File name: | 868d26840c69d3000ba0238e707ca6826324dd6ed71710ee2d872189224ff2aa |
Full analysis: | https://app.any.run/tasks/4f534988-7732-4daf-8fce-3d79fc69b29c |
Verdict: | Malicious activity |
Analysis date: | July 17, 2019, 11:55:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | A4289EFB7D5C79DE6C4B3E56E61C5FFC |
SHA1: | 7DB8D161723C9429E50F2961A2358A5C5D986EBF |
SHA256: | 868D26840C69D3000BA0238E707CA6826324DD6ED71710EE2D872189224FF2AA |
SSDEEP: | 3072:d5+iiVM2EB1GG/66WXrAdyUFVdhxDdiht1wNyY9y74W:3FiVdI3S6EabFbiD11R0W |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2010:08:27 18:52:32+02:00 |
PEType: | PE32 |
LinkerVersion: | 9 |
CodeSize: | 23552 |
InitializedDataSize: | 196096 |
UninitializedDataSize: | - |
EntryPoint: | 0x19f0 |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
FileVersionNumber: | 9.0.0.4503 |
ProductVersionNumber: | 9.0.0.4503 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Windows NT 32-bit |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
CompanyName: | tkioqr Mywawlnhfpc |
FileDescription: | ARR Mpqhray RRT |
FileVersion: | 6.41.99.7646 (nmoy.981591-2668) |
InternalName: | hynixfz.qvj |
LegalCopyright: | © tujnkv Fyhtwhpawof. Dfw zmvnus stjoddin. |
OriginalFileName: | rtiwrpq.owf |
ProductName: | ptuuwz® Rwlmkgf Dapre Sarjtzgl |
ProductVersion: | 6.80.40.6284 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 27-Aug-2010 16:52:32 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000E8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 8 |
Time date stamp: | 27-Aug-2010 16:52:32 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00005A30 | 0x00005C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 1.41068 |
.rdata | 0x00007000 | 0x0002E914 | 0x0002EA00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.51631 |
.data | 0x00036000 | 0x0000051C | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.51109 |
.rdata3 | 0x00037000 | 0x00000064 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0 |
.rdata2 | 0x00038000 | 0x00000064 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0 |
.rdata1 | 0x00039000 | 0x00000064 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0 |
.rsrc | 0x0003B000 | 0x0001F378 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.14834 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
MAINSCREEN | 3.62224 | 770 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
KERNEL32.dll |
USER32.dll |
msvcrt.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3640 | "C:\Users\admin\AppData\Local\Temp\868d26840c69d3000ba0238e707ca6826324dd6ed71710ee2d872189224ff2aa.exe" | C:\Users\admin\AppData\Local\Temp\868d26840c69d3000ba0238e707ca6826324dd6ed71710ee2d872189224ff2aa.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2880 | C:\PROGRA~2\Mozilla\rdmmgud.exe -ewjeepd | C:\PROGRA~2\Mozilla\rdmmgud.exe | taskeng.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3012 | "C:\Users\admin\AppData\Local\Temp\java_update_jxxkdaa.exe" | C:\Users\admin\AppData\Local\Temp\java_update_jxxkdaa.exe | rdmmgud.exe | |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
2372 | C:\PROGRA~2\Mozilla\rdmmgud.exe -ewjeepd | C:\PROGRA~2\Mozilla\rdmmgud.exe | taskeng.exe | |
User: SYSTEM Integrity Level: SYSTEM Exit code: 0 | ||||
2252 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10007_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10007 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3012 | java_update_jxxkdaa.exe | C:\ProgramData\Mozilla\rdmmgud.exe | executable | |
MD5:D7BAE53BF824A06A7CA4759D8F4000B0 | SHA256:CB13DDC6CA9F3E88E86411B659979ED8A6FC0456D4C2D2CAB4DB8C12A6DE8CE6 | |||
3640 | 868d26840c69d3000ba0238e707ca6826324dd6ed71710ee2d872189224ff2aa.exe | C:\ProgramData\Mozilla\rdmmgud.exe | executable | |
MD5:23D4417DDF30A31A1C0CAAD8290271BB | SHA256:673D1E9BB4369075D9B3C675D48F9ABD764BE04D126D093DDE77F6D2C4E2D9F6 | |||
2880 | rdmmgud.exe | C:\Users\admin\AppData\Local\Temp\java_update_jxxkdaa.exe | executable | |
MD5:A69554AFB6285316ABE29BF0F4A00E86 | SHA256:13B227E195CEBA030FD67CFE1C1573BACADA1E15B22041CA0BF944F81A69A2D7 | |||
2372 | rdmmgud.exe | C:\ProgramData\Mozilla\xciqtha.dll | executable | |
MD5:A8D1EA2B752134500BCE64E9021544C5 | SHA256:1B1682B8087B851755035FD9BE3043D7A934C8E3454E0F420AF41A582879E312 |