddI8FbNuSIzPRK4+RA2CJ40adC+id8Ggc+bTJsGB2amLGtc+3R/:P0t8BOoVRjpwJurt4ZDqiiM+ikphvP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SFX dropper has been detected

      • 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe (PID: 1792)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe (PID: 1792)

    • Application launched itself

      • 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe (PID: 1792)

    • Executable content was dropped or overwritten

      • 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe (PID: 6568)

  • INFO

    • Checks supported languages

      • 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe (PID: 1792)

    • Reads the computer name

      • 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe (PID: 1792)

    • The process uses the downloaded file

      • 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe (PID: 1792)

    • Process checks computer location settings

      • 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe (PID: 1792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:05:28 16:04:29+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 72192
InitializedDataSize: 90624
UninitializedDataSize: -
EntryPoint: 0xb480
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DROPPER 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe no specs 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe vlc.exe s.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
512"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Windows\system\اسمعها واذا ما عجبتك - YouTube.flv - YouTube.flv"C:\Program Files\VideoLAN\VLC\vlc.exe
83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe
User:
admin
Company:
VideoLAN
Integrity Level:
HIGH
Description:
VLC media player
Version:
3.0.11
Modules
Images
c:\program files\videolan\vlc\vlc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1112"C:\Windows\system\s.exe" C:\Windows\System\s.exe—83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\windows\system\s.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1792"C:\Users\admin\AppData\Local\Temp\83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe" C:\Users\admin\AppData\Local\Temp\83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6568"C:\Users\admin\AppData\Local\Temp\83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe" -el -s2 "-dC:\Windows\system" "-p" "-sp"C:\Users\admin\AppData\Local\Temp\83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe
83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
2 881
Read events
2 879
Write events
2
Delete events
0

Modification events

(PID) Process:(6568) 83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flv\OpenWithProgids
Operation:writeName:VLC.flv
Value:
Executable files
3
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
656883b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exeC:\Windows\System\اسمعها واذا ما عجبتك - YouTube.flv - YouTube.flv —
MD5:—
SHA256:—
512vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.locktext
MD5:5B6D2F2E7DE5C26EF0FE558C939260F0
SHA256:59FABC869F6D6CB27166A610E39FB31D23CCBA683AAFBD748BE980DEB34D6193
656883b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin.exeC:\Windows\System\s.exeexecutable
MD5:BA6C9D78226B3416A43DA2C2E619438C
SHA256:18F9B2B16C9E1310E0895253457D98A526F00B0A5554717150623845127C6DCB
512vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.initext
MD5:7FB53A972A818CFA73C1452C8BE03DF3
SHA256:4A23E0AC1A5E903C87D8B7C114DA71D49C784BBD12FC39051AF379853160E28F
512vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.dlE512text
MD5:7FB53A972A818CFA73C1452C8BE03DF3
SHA256:4A23E0AC1A5E903C87D8B7C114DA71D49C784BBD12FC39051AF379853160E28F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
53
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4004
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7228
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7228
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6236
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1248
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6944
svchost.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
104.126.37.171:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.169
  • 104.126.37.176
  • 104.126.37.160
  • 104.126.37.170
  • 104.126.37.168
  • 104.126.37.179
  • 104.126.37.184
  • 104.126.37.163
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.0
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.23
  • 20.190.159.2
whitelisted
th.bing.com
  • 2.23.209.180
  • 2.23.209.183
  • 2.23.209.176
  • 2.23.209.175
  • 2.23.209.182
  • 2.23.209.177
  • 2.23.209.181
  • 2.23.209.179
  • 2.23.209.185
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

No threats detected
Process
Message
vlc.exe
main libvlc debug: VLC media player - 3.0.11 Vetinari
vlc.exe
main libvlc debug: Copyright © 1996-2020 the VideoLAN team
vlc.exe
main libvlc debug: revision 3.0.11-0-gdc0c5ced72
vlc.exe
main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=x86_64-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' 'host_alias=x86_64-w64-mingw32' 'PKG_CONFIG_LIBDIR=/home/jenkins/workspace/vlc-release/windows/vlc-release-win32-x64/contrib/x86_64-w64-mingw32/lib/pkgconfig'
vlc.exe
main libvlc debug: using multimedia timers as clock source
vlc.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
vlc.exe
main libvlc debug: searching plug-in modules
vlc.exe
main libvlc debug: loading plugins cache file C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
vlc.exe
main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
vlc.exe
main libvlc debug: plug-ins loaded: 494 modules
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
83b0f67c1fad7e6eed8210c999521a9ab9644c49495fa4baccd0d4f592979e11.bin