File name:

VDeck Setup.exe

Full analysis: https://app.any.run/tasks/0affe5f5-70db-4567-8501-5ecd73f23ab1
Verdict: Malicious activity
Analysis date: August 04, 2024, 08:26:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

AA53626F27F7C2D0428D81F5F3EC02AC

SHA1:

52DAC85B5D3E0491BB05C7DD6D88842409B4E0FF

SHA256:

8AAD43ED10153B766F0C7077748CBABF4BFE98B62CA6FE1AD6A5A0840F4B7BB2

SSDEEP:

393216:146yJD4ZsZ+ppr6qaT0rgLKZ8ArsFrALySJwgAFhaes:+6m4Z8uptaT0oAwNALyy+U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VDeck Setup.exe (PID: 6608)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • VDeck Setup.exe (PID: 6608)

    • Process drops legitimate windows executable

      • VDeck Setup.exe (PID: 6608)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • VDeck Setup.exe (PID: 6608)

    • The process creates files with name similar to system file names

      • VDeck Setup.exe (PID: 6608)

    • Creates a software uninstall entry

      • VDeck Setup.exe (PID: 6608)

    • The process drops C-runtime libraries

      • VDeck Setup.exe (PID: 6608)

  • INFO

    • Creates files in the program directory

      • VDeck Setup.exe (PID: 6608)
      • VDeck.exe (PID: 6336)

    • Creates files or folders in the user directory

      • VDeck Setup.exe (PID: 6608)

    • Create files in a temporary directory

      • VDeck Setup.exe (PID: 6608)

    • Checks supported languages

      • VDeck.exe (PID: 6336)

    • Reads the computer name

      • VDeck.exe (PID: 6336)

    • Reads the machine GUID from the registry

      • VDeck.exe (PID: 6336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:43+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x3645
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.0.0
ProductVersionNumber: 1.2.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: VDeck Team
FileDescription: VDeck
FileVersion: 1.2.0.0
LegalCopyright: Copyright 2024 © VDeck
ProductName: VDeck
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vdeck setup.exe vdeck.exe no specs vdeck setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6336"C:\Program Files (x86)\VDeck\VDeck.exe"C:\Program Files (x86)\VDeck\VDeck.exe—VDeck Setup.exe
User:
admin
Company:
VDeck
Integrity Level:
HIGH
Description:
VDeck
Version:
1.0.0.0
Modules
Images
c:\program files (x86)\vdeck\vdeck.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6560"C:\Users\admin\AppData\Local\Temp\VDeck Setup.exe" C:\Users\admin\AppData\Local\Temp\VDeck Setup.exe—explorer.exe
User:
admin
Company:
VDeck Team
Integrity Level:
MEDIUM
Description:
VDeck
Exit code:
3221226540
Version:
1.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\vdeck setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6608"C:\Users\admin\AppData\Local\Temp\VDeck Setup.exe" C:\Users\admin\AppData\Local\Temp\VDeck Setup.exe
explorer.exe
User:
admin
Company:
VDeck Team
Integrity Level:
HIGH
Description:
VDeck
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\windows\syswow64\riched20.dll
c:\windows\syswow64\usp10.dll
c:\windows\syswow64\msls31.dll
c:\users\admin\appdata\local\temp\nss681e.tmp\installoptions.dll
c:\windows\syswow64\comdlg32.dll
c:\windows\syswow64\linkinfo.dll
c:\windows\syswow64\ntshrui.dll
c:\windows\syswow64\sspicli.dll
c:\windows\syswow64\srvcli.dll
c:\windows\syswow64\cscapi.dll
Total events
269
Read events
263
Write events
6
Delete events
0

Modification events

(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:DisplayName
Value:
VDeck
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\VDeck\VDeck.exe
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:DisplayVersion
Value:
1.2.0.0
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:Publisher
Value:
VDeck Team
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:URLInfoAbout
Value:
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:Installer Language
Value:
1033
Executable files
465
Suspicious files
3
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6608VDeck Setup.exeC:\Users\admin\AppData\Local\Temp\nss681E.tmp\ioSpecial.iniini
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
6608VDeck Setup.exeC:\Users\admin\AppData\Local\Temp\nss681E.tmp\LangDLL.dllexecutable
MD5:50016010FB0D8DB2BC4CD258CEB43BE5
SHA256:32230128C18574C1E860DFE4B17FE0334F685740E27BC182E0D525A8948C9C2E
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\D3DCompiler_47_cor3.dllexecutable
MD5:D935C9F57AA56B90AE4DA0A0BB280E0F
SHA256:F8C35B65524C60AA1765B13DC96A92A16D5570827B7FE6CCABFA9859D2A6AD60
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\Microsoft.Win32.Primitives.dllexecutable
MD5:300C95FF95B52E8A02FEC6BFCFA58225
SHA256:F1B40565E5C4C41DA810AEE5B7D2272A0906E88F796812435AA5ED712BCAC40C
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\PresentationFramework-SystemData.dllexecutable
MD5:15B38687A26423B61A28E9B825AC984C
SHA256:6CFF440D61D78103C4656F822181AA79F2C4FDD775BC4BA0A828CDF3D4C8248A
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\Microsoft.Win32.SystemEvents.dllexecutable
MD5:4D48D0E122614BCD5101DF52FC7C8F29
SHA256:FFD00E19744E3E67BF2354C05EC354B728D2649E339EA3F1474CA4B70E1A4CB1
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\Microsoft.Win32.Registry.AccessControl.dllexecutable
MD5:ACE8A8DD508B744D06D635E324773467
SHA256:8641AFF92DCA11DF7D8F8A5DFDE76C1F4D47F3619C3569B6D4E69A44D9A3C709
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\PenImc_cor3.dllexecutable
MD5:BB718778D28B5DB972A3ABD8E61FD4C4
SHA256:3DBC15831B6DD8BA4B47CB4DB8B3AE0CA15FE8BC3EBDB137A252B17FB9C8A85C
6608VDeck Setup.exeC:\Users\admin\AppData\Local\Temp\nss681E.tmp\modern-wizard.bmpimage
MD5:C520757422DF263588D99C056383D5D3
SHA256:0357586DB9BB15BCCB3927C57292C02E58A78E6BCD8071A267FE4B82893C6BED
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\Accessibility.dllexecutable
MD5:FB554F9FE0B91F135D26AC6459CFD6F2
SHA256:929EA150AD45B7C7DD5427461FBEC44D43B67C08081F59B42B6ABF570FEAE271
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
37
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3068
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6980
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6944
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5336
SearchApp.exe
2.23.209.150:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3068
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3068
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 2.23.209.150
  • 2.23.209.140
  • 2.23.209.148
  • 2.23.209.158
  • 2.23.209.154
  • 2.23.209.176
  • 2.23.209.149
  • 2.23.209.160
  • 2.23.209.141
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.64
  • 20.190.159.0
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.4
  • 40.126.31.71
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted
th.bing.com
  • 2.23.209.183
  • 2.23.209.185
  • 2.23.209.177
  • 2.23.209.158
  • 2.23.209.176
  • 2.23.209.179
  • 2.23.209.160
  • 2.23.209.182
  • 2.23.209.181
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VDeck Setup.exe