File name:

shoku32_0201.exe

Full analysis: https://app.any.run/tasks/62f8756a-606b-4dcf-b573-a587274ed2fe
Verdict: Malicious activity
Analysis date: June 20, 2019, 00:37:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E50F2A20021E317C6358EDEE2D9632B8

SHA1:

6D3FDA8AF67A4FDAC6B0E43483CF329F4473A08C

SHA256:

8CCB8F6DDDCF87035959DC16C5DE5289543813C594FC2862BFC652A403AA56F5

SSDEEP:

6144:Mk/tIRDOEPF8BZy/u55khOFHM3kNnXh34dAsn9RiWMraxAAbMEMN9yoEEjICb8w:ztkCEqydhkHMOXhvhrp1EQ9zICb8w

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • shoku32_0201.exe (PID: 3704)

    • Application was dropped or rewritten from another process

      • Shokuin.exe (PID: 292)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • shoku32_0201.exe (PID: 3704)

    • Executable content was dropped or overwritten

      • shoku32_0201.exe (PID: 3704)

    • Creates files in the program directory

      • shoku32_0201.exe (PID: 3704)

    • Modifies the open verb of a shell class

      • shoku32_0201.exe (PID: 3704)

    • Removes files from Windows directory

      • shoku32_0201.exe (PID: 3704)

    • Creates a software uninstall entry

      • shoku32_0201.exe (PID: 3704)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • shoku32_0201.exe (PID: 3704)

    • Manual execution by user

      • Shokuin.exe (PID: 292)
      • mspaint.exe (PID: 3860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1999:05:21 22:48:48+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 8704
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x21af
OSVersion: 4
ImageVersion: 4
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows 16-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: -
FileDescription: 職印くん32インストーラ
FileVersion: 2.1.1.0
LegalCopyright: Copyright (C) 1994,2019, Akihiro Hashi
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start shoku32_0201.exe shokuin.exe no specs mspaint.exe no specs shoku32_0201.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\Shokuin.exe" C:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\Shokuin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
職印くん32
Exit code:
0
Version:
2.01
Modules
Images
c:\program files\hashi's tools\eˆó‚­‚ñ32\shokuin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
908"C:\Users\admin\AppData\Local\Temp\shoku32_0201.exe" C:\Users\admin\AppData\Local\Temp\shoku32_0201.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\systemroot\system32\ntdll.dll
3704"C:\Users\admin\AppData\Local\Temp\shoku32_0201.exe" C:\Users\admin\AppData\Local\Temp\shoku32_0201.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\shoku32_0201.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3860"C:\Windows\system32\mspaint.exe" C:\Windows\system32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mspaint.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
194
Read events
188
Write events
6
Delete events
0

Modification events

(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Eˆó‚­‚ñ32
Operation:writeName:DisplayName
Value:
Eˆó‚­‚ñ32 2.01
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Eˆó‚­‚ñ32
Operation:writeName:UninstallString
Value:
C:\PROGRA~1\HASHI'~1\E32~1\UNINST.EXE C:\PROGRA~1\HASHI'~1\E32~1\INSTALL.LOG
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.shdf
Operation:writeName:
Value:
Shokuin.Document
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shokuin.Document
Operation:writeName:
Value:
Eˆóƒtƒ@ƒCƒ‹
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shokuin.Document\shell\open\command
Operation:writeName:
Value:
C:\PROGRA~1\HASHI'~1\E32~1\Shokuin.exe "%1"
(PID) Process:(3704) shoku32_0201.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shokuin.Document\DefaultIcon
Operation:writeName:
Value:
C:\PROGRA~1\HASHI'~1\E32~1\Shokuin.exe,1
Executable files
5
Suspicious files
0
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
3704shoku32_0201.exeC:\Users\admin\AppData\Local\Temp\~GLH0000.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\~GLH0001.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\~GLH0002.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\~GLH0003.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\~GLH0004.TMP —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Users\admin\AppData\Local\Temp\GLG4B96.tmp —
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\readme.txttext
MD5:—
SHA256:—
3704shoku32_0201.exeC:\Users\admin\AppData\Local\Temp\GLK3FEB.tmpexecutable
MD5:BFC6EF2F908D777014BE6130F9FE9CA9
SHA256:1884778EE77B0D7FA8D5E6D0F8228789A34481B5DA47FCC4D841A277F1A28C9C
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\UNINST.EXEexecutable
MD5:A73B05A399E5AA3F54889760986A58B5
SHA256:A5954188660936D5E05E727D893E95851F33D1CCECAD3C37485276A4BDB3758F
3704shoku32_0201.exeC:\Program Files\Hashi's Tools\Eˆó‚­‚ñ32\Shokuin.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
shoku32_0201.exe