download: | 35.exe |
Full analysis: | https://app.any.run/tasks/b5872bbf-a712-45ae-9663-51a8742e1775 |
Verdict: | Malicious activity |
Analysis date: | November 14, 2018, 15:30:53 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | B4F95B79952772CFC18795DA0BCE4C90 |
SHA1: | 2EE87C82E785460F12572BA94EDA029FFABAF468 |
SHA256: | 8827F4ED52B6B029DACB580D34D16DEC05D6A9DC9E162F921091F3A8E47CF2B2 |
SSDEEP: | 12288:pvV4U2rJTAF9XVGMEn94UpHtWOpf533RHzsmP+agVznWqZa/Cr7tF75x561OAV:ZV4U2rJkFVkkUpLV53BHzsmGTGK |
.exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
---|---|---|
.exe | | | Win64 Executable (generic) (23.8) |
.dll | | | Win32 Dynamic Link Library (generic) (5.6) |
.exe | | | Win32 Executable (generic) (3.8) |
.exe | | | Generic Win/DOS Executable (1.7) |
AssemblyVersion: | 3.1.4.0 |
---|---|
ProductVersion: | 5.16.00.5515 |
ProductName: | CCleaner |
OriginalFileName: | BitcoinBlackmailer.exe |
LegalTrademarks: | Copyright 2005 - 2016 Piriform. All rights reserved. |
LegalCopyright: | Copyright 2005 - 2016 Piriform. All rights reserved. |
InternalName: | BitcoinBlackmailer.exe |
FileVersion: | 5.16.00.5515 |
FileDescription: | CCleaner |
CompanyName: | Piriform |
Comments: | CCleaner |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 5.16.0.5515 |
FileVersionNumber: | 5.16.0.5515 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0xac23e |
UninitializedDataSize: | - |
InitializedDataSize: | 2560 |
CodeSize: | 697344 |
LinkerVersion: | 8 |
PEType: | PE32 |
TimeStamp: | 2016:05:19 03:19:58+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 19-May-2016 01:19:58 |
Comments: | CCleaner |
CompanyName: | Piriform |
FileDescription: | CCleaner |
FileVersion: | 5.16.00.5515 |
InternalName: | BitcoinBlackmailer.exe |
LegalCopyright: | Copyright 2005 - 2016 Piriform. All rights reserved. |
LegalTrademarks: | Copyright 2005 - 2016 Piriform. All rights reserved. |
OriginalFilename: | BitcoinBlackmailer.exe |
ProductName: | CCleaner |
ProductVersion: | 5.16.00.5515 |
Assembly Version: | 3.1.4.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 19-May-2016 01:19:58 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00002000 | 0x000AA244 | 0x000AA400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.88548 |
.rsrc | 0x000AE000 | 0x000006B8 | 0x00000800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.69136 |
.reloc | 0x000B0000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.00112 | 490 | UNKNOWN | UNKNOWN | RT_MANIFEST |
mscoree.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3872 | "C:\Users\admin\AppData\Local\Temp\35.exe" | C:\Users\admin\AppData\Local\Temp\35.exe | explorer.exe | |
User: admin Company: Piriform Integrity Level: MEDIUM Description: CCleaner Exit code: 0 Version: 5.16.00.5515 | ||||
3628 | "C:\Users\admin\AppData\Local\Macrvds\Macrvds.exe" C:\Users\admin\AppData\Local\Temp\35.exe | C:\Users\admin\AppData\Local\Macrvds\Macrvds.exe | 35.exe | |
User: admin Company: Piriform Integrity Level: MEDIUM Description: CCleaner Exit code: 1 Version: 5.16.00.5515 | ||||
3352 | "C:\Windows\system32\taskmgr.exe" | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (3872) 35.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | vidporc.exe |
Value: C:\Users\admin\AppData\Roaming\Vidporc\vidporc.exe | |||
(PID) Process: | (3872) 35.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3872) 35.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | — | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager |
Operation: | write | Name: | UsrColumnSettings |
Value: 1C0C0000340400000000000050000000010000001D0C0000350400000000000023000000010000001E0C000036040000000000003C000000010000001F0C000039040000000000004E00000001000000200C000037040000000000004E00000001000000 | |||
(PID) Process: | — | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager |
Operation: | write | Name: | Preferences |
Value: 30030000E803000001000000010000000A0000000A000000A2010000F00100000100000001000000000000000000000001000000000000000100000000000000000000000200000004000000090000001D000000FFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009C00000040000000210000004600000052000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000002000000010000000300000004000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0500000000000000FFFFFFFF00000000020000000300000004000000FFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000010000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0400000000000000FFFFFFFF00000000FFFFFFFF4F00000028000000500000003400000050000000000000000100000002000000030000000400000000000000FFFFFFFF43000000000000000000000001000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3628 | Macrvds.exe | C:\Users\admin\Desktop\productionconnection.jpg.pornoransom | binary | |
MD5:568295F53923AED10B7E2A0CD227FC1F | SHA256:7B2A6351E2CF6C153D0D250EEE6EF025BDDB872654930E373327E74659774A96 | |||
3628 | Macrvds.exe | C:\Users\admin\Desktop\materialsecond.rtf.pornoransom | binary | |
MD5:EB331DCF84C14037DB0EA97D3A65043F | SHA256:66C5E785C895A123742FE83BF6AA9C706F0CDA05FB94BAA831F09CA20045B60C | |||
3628 | Macrvds.exe | C:\Users\admin\Desktop\summaryposition.rtf.pornoransom | binary | |
MD5:176F2942D3A07309077FFFE4518FD772 | SHA256:FE980F8BA8270E0586FB29EE11771E4C1DAA6A5A82C3390155DDDD4B6ABB613E | |||
3628 | Macrvds.exe | C:\Users\admin\Desktop\antielectronic.rtf.pornoransom | binary | |
MD5:1483BE27ECC1408E3CCD3F28B1C6FA23 | SHA256:0257026FDD2F243933CCCF0429F112A6F7E088E96449983AA5118EE8BCD12763 | |||
3628 | Macrvds.exe | C:\Users\admin\Desktop\professionaltypes.rtf.pornoransom | binary | |
MD5:B424A124D08F044F14F68942B4E50673 | SHA256:633A797651A502DE2B00DB60C83E96BA009A9202630557BD62BF63D71FB90681 | |||
3628 | Macrvds.exe | C:\Users\admin\Documents\inforeported.rtf.pornoransom | binary | |
MD5:872E658B676FD194A46AB40F42CC24C4 | SHA256:3B3AE589B26B849CDE4CD166D44C5227B8E874140F9FE55BFC0ABD2F0CD3B5E4 | |||
3872 | 35.exe | C:\Users\admin\AppData\Roaming\Vidporc\vidporc.exe | executable | |
MD5:B4F95B79952772CFC18795DA0BCE4C90 | SHA256:8827F4ED52B6B029DACB580D34D16DEC05D6A9DC9E162F921091F3A8E47CF2B2 | |||
3628 | Macrvds.exe | C:\Users\admin\Documents\necessarycan.rtf.pornoransom | binary | |
MD5:85E6DE5981090594DC26440B7040467D | SHA256:B2BB395BED5BF9CF23BDEE2E84CC40BAFE7DD4C3EBE1E2E1E570EBE4A76FF993 | |||
3872 | 35.exe | C:\Users\admin\AppData\Local\Macrvds\Macrvds.exe | executable | |
MD5:B4F95B79952772CFC18795DA0BCE4C90 | SHA256:8827F4ED52B6B029DACB580D34D16DEC05D6A9DC9E162F921091F3A8E47CF2B2 | |||
3628 | Macrvds.exe | C:\Users\Public\Music\Sample Music\Kalimba.mp3.pornoransom | — | |
MD5:— | SHA256:— |