File name:

shoku32_0201.exe

Full analysis: https://app.any.run/tasks/62f8756a-606b-4dcf-b573-a587274ed2fe
Verdict: Malicious activity
Analysis date: June 20, 2019, 00:37:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E50F2A20021E317C6358EDEE2D9632B8

SHA1:

6D3FDA8AF67A4FDAC6B0E43483CF329F4473A08C

SHA256:

8CCB8F6DDDCF87035959DC16C5DE5289543813C594FC2862BFC652A403AA56F5

SSDEEP:

6144:Mk/tIRDOEPF8BZy/u55khOFHM3kNnXh34dAsn9RiWMraxAAbMEMN9yoEEjICb8w:ztkCEqydhkHMOXhvhrp1EQ9zICb8w

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • shoku32_0201.exe (PID: 3704)

    • Application was dropped or rewritten from another process

      • Shokuin.exe (PID: 292)

  • SUSPICIOUS

    • Creates files in the program directory

      • shoku32_0201.exe (PID: 3704)

    • Modifies the open verb of a shell class

      • shoku32_0201.exe (PID: 3704)

    • Executable content was dropped or overwritten

      • shoku32_0201.exe (PID: 3704)

    • Creates files in the Windows directory

      • shoku32_0201.exe (PID: 3704)

    • Removes files from Windows directory

      • shoku32_0201.exe (PID: 3704)

    • Creates a software uninstall entry

      • shoku32_0201.exe (PID: 3704)

  • INFO

    • Manual execution by user

      • Shokuin.exe (PID: 292)
      • mspaint.exe (PID: 3860)

    • Dropped object may contain Bitcoin addresses

      • shoku32_0201.exe (PID: 3704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1999:05:21 22:48:48+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 8704
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x21af
OSVersion: 4
ImageVersion: 4
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows 16-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: -
FileDescription: 職印くん32インストーラ
FileVersion: 2.1.1.0
LegalCopyright: Copyright (C) 1994,2019, Akihiro Hashi
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start shoku32_0201.exe shokuin.exe no specs mspaint.exe no specs shoku32_0201.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\Shokuin.exe" C:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\Shokuin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
職印くん32
Exit code:
0
Version:
2.01
Modules
Images
c:\program files\hashi's tools\eˆó‚­‚ñ32\shokuin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
908"C:\Users\admin\AppData\Local\Temp\shoku32_0201.exe" C:\Users\admin\AppData\Local\Temp\shoku32_0201.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\systemroot\system32\ntdll.dll
3704"C:\Users\admin\AppData\Local\Temp\shoku32_0201.exe" C:\Users\admin\AppData\Local\Temp\shoku32_0201.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\shoku32_0201.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3860"C:\Windows\system32\mspaint.exe" C:\Windows\system32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mspaint.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
194
Read events
188
Write events
6
Delete events
0

Modification events

(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Eˆó‚­‚ñ32
Operation:writeName:DisplayName
Value:
Eˆó‚­‚ñ32 2.01
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Eˆó‚­‚ñ32
Operation:writeName:UninstallString
Value:
C:\PROGRA~1\HASHI'~1\E32~1\UNINST.EXE C:\PROGRA~1\HASHI'~1\E32~1\INSTALL.LOG
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.shdf
Operation:writeName:
Value:
Shokuin.Document
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shokuin.Document
Operation:writeName:
Value:
Eˆóƒtƒ@ƒCƒ‹
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shokuin.Document\shell\open\command
Operation:writeName:
Value:
C:\PROGRA~1\HASHI'~1\E32~1\Shokuin.exe "%1"
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shokuin.Document\DefaultIcon
Operation:writeName:
Value:
C:\PROGRA~1\HASHI'~1\E32~1\Shokuin.exe,1
Executable files
5
Suspicious files
0
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
3704shoku32_0201.exeC:\Users\admin\AppData\Local\Temp\~GLH0000.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\~GLH0001.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\~GLH0002.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\~GLH0003.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\~GLH0004.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Users\admin\AppData\Local\Temp\GLG4B96.tmp —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\INSTALL.LOGtext
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\readme.txttext
MD5:—
SHA256:—
3704shoku32_0201.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hashi's Tools\Eˆó‚­‚ñ32\Eˆó‚­‚ñ32.lnklnk
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Users\Public\Desktop\Eˆó‚­‚ñ32.lnklnk
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
shoku32_0201.exe