File name: | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe |
Full analysis: | https://app.any.run/tasks/4eabc327-2625-4022-b57f-c57d41b4a196 |
Verdict: | Malicious activity |
Analysis date: | January 15, 2022, 01:46:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | MS-DOS executable, MZ for MS-DOS |
MD5: | E4A624C0559A614DAE75C90E7B515E09 |
SHA1: | 633C307F61509FFB09CF55F56F905B80E0705F6B |
SHA256: | 8E156F615ED8BF61F64CC940D3493C1D31FDED9BEB66FCFA31AFFFF190FC5DE9 |
SSDEEP: | 24576:PFOazsem63blG+KD3DeulpW/g1gIz6N5Fzqr/+KbLjRWPa4FlBORshGRJxMDdq:tLm6LQxlE/XV5Ir+Kn8a4FlBOyhMxq4 |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2013:04:01 09:08:22+02:00 |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 106496 |
InitializedDataSize: | 12288 |
UninitializedDataSize: | - |
EntryPoint: | 0x290c |
OSVersion: | 4 |
ImageVersion: | 1 |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
FileVersionNumber: | 1.0.0.0 |
ProductVersionNumber: | 1.0.0.0 |
FileFlagsMask: | 0x0000 |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
ProductName: | Project1 |
FileVersion: | 1 |
ProductVersion: | 1 |
InternalName: | TJprojMain |
OriginalFileName: | TJprojMain.exe |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 01-Apr-2013 07:08:22 |
Detected languages: |
|
ProductName: | Project1 |
FileVersion: | 1.00 |
ProductVersion: | 1.00 |
InternalName: | TJprojMain |
OriginalFilename: | TJprojMain.exe |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000B8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 01-Apr-2013 07:08:22 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000191D4 | 0x0001A000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.7348 |
.data | 0x0001B000 | 0x0000180C | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x0001D000 | 0x000013F0 | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.20063 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 4.71018 | 999 | UNKNOWN | English - United States | RT_MANIFEST |
30001 | 4.09473 | 3280 | Unicode (UTF 16LE) | UNKNOWN | RT_ICON |
MSVBVM60.DLL |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3204 | "C:\Users\admin\AppData\Local\Temp\8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe" | C:\Users\admin\AppData\Local\Temp\8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Version: 1.00 Modules
| |||||||||||||||
3948 | "C:\Users\admin\AppData\Local\Temp\8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe" | C:\Users\admin\AppData\Local\Temp\8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.00 Modules
| |||||||||||||||
4020 | c:\users\admin\appdata\local\temp\8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | c:\users\admin\appdata\local\temp\8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe | ||||||||||||
User: admin Company: Akeo Consulting Integrity Level: HIGH Description: Rufus Version: 3.17.1846 Modules
| |||||||||||||||
2616 | C:\Windows\Resources\Themes\icsys.icn.exe | C:\Windows\Resources\Themes\icsys.icn.exe | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.00 Modules
| |||||||||||||||
2752 | C:\Windows\System32\vdsldr.exe -Embedding | C:\Windows\System32\vdsldr.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Virtual Disk Service Loader Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
700 | C:\Windows\System32\vds.exe | C:\Windows\System32\vds.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Virtual Disk Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1292 | c:\windows\resources\themes\explorer.exe | c:\windows\resources\themes\explorer.exe | icsys.icn.exe | ||||||||||||
User: admin Integrity Level: HIGH Version: 1.00 Modules
| |||||||||||||||
2144 | c:\windows\resources\spoolsv.exe SE | c:\windows\resources\spoolsv.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.00 Modules
| |||||||||||||||
2256 | c:\windows\resources\svchost.exe | c:\windows\resources\svchost.exe | spoolsv.exe | ||||||||||||
User: admin Integrity Level: HIGH Version: 1.00 Modules
| |||||||||||||||
3580 | c:\windows\resources\spoolsv.exe PR | c:\windows\resources\spoolsv.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.00 Modules
|
(PID) Process: | (3948) 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe | Key: | HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Explorer\Process |
Operation: | write | Name: | LO |
Value: 1 | |||
(PID) Process: | (4020) 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2616) icsys.icn.exe | Key: | HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Explorer\Process |
Operation: | write | Name: | LO |
Value: 1 | |||
(PID) Process: | (4020) 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{DFC64576-A972-4D9E-B4F9-DD86B0576EC1}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
Operation: | write | Name: | IncludeRecommendedUpdates |
Value: 0 | |||
(PID) Process: | (4020) 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{DFC64576-A972-4D9E-B4F9-DD86B0576EC1}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU |
Operation: | write | Name: | AutoInstallMinorUpdates |
Value: 0 | |||
(PID) Process: | (4020) 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{DFC64576-A972-4D9E-B4F9-DD86B0576EC1}Machine\Software\Policies\Microsoft\Windows Defender |
Operation: | write | Name: | DisableAntiSpyware |
Value: 1 | |||
(PID) Process: | (4020) 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{DFC64576-A972-4D9E-B4F9-DD86B0576EC1}Machine\Software\Policies\Microsoft\Windows Defender\Real-time Protection |
Operation: | write | Name: | DisableRealtimeMonitoring |
Value: 1 | |||
(PID) Process: | (4020) 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{DFC64576-A972-4D9E-B4F9-DD86B0576EC1}Machine\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
Operation: | write | Name: | NoDriveTypeAutorun |
Value: 158 | |||
(PID) Process: | (4020) 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{DFC64576-A972-4D9E-B4F9-DD86B0576EC1}User |
Operation: | delete key | Name: | (default) |
Value: | |||
(PID) Process: | (4020) 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects |
Operation: | delete key | Name: | (default) |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
2144 | spoolsv.exe | C:\Users\admin\AppData\Local\Temp\~DFFBF9CA35B9EB2823.TMP | binary | |
MD5:E952864394D99DE737FB5A367D813FEA | SHA256:3D7A9CD7C94D3EF2099ED181F7BBCFC97855681413507F9F3BB36E691080ED69 | |||
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 | der | |
MD5:54E9306F95F32E50CCD58AF19753D929 | SHA256:45F94DCEB18A8F738A26DA09CE4558995A4FE02B971882E8116FC9B59813BB72 | |||
3948 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe | C:\Windows\Resources\Themes\icsys.icn.exe | executable | |
MD5:1A7463500C06544A24F90EFC898A2C24 | SHA256:C63E40E2F11C7C01991D5E73A1FD9E2722685FEAE86A12405D899CDDEE9F76D7 | |||
2616 | icsys.icn.exe | C:\windows\resources\themes\explorer.exe | executable | |
MD5:5421257C6B2FB53BC65F6C59FF68BA0F | SHA256:83CCD138F55BECDADB204C00C4BA31F82973C2C69D4EC67A4110677686011C03 | |||
1292 | explorer.exe | C:\windows\resources\spoolsv.exe | executable | |
MD5:E1A7BAB3A440AA0684318B6A1D367A0C | SHA256:2EA6CDF98CB9CC4CFD72ABF8FE04532CC95196F59112079774DA593A657710C8 | |||
3948 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe | C:\Users\admin\AppData\Local\Temp\~DFC134D08C079B3757.TMP | binary | |
MD5:55E6D7577378462AAF58ED8230A10380 | SHA256:0CE892827F47C913F3BA69E005565C169174E9C73591AC2E61886FD282D50884 | |||
2144 | spoolsv.exe | C:\windows\resources\svchost.exe | executable | |
MD5:56F0953C343D1A69A3101B12EA5A7C29 | SHA256:9688A7BAD65EF4A9272B330E3EA64885913BD79467AD69B2E7F03EEA4460F1BD | |||
3580 | spoolsv.exe | C:\Users\admin\AppData\Local\Temp\~DF80342740D2C63CCB.TMP | binary | |
MD5:E952864394D99DE737FB5A367D813FEA | SHA256:3D7A9CD7C94D3EF2099ED181F7BBCFC97855681413507F9F3BB36E691080ED69 | |||
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:DB167D62A73C72B80B363E1A99F13585 | SHA256:814944C29F50535BE56B35AFC1CEDF579A4FF4DACE19A13BBD430530EFC58D86 | |||
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:880871146066DA8C4B8B5BDC8BF012A5 | SHA256:07FE7764D62AF8F912CDA1D49032112FAB633005153F5BAF474DBA01E1A1ED22 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTGMlruL6P9M9B3if1rTM7wyj%2FQKQQUUGGmoNI1xBEqII0fD6xC8M0pz0sCEA6L83cNktGW8Lth%2BTxBZr4%3D | US | der | 278 b | whitelisted |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAZnA1u7FP1jr8DWqFNO%2FhY%3D | US | der | 471 b | whitelisted |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D | US | der | 471 b | whitelisted |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | GET | 200 | 23.45.105.185:80 | http://x1.c.lencr.org/ | NL | der | 717 b | whitelisted |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | GET | 200 | 8.253.204.121:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a9b2e1c393cb1c8a | US | compressed | 4.70 Kb | whitelisted |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | GET | 200 | 8.253.204.121:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6673e19e61d5b752 | US | compressed | 59.9 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | 185.199.111.153:443 | rufus.ie | GitHub, Inc. | NL | shared |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | 185.199.108.133:443 | objects.githubusercontent.com | GitHub, Inc. | NL | malicious |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | 23.45.105.185:80 | x1.c.lencr.org | Akamai International B.V. | NL | unknown |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | 8.253.204.121:80 | ctldl.windowsupdate.com | Global Crossing | US | malicious |
4020 | 8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | 140.82.121.3:443 | github.com | — | US | suspicious |
Domain | IP | Reputation |
---|---|---|
rufus.ie |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
github.com |
| shared |
ocsp.digicert.com |
| whitelisted |
objects.githubusercontent.com |
| shared |
Process | Message |
---|---|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | *** Rufus init ***
|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Binary executable is signed by 'Akeo Consulting'
|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | Will use settings from registry
|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | loc file not found in current directory - embedded one will be used
|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | localization: extracted data to 'C:\Users\admin\AppData\Local\Temp\RufEB0F.tmp'
|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | localization: found locale 'en-US'
|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | localization: found locale 'ar-SA'
|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | embedded.loc(408): the version of this translation is older than the base one and may result in some messages not being properly translated.
If you are the translator, please update your translation with the changes that intervened between v3.5 and v3.14.
See https://github.com/pbatard/rufus/blob/master/res/loc/ChangeLog.txt
|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | localization: found locale 'bg-BG'
|
8e156f615ed8bf61f64cc940d3493c1d31fded9beb66fcfa31affff190fc5de9.exe� | embedded.loc(762): the version of this translation is older than the base one and may result in some messages not being properly translated.
If you are the translator, please update your translation with the changes that intervened between v3.5 and v3.14.
See https://github.com/pbatard/rufus/blob/master/res/loc/ChangeLog.txt
|