File name:

VDeck Setup.exe

Full analysis: https://app.any.run/tasks/0affe5f5-70db-4567-8501-5ecd73f23ab1
Verdict: Malicious activity
Analysis date: August 04, 2024, 08:26:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

AA53626F27F7C2D0428D81F5F3EC02AC

SHA1:

52DAC85B5D3E0491BB05C7DD6D88842409B4E0FF

SHA256:

8AAD43ED10153B766F0C7077748CBABF4BFE98B62CA6FE1AD6A5A0840F4B7BB2

SSDEEP:

393216:146yJD4ZsZ+ppr6qaT0rgLKZ8ArsFrALySJwgAFhaes:+6m4Z8uptaT0oAwNALyy+U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VDeck Setup.exe (PID: 6608)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • VDeck Setup.exe (PID: 6608)

    • Process drops legitimate windows executable

      • VDeck Setup.exe (PID: 6608)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • VDeck Setup.exe (PID: 6608)

    • Creates a software uninstall entry

      • VDeck Setup.exe (PID: 6608)

    • The process drops C-runtime libraries

      • VDeck Setup.exe (PID: 6608)

    • The process creates files with name similar to system file names

      • VDeck Setup.exe (PID: 6608)

  • INFO

    • Creates files in the program directory

      • VDeck Setup.exe (PID: 6608)
      • VDeck.exe (PID: 6336)

    • Creates files or folders in the user directory

      • VDeck Setup.exe (PID: 6608)

    • Checks supported languages

      • VDeck.exe (PID: 6336)

    • Create files in a temporary directory

      • VDeck Setup.exe (PID: 6608)

    • Reads the machine GUID from the registry

      • VDeck.exe (PID: 6336)

    • Reads the computer name

      • VDeck.exe (PID: 6336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:43+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x3645
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.0.0
ProductVersionNumber: 1.2.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: VDeck Team
FileDescription: VDeck
FileVersion: 1.2.0.0
LegalCopyright: Copyright 2024 © VDeck
ProductName: VDeck
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vdeck setup.exe vdeck.exe no specs vdeck setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6336"C:\Program Files (x86)\VDeck\VDeck.exe"C:\Program Files (x86)\VDeck\VDeck.exe—VDeck Setup.exe
User:
admin
Company:
VDeck
Integrity Level:
HIGH
Description:
VDeck
Version:
1.0.0.0
Modules
Images
c:\program files (x86)\vdeck\vdeck.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6560"C:\Users\admin\AppData\Local\Temp\VDeck Setup.exe" C:\Users\admin\AppData\Local\Temp\VDeck Setup.exe—explorer.exe
User:
admin
Company:
VDeck Team
Integrity Level:
MEDIUM
Description:
VDeck
Exit code:
3221226540
Version:
1.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\vdeck setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6608"C:\Users\admin\AppData\Local\Temp\VDeck Setup.exe" C:\Users\admin\AppData\Local\Temp\VDeck Setup.exe
explorer.exe
User:
admin
Company:
VDeck Team
Integrity Level:
HIGH
Description:
VDeck
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\windows\syswow64\riched20.dll
c:\windows\syswow64\usp10.dll
c:\windows\syswow64\msls31.dll
c:\users\admin\appdata\local\temp\nss681e.tmp\installoptions.dll
c:\windows\syswow64\comdlg32.dll
c:\windows\syswow64\linkinfo.dll
c:\windows\syswow64\ntshrui.dll
c:\windows\syswow64\sspicli.dll
c:\windows\syswow64\srvcli.dll
c:\windows\syswow64\cscapi.dll
Total events
269
Read events
263
Write events
6
Delete events
0

Modification events

(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:DisplayName
Value:
VDeck
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\VDeck\VDeck.exe
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:DisplayVersion
Value:
1.2.0.0
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:Publisher
Value:
VDeck Team
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:URLInfoAbout
Value:
(PID) Process:(6608) VDeck Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VDeck
Operation:writeName:Installer Language
Value:
1033
Executable files
465
Suspicious files
3
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\D3DCompiler_47_cor3.dllexecutable
MD5:D935C9F57AA56B90AE4DA0A0BB280E0F
SHA256:F8C35B65524C60AA1765B13DC96A92A16D5570827B7FE6CCABFA9859D2A6AD60
6608VDeck Setup.exeC:\Users\admin\AppData\Local\Temp\nss681E.tmp\modern-wizard.bmpimage
MD5:C520757422DF263588D99C056383D5D3
SHA256:0357586DB9BB15BCCB3927C57292C02E58A78E6BCD8071A267FE4B82893C6BED
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\Microsoft.DiaSymReader.Native.x86.dllexecutable
MD5:AEDF37FAD08AED1AFE96CD09B45FB512
SHA256:149BA70FA4AFCF113711FEF6F014B73D5FC98BF0E4109766A626FA023D2BAF49
6608VDeck Setup.exeC:\Users\admin\AppData\Local\Temp\nss681E.tmp\ioSpecial.iniini
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\Microsoft.CSharp.dllexecutable
MD5:174035B438E4702E17C4619B976E617B
SHA256:8307FA548C31A3B5BB4330F191367EFFE165F14FEAFA6DA472DB82FBD85669D6
6608VDeck Setup.exeC:\Users\admin\AppData\Local\Temp\nss681E.tmp\LangDLL.dllexecutable
MD5:50016010FB0D8DB2BC4CD258CEB43BE5
SHA256:32230128C18574C1E860DFE4B17FE0334F685740E27BC182E0D525A8948C9C2E
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\DirectWriteForwarder.dllexecutable
MD5:A9A9F93A3B9F359F3AE974FE4B4F8906
SHA256:B54F75DB8E5E8A6A767170FED167034F3DCBAB632FBE678B107D97FCD6746D97
6608VDeck Setup.exeC:\Users\admin\AppData\Local\Temp\nss681E.tmp\InstallOptions.dllexecutable
MD5:D095B082B7C5BA4665D40D9C5042AF6D
SHA256:B2091205E225FC07DAF1101218C64CE62A4690CACAC9C3D0644D12E93E4C213C
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\Microsoft.VisualBasic.Core.dllexecutable
MD5:704CA729EB1D358AD5FD31FDA368409A
SHA256:6E9C6D2355E14FAA10BA8C655F4EABBB2DF4F7FDE411E870D91D5C8FFBE07446
6608VDeck Setup.exeC:\Program Files (x86)\VDeck\Microsoft.Win32.Primitives.dllexecutable
MD5:300C95FF95B52E8A02FEC6BFCFA58225
SHA256:F1B40565E5C4C41DA810AEE5B7D2272A0906E88F796812435AA5ED712BCAC40C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
37
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3068
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6944
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6980
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5336
SearchApp.exe
2.23.209.150:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3068
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3068
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 2.23.209.150
  • 2.23.209.140
  • 2.23.209.148
  • 2.23.209.158
  • 2.23.209.154
  • 2.23.209.176
  • 2.23.209.149
  • 2.23.209.160
  • 2.23.209.141
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.64
  • 20.190.159.0
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.4
  • 40.126.31.71
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted
th.bing.com
  • 2.23.209.183
  • 2.23.209.185
  • 2.23.209.177
  • 2.23.209.158
  • 2.23.209.176
  • 2.23.209.179
  • 2.23.209.160
  • 2.23.209.182
  • 2.23.209.181
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VDeck Setup.exe