File name: | setup_driverdoc_2018.exe.exe |
Full analysis: | https://app.any.run/tasks/bd3213b7-7b2c-4c14-83b4-d4b1b8cbda60 |
Verdict: | Malicious activity |
Analysis date: | January 18, 2020, 12:24:55 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | ED17E4D75CDE674FB2093C7D03ED9FB1 |
SHA1: | 8CB6F64829C9C6DACD75FB9ABF3121458F09D0E3 |
SHA256: | 875A627637A7562A5A21425A30C65459E355CE05578623B38A8C573A45E60A0C |
SSDEEP: | 196608:bK2Fg2dITv2ZWNvY75CUsHhV0npXdDIpHgY7+U/zDHQVZKwqjSU:+2F/kv6WCdwhUKpp6Az8Ev7 |
.exe | | | InstallShield setup (36.8) |
---|---|---|
.exe | | | Win32 Executable MS Visual C++ (generic) (26.6) |
.exe | | | Win64 Executable (generic) (23.6) |
.dll | | | Win32 Dynamic Link Library (generic) (5.6) |
.exe | | | Win32 Executable (generic) (3.8) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2018:03:16 00:26:52+01:00 |
PEType: | PE32 |
LinkerVersion: | 9 |
CodeSize: | 191488 |
InitializedDataSize: | 115712 |
UninitializedDataSize: | - |
EntryPoint: | 0x1361a |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
FileVersionNumber: | 1.8.0.0 |
ProductVersionNumber: | 1.8.0.0 |
FileFlagsMask: | 0x0000 |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Unknown |
FileSubtype: | - |
LanguageCode: | Neutral |
CharacterSet: | Unicode |
CompanyName: | Solvusoft Corporation |
LegalCopyright: | Copyright (C) Solvusoft Corporation 2012. All rights reserved. |
FileVersion: | 1.8.0 |
ProductVersion: | 1.8.0 |
ProductName: | DriverDoc |
InternalName: | DriverDoc Setup |
OriginalFileName: | DriverDocSetup.exe |
FileDescription: | DriverDoc Installation Package |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 15-Mar-2018 23:26:52 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | Solvusoft Corporation |
LegalCopyright: | Copyright (C) Solvusoft Corporation 2012. All rights reserved. |
FileVersion: | 1.8.0 |
ProductVersion: | 1.8.0 |
ProductName: | DriverDoc |
InternalName: | DriverDoc Setup |
OriginalFilename: | DriverDocSetup.exe |
FileDescription: | DriverDoc Installation Package |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000F8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 15-Mar-2018 23:26:52 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0002EA1E | 0x0002EC00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.62196 |
.rdata | 0x00030000 | 0x0000A304 | 0x0000A400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.966 |
.data | 0x0003B000 | 0x00004888 | 0x00002A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.29857 |
.rsrc | 0x00040000 | 0x0000909D | 0x00009200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.69258 |
.reloc | 0x0004A000 | 0x0000630C | 0x00006400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 3.68608 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.08302 | 521 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 5.31962 | 2440 | UNKNOWN | UNKNOWN | RT_ICON |
3 | 4.98968 | 4264 | UNKNOWN | UNKNOWN | RT_ICON |
4 | 4.65049 | 9640 | UNKNOWN | UNKNOWN | RT_ICON |
5 | 7.95438 | 17462 | UNKNOWN | UNKNOWN | RT_ICON |
101 | 2.64638 | 76 | Latin 1 / Western European | UNKNOWN | RT_GROUP_ICON |
126 | 1.95756 | 68 | Latin 1 / Western European | UNKNOWN | RT_STRING |
ADVAPI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2440 | "C:\Users\admin\AppData\Local\Temp\setup_driverdoc_2018.exe.exe" | C:\Users\admin\AppData\Local\Temp\setup_driverdoc_2018.exe.exe | — | explorer.exe |
User: admin Company: Solvusoft Corporation Integrity Level: MEDIUM Description: DriverDoc Installation Package Exit code: 3221226540 Version: 1.8.0 | ||||
3884 | "C:\Users\admin\AppData\Local\Temp\setup_driverdoc_2018.exe.exe" | C:\Users\admin\AppData\Local\Temp\setup_driverdoc_2018.exe.exe | explorer.exe | |
User: admin Company: Solvusoft Corporation Integrity Level: HIGH Description: DriverDoc Installation Package Version: 1.8.0 | ||||
2172 | "C:\Users\admin\AppData\Local\Temp\DRF1579350321\DRPROSetup.exe" /V"/l*v \"C:\Users\admin\AppData\Local\Temp\DRPRO_msi.log.txt\" USER_BRAND_NAME=\"Solvusoft\" SHORT_UNINSTALL=1 " | C:\Users\admin\AppData\Local\Temp\DRF1579350321\DRPROSetup.exe | — | setup_driverdoc_2018.exe.exe |
User: admin Integrity Level: HIGH | ||||
3944 | MSIEXEC.EXE /i "C:\ProgramData\Solvusoft\DriverDoc\InstallCache\{A48B2AFF-BAC0-4BB6-AD52-EC28D293E5E1}\DriverDoc.msi" /l*v "C:\Users\admin\AppData\Local\Temp\DRPRO_msi.log.txt" USER_BRAND_NAME="Solvusoft" SHORT_UNINSTALL=1 TRANSFORMS="C:\ProgramData\Solvusoft\DriverDoc\InstallCache\{A48B2AFF-BAC0-4BB6-AD52-EC28D293E5E1}\1042.MST" SETUPEXEDIR="C:\Users\admin\AppData\Local\Temp\DRF1579350321" SETUPEXENAME="DRPROSetup.exe" | C:\Windows\system32\MSIEXEC.EXE | DRPROSetup.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2712 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2696 | C:\Windows\system32\MsiExec.exe -Embedding 0ED774C047D05759203C7627182E91E9 C | C:\Windows\system32\MsiExec.exe | msiexec.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
1560 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2280 | C:\Windows\system32\MsiExec.exe -Embedding D9DB17BB43A7F18142152420DC031517 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
1740 | "C:\Program Files\Solvusoft\SuiteService.exe" /install | C:\Program Files\Solvusoft\SuiteService.exe | — | MsiExec.exe |
User: admin Company: Solvusoft Corporation Integrity Level: HIGH Description: Solvusoft Suite Service Exit code: 0 Version: 3.1.295.0 | ||||
2368 | "C:\Program Files\Solvusoft\\SuiteService.exe" /start | C:\Program Files\Solvusoft\SuiteService.exe | — | MsiExec.exe |
User: admin Company: Solvusoft Corporation Integrity Level: HIGH Description: Solvusoft Suite Service Exit code: 0 Version: 3.1.295.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3884 | setup_driverdoc_2018.exe.exe | C:\Users\admin\AppData\Local\Temp\DRF1579350321\DRPROSetup.exe | executable | |
MD5:29F0F2C5C1DFDEDB2AD360532080E0D2 | SHA256:36039AE39868E61451D2213E6CF9764235732C094509878CB162C55BB253DE0B | |||
2172 | DRPROSetup.exe | C:\Users\admin\AppData\Local\Temp\{2F8448EB-3820-4732-88A9-F42CB4AC399C}\_ISMSIDEL.INI | text | |
MD5:31C00326F2BE7ECD71E49C71BC147A2D | SHA256:7E1872F9866BB2DF393DA34B431F11C929ADA80435019A4E55365A3FA0D7D021 | |||
2172 | DRPROSetup.exe | C:\Users\admin\AppData\Local\Temp\{2F8448EB-3820-4732-88A9-F42CB4AC399C}\Setup.INI | text | |
MD5:06C475300197A36D404E89F047E5AA7A | SHA256:71BBDF82A891A92FF3EC3B86808B1D7264592B71571AA88DC4DC53DE7693D1FC | |||
2172 | DRPROSetup.exe | C:\Users\admin\AppData\Local\Temp\{2F8448EB-3820-4732-88A9-F42CB4AC399C}\0x0409.ini | text | |
MD5:FB2887DF5A359468851A7080B9140311 | SHA256:A9CF5B5A4303CA758BDEFF308CBD59FC98CF918C3D51CD62913E2FC75D2E4339 | |||
2172 | DRPROSetup.exe | C:\Users\admin\AppData\Local\Temp\{2F8448EB-3820-4732-88A9-F42CB4AC399C}\0x0405.ini | text | |
MD5:E66F855502B409A2EAA50EF9BC66ACBD | SHA256:BBE50A141BB622513C4117EF72DABBBBD152F83393490A6B61173025BCBED188 | |||
2172 | DRPROSetup.exe | C:\Users\admin\AppData\Local\Temp\{2F8448EB-3820-4732-88A9-F42CB4AC399C}\0x040b.ini | text | |
MD5:37698FFF4F4D3392110353D3FEE3FA62 | SHA256:D7C5B75D769218C3BD8E536182C5EAAC634A4BBE713527AEEE71C14ECB7F51D3 | |||
2172 | DRPROSetup.exe | C:\Users\admin\AppData\Local\Temp\{2F8448EB-3820-4732-88A9-F42CB4AC399C}\0x040a.ini | text | |
MD5:4AF55AE1A38156139694B8A772E2661D | SHA256:5CBC55BF53B318A7C95865FDF161D9405EAECDC4047A0F23E4E9A6D1E6857021 | |||
2172 | DRPROSetup.exe | C:\Users\admin\AppData\Local\Temp\{2F8448EB-3820-4732-88A9-F42CB4AC399C}\0x0402.ini | text | |
MD5:8846B9A3A28DF070A511988DCCC86F58 | SHA256:5D3B6E8E93F00F45599C8EA292302EC94B317F0B00248071879CDE194BDBE6E3 | |||
2172 | DRPROSetup.exe | C:\Users\admin\AppData\Local\Temp\{2F8448EB-3820-4732-88A9-F42CB4AC399C}\0x0406.ini | text | |
MD5:2934637BF3CCCDC7097C72044DE19F98 | SHA256:47BF75B72EA1581B567F4517B9FD4E6F718E39FBB4C751E5213E94B5312942BB | |||
2172 | DRPROSetup.exe | C:\Users\admin\AppData\Local\Temp\{2F8448EB-3820-4732-88A9-F42CB4AC399C}\0x0407.ini | text | |
MD5:C19F30CAAA751082474E2153F5124693 | SHA256:AB9B5B21487355C975C975E6BA88C1EB881E27657D5CAABE9CCB2EF8421D459E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2040 | SuiteService.exe | GET | 200 | 51.124.128.217:80 | http://download.dk.spamfighter.com/DVPRO/Blacklist///Ignore.xml | GB | xml | 160 b | malicious |
2040 | SuiteService.exe | POST | 200 | 51.144.56.51:80 | http://update.spamfighter.com/Toolkit/Service.asmx | NL | xml | 393 b | suspicious |
2040 | SuiteService.exe | POST | 200 | 51.144.56.51:80 | http://update.spamfighter.com/Toolkit/Service.asmx | NL | xml | 413 b | suspicious |
2040 | SuiteService.exe | POST | 200 | 51.144.56.51:80 | http://update.spamfighter.com/Toolkit/Service.asmx | NL | xml | 672 b | suspicious |
2040 | SuiteService.exe | POST | 200 | 51.144.56.51:80 | http://update.spamfighter.com/Toolkit/Service.asmx | NL | xml | 396 b | suspicious |
2040 | SuiteService.exe | POST | 200 | 51.144.56.51:80 | http://update.spamfighter.com/Toolkit/Service.asmx | NL | xml | 393 b | suspicious |
2040 | SuiteService.exe | POST | 200 | 51.144.56.51:80 | http://update.spamfighter.com/Toolkit/Service.asmx | NL | xml | 376 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2040 | SuiteService.exe | 51.124.128.217:80 | download.dk.spamfighter.com | Microsoft Corporation | GB | suspicious |
2040 | SuiteService.exe | 51.144.56.51:80 | update.spamfighter.com | Microsoft Corporation | NL | unknown |
Domain | IP | Reputation |
---|---|---|
update.spamfighter.com |
| suspicious |
download.dk.spamfighter.com |
| malicious |