URL:

download.edrawsoft.com/inst/edraw-max_setup_full5517.exe

Full analysis: https://app.any.run/tasks/014a1c9a-60b5-4753-b1f2-dfbbe1273351
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 13, 2024, 07:57:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

59831D42DA679E39790F7627031ECEE5

SHA1:

2C9E867E11EB5E1C66B9AA2E92FA02ECD4A4ACE0

SHA256:

88E2D1447859BDF33EF1F3D0F44690E53C8696F2211B1B2277B056EDBAD020E4

SSDEEP:

3:ZKWeS8tDiWy6IPUS0dA:ZleSQDiWybsS0dA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • edraw-max_setup_full5517.exe (PID: 3308)
      • edraw-max_full5517.exe (PID: 3192)
      • edraw-max_full5517.tmp (PID: 2656)

  • SUSPICIOUS

    • Reads the Internet Settings

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Reads security settings of Internet Explorer

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Reads Microsoft Outlook installation path

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Reads Internet Explorer settings

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Executable content was dropped or overwritten

      • edraw-max_setup_full5517.exe (PID: 3308)
      • edraw-max_full5517.exe (PID: 3192)
      • edraw-max_full5517.tmp (PID: 2656)

    • Likely accesses (executes) a file from the Public directory

      • NFWCHK.exe (PID: 2592)
      • edraw-max_full5517.exe (PID: 3192)
      • edraw-max_full5517.tmp (PID: 2656)

    • Connects to unusual port

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Checks Windows Trust Settings

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Reads settings of System Certificates

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Process requests binary or script from the Internet

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Process drops legitimate windows executable

      • edraw-max_full5517.tmp (PID: 2656)

    • The process drops C-runtime libraries

      • edraw-max_full5517.tmp (PID: 2656)

    • Process drops SQLite DLL files

      • edraw-max_full5517.tmp (PID: 2656)

    • Reads the Windows owner or organization settings

      • edraw-max_full5517.tmp (PID: 2656)

  • INFO

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2856)
      • iexplore.exe (PID: 2120)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2856)
      • iexplore.exe (PID: 2120)

    • Application launched itself

      • iexplore.exe (PID: 2120)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2120)

    • Checks supported languages

      • edraw-max_setup_full5517.exe (PID: 3308)
      • NFWCHK.exe (PID: 2592)
      • edraw-max_full5517.exe (PID: 3192)
      • edraw-max_full5517.tmp (PID: 2656)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2120)

    • Reads the computer name

      • edraw-max_setup_full5517.exe (PID: 3308)
      • NFWCHK.exe (PID: 2592)
      • edraw-max_full5517.tmp (PID: 2656)

    • Reads the machine GUID from the registry

      • edraw-max_setup_full5517.exe (PID: 3308)
      • NFWCHK.exe (PID: 2592)

    • Create files in a temporary directory

      • edraw-max_setup_full5517.exe (PID: 3308)
      • edraw-max_full5517.exe (PID: 3192)
      • edraw-max_full5517.tmp (PID: 2656)

    • Checks proxy server information

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Creates files in the program directory

      • edraw-max_setup_full5517.exe (PID: 3308)
      • edraw-max_full5517.tmp (PID: 2656)

    • Reads the software policy settings

      • edraw-max_setup_full5517.exe (PID: 3308)

    • Creates files or folders in the user directory

      • edraw-max_setup_full5517.exe (PID: 3308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe edraw-max_setup_full5517.exe no specs edraw-max_setup_full5517.exe nfwchk.exe no specs edraw-max_full5517.exe edraw-max_full5517.tmp

Process information

PID
CMD
Path
Indicators
Parent process
2120"C:\Program Files\Internet Explorer\iexplore.exe" "download.edrawsoft.com/inst/edraw-max_setup_full5517.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2592C:\Users\Public\Documents\Edrawsoft\NFWCHK.exeC:\Users\Public\Documents\Edrawsoft\NFWCHK.exe—edraw-max_setup_full5517.exe
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
.NET Framework Checker
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\public\documents\edrawsoft\nfwchk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2656"C:\Users\admin\AppData\Local\Temp\is-A87LL.tmp\edraw-max_full5517.tmp" /SL5="$140180,352150602,320000,C:\Users\Public\Documents\Edrawsoft\edraw-max_full5517.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-EdrawMax (CPC).log" /installpath: "C:\Program Files\Edrawsoft\EdrawMax (CPC)\" /DIR="C:\Program Files\Edrawsoft\EdrawMax (CPC)\" /WAEWIN=B017E /PID=5517C:\Users\admin\AppData\Local\Temp\is-A87LL.tmp\edraw-max_full5517.tmp
edraw-max_full5517.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-a87ll.tmp\edraw-max_full5517.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2856"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2120 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3192"C:\Users\Public\Documents\Edrawsoft\edraw-max_full5517.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-EdrawMax (CPC).log" /installpath: "C:\Program Files\Edrawsoft\EdrawMax (CPC)\" /DIR="C:\Program Files\Edrawsoft\EdrawMax (CPC)\" /WAEWIN=B017E /PID=5517C:\Users\Public\Documents\Edrawsoft\edraw-max_full5517.exe
edraw-max_setup_full5517.exe
User:
admin
Company:
EdrawSoft Co.,Ltd.
Integrity Level:
HIGH
Description:
EdrawMax Setup
Version:
13.0.5.1119
Modules
Images
c:\users\public\documents\edrawsoft\edraw-max_full5517.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3308"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\edraw-max_setup_full5517.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\edraw-max_setup_full5517.exe
iexplore.exe
User:
admin
Integrity Level:
HIGH
Description:
edrawmax-(cpc)_setup_full5517.exe
Version:
4.0.4.18
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\edraw-max_setup_full5517.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3724"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\edraw-max_setup_full5517.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\edraw-max_setup_full5517.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Description:
edrawmax-(cpc)_setup_full5517.exe
Exit code:
3221226540
Version:
4.0.4.18
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\edraw-max_setup_full5517.exe
c:\windows\system32\ntdll.dll
Total events
19 165
Read events
18 996
Write events
138
Delete events
31

Modification events

(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31100280
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31100280
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
190
Suspicious files
56
Text files
727
Unknown types
6

Dropped files

PID
Process
Filename
Type
2856iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\edraw-max_setup_full5517[1].exeexecutable
MD5:—
SHA256:—
2856iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\edraw-max_setup_full5517.exe.v3k9p51.partialexecutable
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF161E5F11D048AE76.TMPgmc
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{8AC8DFC5-F96B-11EE-AE0A-12A9866C77DE}.datbinary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\edraw-max_setup_full5517.exe.v3k9p51.partial:Zone.Identifiertext
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\edraw-max_setup_full5517.exeexecutable
MD5:—
SHA256:—
3308edraw-max_setup_full5517.exeC:\Users\admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.logtext
MD5:—
SHA256:—
3308edraw-max_setup_full5517.exeC:\Users\admin\AppData\Local\Temp\wsduilib.logtext
MD5:—
SHA256:—
3308edraw-max_setup_full5517.exeC:\Users\Public\Documents\Edrawsoft\NFWCHK.exeexecutable
MD5:—
SHA256:—
3308edraw-max_setup_full5517.exeC:\Users\Public\Documents\Edrawsoft\NFWCHK.exe.configxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
56
DNS requests
15
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3308
edraw-max_setup_full5517.exe
GET
—
8.209.73.211:80
http://platform.edrawsoft.com/rest/v2/downloader/runtime/?client_sign={c3577d79-3fe0-405f-84cc-740068d87ef2G}&product_id=5517&wae=4.0.4&platform=win_x86
unknown
—
—
—
3308
edraw-max_setup_full5517.exe
HEAD
200
23.48.23.45:80
http://download.edrawsoft.com/cbs_down/edraw-max_full5517.exe
unknown
—
—
—
3308
edraw-max_setup_full5517.exe
HEAD
200
23.48.23.45:80
http://download.edrawsoft.com/cbs_down/edraw-max_full5517.exe
unknown
—
—
—
3308
edraw-max_setup_full5517.exe
HEAD
200
23.48.23.52:80
http://download.edrawsoft.com/cbs_down/edraw-max_full5517.exe
unknown
—
—
—
3308
edraw-max_setup_full5517.exe
GET
—
23.48.23.45:80
http://download.edrawsoft.com/cbs_down/edraw-max_full5517.exe
unknown
—
—
—
3308
edraw-max_setup_full5517.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?35e9e893bb2db86c
unknown
—
—
—
2856
iexplore.exe
GET
200
23.48.23.45:80
http://download.edrawsoft.com/inst/edraw-max_setup_full5517.exe
unknown
—
—
—
3308
edraw-max_setup_full5517.exe
GET
206
23.48.23.52:80
http://download.edrawsoft.com/cbs_down/edraw-max_full5517.exe
unknown
—
—
—
3308
edraw-max_setup_full5517.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEA3EQd5SLWy5mr7JXcu5TKw%3D
unknown
—
—
—
3308
edraw-max_setup_full5517.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2856
iexplore.exe
23.48.23.45:80
download.edrawsoft.com
Akamai International B.V.
DE
unknown
3308
edraw-max_setup_full5517.exe
8.209.72.213:443
pc-api.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
3308
edraw-max_setup_full5517.exe
8.209.73.211:80
platform.edrawsoft.com
Alibaba US Technology Co., Ltd.
DE
unknown
3308
edraw-max_setup_full5517.exe
47.91.89.51:443
prod-web.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
3308
edraw-max_setup_full5517.exe
23.48.23.45:80
download.edrawsoft.com
Akamai International B.V.
DE
unknown
3308
edraw-max_setup_full5517.exe
47.91.90.244:8106
analytics.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
3308
edraw-max_setup_full5517.exe
163.181.157.114:443
wae.wondershare.cc
—
US
unknown

DNS requests

Domain
IP
Reputation
download.edrawsoft.com
  • 23.48.23.45
  • 23.48.23.52
unknown
pc-api.wondershare.cc
  • 8.209.72.213
unknown
platform.edrawsoft.com
  • 8.209.73.211
unknown
prod-web.wondershare.cc
  • 47.91.89.51
unknown
analytics.wondershare.cc
  • 47.91.90.244
unknown
wae.wondershare.cc
  • 163.181.157.114
  • 163.181.157.116
  • 163.181.157.89
  • 163.181.157.115
  • 163.181.157.118
  • 163.181.157.113
  • 163.181.157.88
  • 163.181.157.117
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
iecvlist.microsoft.com
  • 152.199.19.161
unknown
r20swj13mr.microsoft.com
  • 152.199.19.161
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
download.edrawsoft.com/inst/edraw-max_setup_full5517.exe