File name:

gamebox

Full analysis: https://app.any.run/tasks/73f1f7b9-97bb-4387-a5a8-d06a6b9a8706
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: November 11, 2019, 08:31:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4FC118F454A98925ACBE31CF1248ED30

SHA1:

F7BE7369AC5AC13A78FE99B031677A5C17E56566

SHA256:

8E83CCB4D62DB2C9DBCD4A5CC7904643215194AF8078A455A3E9CEDBD386FDDA

SSDEEP:

196608:GYciVkLVFkdaBX/hpo8rGRx/QafPhcI/7eNgFT:vciVGVFk6Xo8rGX1zeyd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • gameboxrun.exe (PID: 1708)
      • yygamebox.exe (PID: 1600)
      • KKTaskSrv.exe (PID: 388)
      • kkbinddown.exe (PID: 564)
      • BoxGameMsg.exe (PID: 3900)

    • Loads the Task Scheduler DLL interface

      • KKTaskSrv.exe (PID: 388)
      • yygamebox.exe (PID: 1600)

    • Connects to CnC server

      • gamebox.exe (PID: 3660)
      • yygamebox.exe (PID: 1600)
      • BoxGameMsg.exe (PID: 3900)

    • Loads dropped or rewritten executable

      • yygamebox.exe (PID: 1600)
      • gamebox.exe (PID: 3660)
      • kkbinddown.exe (PID: 564)

  • SUSPICIOUS

    • Low-level read access rights to disk partition

      • gamebox.exe (PID: 3660)
      • BoxGameMsg.exe (PID: 3900)

    • Reads internet explorer settings

      • yygamebox.exe (PID: 1600)

    • Creates COM task schedule object

      • gamebox.exe (PID: 3660)

    • Modifies the open verb of a shell class

      • gameboxrun.exe (PID: 1708)

    • Creates files in the user directory

      • yygamebox.exe (PID: 1600)
      • gamebox.exe (PID: 3660)
      • kkbinddown.exe (PID: 564)

    • Executable content was dropped or overwritten

      • gamebox.exe (PID: 3660)

    • Creates a software uninstall entry

      • gamebox.exe (PID: 3660)

    • Reads Internet Cache Settings

      • gamebox.exe (PID: 3660)

    • Creates files in the program directory

      • yygamebox.exe (PID: 1600)
      • gamebox.exe (PID: 3660)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • yygamebox.exe (PID: 1600)

    • Reads CPU info

      • yygamebox.exe (PID: 1600)

    • Creates files in the Windows directory

      • KKTaskSrv.exe (PID: 388)

    • Executed via Task Scheduler

      • BoxGameMsg.exe (PID: 3900)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (54.3)
.exe | Win64 Executable (generic) (34.8)
.exe | Win32 Executable (generic) (5.6)
.exe | Generic Win/DOS Executable (2.5)
.exe | DOS Executable Generic (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:12 04:11:29+01:00
PEType: PE32
LinkerVersion: 9
CodeSize: 1049600
InitializedDataSize: 7964160
UninitializedDataSize: -
EntryPoint: 0x4c235
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2018.1.12.1770
ProductVersionNumber: 3.9.59744.1770
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
Comments: 快快游戏
CompanyName: YY Inc.
FileDescription: 快快游戏
FileVersion: 2018.01.12.1770
InternalName: gamebox
LegalCopyright: Copyright © 2007-2018 YY Inc. All rights reserved.
ProductName: 快快游戏
ProductVersion: 3.9.1960288.1770

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 12-Jan-2018 03:11:29
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • e:\DUOWAN_BUILD\build\Build_Src\yygb\yygb\bin\install_update.pdb
Comments: 快快游戏
CompanyName: YY Inc.
FileDescription: 快快游戏
FileVersion: 2018.01.12.1770
InternalName: gamebox
LegalCopyright: Copyright © 2007-2018 YY Inc. All rights reserved.
ProductName: 快快游戏
ProductVersion: 3.9.1960288.1770

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 12-Jan-2018 03:11:29
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x001003B4
0x00100400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.59846
.rdata
0x00102000
0x0003C3BC
0x0003C400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.55977
.data
0x0013F000
0x000099C0
0x00003A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.49114
.rsrc
0x00149000
0x007445AC
0x00744600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.99862
.reloc
0x0088E000
0x00014032
0x00014200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.53409

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.15228
616
Latin 1 / Western European
English - United States
RT_MANIFEST
2
2.54353
296
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
4.35478
3752
Latin 1 / Western European
Chinese - PRC
RT_ICON
4
5.17501
2216
Latin 1 / Western European
Chinese - PRC
RT_ICON
5
3.47748
1384
Latin 1 / Western European
Chinese - PRC
RT_ICON
6
2.83156
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
7
3.44197
4264
Latin 1 / Western European
Chinese - PRC
RT_ICON
8
4.05874
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
9
2.89005
744
Latin 1 / Western European
Chinese - PRC
RT_ICON
10
2.54353
296
Latin 1 / Western European
Chinese - PRC
RT_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
WININET.dll
WS2_32.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
7
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start gamebox.exe gameboxrun.exe no specs yygamebox.exe kktasksrv.exe no specs kkbinddown.exe boxgamemsg.exe gamebox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
388"C:\Program Files\duowan\gamebox\3.9.1960288.1770\KKTaskSrv.exe" -c -t KKTaskSrv -o "快快游戏定时任务" -w "C:\Program Files\duowan\gamebox\3.9.1960288.1770" -p "C:\Program Files\duowan\gamebox\3.9.1960288.1770\popup\BoxGameMsg.exe" -a "--type=kkgame" -r "admin" -m 30C:\Program Files\duowan\gamebox\3.9.1960288.1770\KKTaskSrv.exe—yygamebox.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\program files\duowan\gamebox\3.9.1960288.1770\kktasksrv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
516"C:\Users\admin\AppData\Local\Temp\gamebox.exe" C:\Users\admin\AppData\Local\Temp\gamebox.exe—explorer.exe
User:
admin
Company:
YY Inc.
Integrity Level:
MEDIUM
Description:
快快游戏
Exit code:
3221226540
Version:
2018.01.12.1770
Modules
Images
c:\users\admin\appdata\local\temp\gamebox.exe
c:\systemroot\system32\ntdll.dll
564"C:\Users\admin\AppData\Roaming\duowan\gamebox\config\comstore\kkbinddown.exe" /getinfoex /channel=10_1 /request_url=http://client.gamebox.duowan.com/z/softupdate10_1/index.html /bind_type=2C:\Users\admin\AppData\Roaming\duowan\gamebox\config\comstore\kkbinddown.exe
yygamebox.exe
User:
admin
Company:
YY Inc.
Integrity Level:
HIGH
Description:
快快游戏
Exit code:
0
Version:
2018.01.12.1770
Modules
Images
c:\users\admin\appdata\roaming\duowan\gamebox\config\comstore\kkbinddown.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
1600"C:\Program Files\duowan\gamebox\3.9.1960288.1770\yygamebox.exe" C:\Program Files\duowan\gamebox\3.9.1960288.1770\yygamebox.exe
gameboxrun.exe
User:
admin
Company:
YY Inc.
Integrity Level:
HIGH
Description:
快快游戏
Exit code:
0
Version:
2018.01.12.1770
Modules
Images
c:\program files\duowan\gamebox\3.9.1960288.1770\yygamebox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\duowan\gamebox\3.9.1960288.1770\gameresmgr.dll
c:\program files\duowan\gamebox\3.9.1960288.1770\hiidomgr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1708"C:\Program Files\duowan\gamebox\gameboxrun.exe" C:\Program Files\duowan\gamebox\gameboxrun.exe—gamebox.exe
User:
admin
Company:
YY Inc.
Integrity Level:
HIGH
Description:
快快游戏
Exit code:
0
Version:
2018.01.12.1770
Modules
Images
c:\program files\duowan\gamebox\gameboxrun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
3660"C:\Users\admin\AppData\Local\Temp\gamebox.exe" C:\Users\admin\AppData\Local\Temp\gamebox.exe
explorer.exe
User:
admin
Company:
YY Inc.
Integrity Level:
HIGH
Description:
快快游戏
Exit code:
0
Version:
2018.01.12.1770
Modules
Images
c:\users\admin\appdata\local\temp\gamebox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3900"C:\Program Files\duowan\gamebox\3.9.1960288.1770\popup\BoxGameMsg.exe" --type=kkgameC:\Program Files\duowan\gamebox\3.9.1960288.1770\popup\BoxGameMsg.exe
taskeng.exe
User:
admin
Company:
YY Inc.
Integrity Level:
HIGH
Description:
YY浏览器
Exit code:
0
Version:
20170526.30916
Modules
Images
c:\program files\duowan\gamebox\3.9.1960288.1770\popup\boxgamemsg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
1 220
Read events
786
Write events
434
Delete events
0

Modification events

(PID) Process:(3660) gamebox.exeKey:HKEY_CURRENT_USER\Software\duowan\ygdata_report
Operation:writeName:mid
Value:
ae1556ebb95fda10a37dd8ad23233ea8
(PID) Process:(3660) gamebox.exeKey:HKEY_CURRENT_USER\Software\duowan\ygdata_report_hiido
Operation:writeName:mid
Value:
ae1556ebb95fda10a37dd8ad23233ea8
(PID) Process:(3660) gamebox.exeKey:HKEY_CURRENT_USER\Software\duowan\datareportsdk
Operation:writeName:mid_2
Value:
ffdd033190cfb8063b0afe081e0a2165
(PID) Process:(3660) gamebox.exeKey:HKEY_CURRENT_USER\Software\duowan\gamebox
Operation:writeName:InstallDir
Value:
C:\Program Files\duowan\gamebox
(PID) Process:(3660) gamebox.exeKey:HKEY_CURRENT_USER\Software\duowan\gamebox
Operation:writeName:LastVer
Value:
3.9.1960288.1770
(PID) Process:(3660) gamebox.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\快快游戏
Operation:writeName:UninstallString
Value:
C:\Program Files\duowan\gamebox\uninstall.exe
(PID) Process:(3660) gamebox.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\快快游戏
Operation:writeName:DisplayIcon
Value:
C:\Program Files\duowan\gamebox\gameboxrun.exe
(PID) Process:(3660) gamebox.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\快快游戏
Operation:writeName:DisplayName
Value:
快快游戏
(PID) Process:(3660) gamebox.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\快快游戏
Operation:writeName:DisplayVersion
Value:
3.9.1960288.1770
(PID) Process:(3660) gamebox.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\快快游戏
Operation:writeName:Publisher
Value:
多玩游戏网
Executable files
48
Suspicious files
2
Text files
92
Unknown types
5

Dropped files

PID
Process
Filename
Type
3660gamebox.exeC:\Program Files\duowan\gamebox\3.9.1960288.1770\html\kkdown\style\images\btn.gifimage
MD5:—
SHA256:—
3660gamebox.exeC:\Users\admin\AppData\Roaming\duowan\gamebox\config\config.initext
MD5:—
SHA256:—
3660gamebox.exeC:\Users\admin\AppData\Roaming\duowan\gamebox\config\hiido.initext
MD5:—
SHA256:—
3660gamebox.exeC:\Program Files\duowan\gamebox\3.9.1960288.1770\html\kkdown\style\images\loading_bg.gifimage
MD5:—
SHA256:—
3660gamebox.exeC:\Program Files\duowan\gamebox\3.9.1960288.1770\html\kkdown\style\images\loading_blue_center.gifimage
MD5:—
SHA256:—
3660gamebox.exeC:\Program Files\duowan\gamebox\3.9.1960288.1770\html\kkdown\style\images\loading_green_center.gifimage
MD5:—
SHA256:—
3660gamebox.exeC:\Program Files\duowan\gamebox\3.9.1960288.1770\music\downfinish.wavwav
MD5:—
SHA256:—
3660gamebox.exeC:\Program Files\duowan\gamebox\3.9.1960288.1770\html\kkdown\style\images\fail_tips_sj.gifimage
MD5:—
SHA256:—
3660gamebox.exeC:\Program Files\duowan\gamebox\3.9.1960288.1770\html\errpage\images\btn_store.gifimage
MD5:—
SHA256:—
3660gamebox.exeC:\Program Files\duowan\gamebox\3.9.1960288.1770\html\kkdown\style\images\diag_info.gifimage
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
99
TCP/UDP connections
113
DNS requests
28
Threats
25

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3660
gamebox.exe
GET
—
124.232.141.3:80
http://ylog.hiido.com/c.gif?act=zhwebevent&smkdata=0&EC=1&action=7fa49062054e4d7cb9f28434a2ce8597&sdkver=ya-cpp-2.2.4&key=8c64e312ae6878c9d16e3ef480a2f54d&time=1573461128&ati=20191111083207&cha=from_kk_duanyou&hiido_mid=ffdd033190cfb8063b0afe081e0a2165&ive=(3.9.1960288.1770)&lla=zh_cn&mid=ae1556ebb95fda10a37dd8ad23233ea8&os=Windows7&pro=kk_client&rso=from_kk_duanyou&extra=dty%3Dpas%26eid%3Dstartup%26rso_desc%3D%25C2%25BF%25C3%25AC%25C2%25BF%25C3%25AC%25C2%25B6%25C3%258B%25C3%2593%25C3%258E%26sdk_ver%3Dya-cpp-2.2.4%26session_id%3D63614946-6cac-4593-8ffb-e410c72b5438
CN
—
—
malicious
1600
yygamebox.exe
GET
—
14.17.119.61:80
http://trans.hiido.com/zhsdkinfo.php?ver=1&EC=1
CN
—
—
malicious
1600
yygamebox.exe
GET
—
183.218.12.248:80
http://kkupd.gamebox.duowan.com/pluginapp/pluginapp.xml?rad=8233
CN
—
—
unknown
1600
yygamebox.exe
GET
—
124.232.141.3:80
http://ylog.hiido.com/c.gif?act=zhwebevent&smkdata=0&EC=1&action=0e3d32dd565948aa920a5f4f92017c14&sdkver=ya-cpp-2.2.4&key=8b442c0f858a705d0cd30e40174840ca&time=1573461137&ati=20191111083216&cha=from_kk_duanyou&hiido_mid=ffdd033190cfb8063b0afe081e0a2165&ive=(3.9.1960288.1770)&lla=zh_cn&mid=24AF9DC9F0484d0482AE6216D691EB36&os=Windows7&pro=kk_client&rso=from_kk_duanyou&extra=dty%3Dpas%26eid%3Dstartup%26eid_desc%3De%2590%25AFe %25A8%26rso_desc%3DB%25BFC%25ACB%25BFC%25ACB%25B6C%258BC%2593C%26sdk_ver%3Dya-cpp-2.2.4%26session_id%3D6b9a9a9e-0ee2-468e-9b86-bb0e6574b2b4
CN
—
—
malicious
1600
yygamebox.exe
GET
—
120.195.158.46:80
http://mobileapi.kuaikuai.cn/rest/gamebox/game/detail-v115/1977?rad=21124
CN
—
—
whitelisted
3660
gamebox.exe
GET
—
124.232.141.3:80
http://ylog.hiido.com/c.gif?act=zhwebevent&smkdata=0&EC=1&action=b6d8c4b0262544c1968be4718868e90a&sdkver=ya-cpp-2.2.4&key=2db73474d8c1e5232cac940d984d2d40&time=1573461138&ati=20191111083218&cha=from_kk_duanyou&dur=11313&hiido_mid=ffdd033190cfb8063b0afe081e0a2165&ive=(3.9.1960288.1770)&lla=zh_cn&mid=ae1556ebb95fda10a37dd8ad23233ea8&os=Windows7&pro=kk_client&rso=from_kk_duanyou&extra=dty%3Dpas%26eid%3Dheartbeat%26rso_desc%3D%25C2%25BF%25C3%25AC%25C2%25BF%25C3%25AC%25C2%25B6%25C3%258B%25C3%2593%25C3%258E%26sdk_ver%3Dya-cpp-2.2.4%26session_id%3D63614946-6cac-4593-8ffb-e410c72b5438
CN
—
—
malicious
3660
gamebox.exe
GET
—
124.232.141.3:80
http://ylog.hiido.com/c.gif?act=zhwebevent&smkdata=0&EC=1&action=c2cd5815fa6240fb9ac20d775cd45bc0&sdkver=ya-cpp-2.2.4&key=eadfeb354b0158de8dab4a9a44a749ee&time=1573461132&ati=20191111083212&cha=from_kk_duanyou&hiido_mid=ffdd033190cfb8063b0afe081e0a2165&ive=(3.9.1960288.1770)&lla=zh_cn&mid=ae1556ebb95fda10a37dd8ad23233ea8&os=Windows7&pro=kk_client&rso=from_kk_duanyou&extra=dty%3Dpas%26eid%3Dkk_install%2F2%2F1%26eid_desc%3Dan%252Fupgrade%252Fres%26rso_desc%3D%25C2%25BF%25C3%25AC%25C2%25BF%25C3%25AC%25C2%25B6%25C3%258B%25C3%2593%25C3%258E%26sdk_ver%3Dya-cpp-2.2.4%26session_id%3D63614946-6cac-4593-8ffb-e410c72b5438
CN
—
—
malicious
3660
gamebox.exe
GET
—
124.232.141.3:80
http://ylog.hiido.com/c.gif?&act=kkinstall&ver=3.9.1960288.1770&code=24AF9DC9F0484d0482AE6216D691EB36&key=40a5b4de8132a71e8be073f2564e736b&time=1573461132
CN
—
—
malicious
1600
yygamebox.exe
GET
—
124.232.141.3:80
http://ylog.hiido.com/c.gif?act=zhwebevent&smkdata=0&EC=1&action=c0142bfd2bdc4badb459b20982eb5b3c&sdkver=ya-cpp-2.2.4&key=8b442c0f858a705d0cd30e40174840ca&time=1573461137&ati=20191111083216&cha=from_kk_duanyou&hiido_mid=ffdd033190cfb8063b0afe081e0a2165&ive=(3.9.1960288.1770)&lla=zh_cn&mid=24AF9DC9F0484d0482AE6216D691EB36&os=Windows7&pro=kk_client&rso=from_kk_duanyou&extra=dty%3Dpas%26eid%3Dstartup%26rso_desc%3DB%25BFC%25ACB%25BFC%25ACB%25B6C%258BC%2593C%26sdk_ver%3Dya-cpp-2.2.4%26session_id%3D6b9a9a9e-0ee2-468e-9b86-bb0e6574b2b4
CN
—
—
malicious
1600
yygamebox.exe
GET
—
124.232.141.3:80
http://ylog.hiido.com/c.gif?act=zhwebevent&smkdata=0&EC=1&action=984a8374f50d42bda258e88dc7072e2f&sdkver=ya-cpp-2.2.4&key=8b442c0f858a705d0cd30e40174840ca&time=1573461137&ati=20191111083216&cha=from_kk_duanyou&hiido_mid=ffdd033190cfb8063b0afe081e0a2165&ive=(3.9.1960288.1770)&lla=zh_cn&mid=24AF9DC9F0484d0482AE6216D691EB36&os=Windows7&pro=kk_client&rso=from_kk_duanyou&extra=dty%3Dpas%26eid%3Dkk_startup%2Funknown%26eid_desc%3Dan%252Fentrance%26rso_desc%3DB%25BFC%25ACB%25BFC%25ACB%25B6C%258BC%2593C%26sdk_ver%3Dya-cpp-2.2.4%26session_id%3D6b9a9a9e-0ee2-468e-9b86-bb0e6574b2b4
CN
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3660
gamebox.exe
14.17.119.61:80
trans.hiido.com
Guangdong
CN
malicious
3660
gamebox.exe
124.232.141.3:80
ylog.hiido.com
No.293,Wanbao Avenue
CN
malicious
3660
gamebox.exe
14.17.112.251:80
config.hiido.com
CHINANET Guangdong province network
CN
unknown
3660
gamebox.exe
221.228.79.225:80
stat.game.yy.com
No.31,Jin-rong Street
CN
malicious
1600
yygamebox.exe
115.238.171.161:6636
p2pm.kuaikuai.cn
No.31,Jin-rong Street
CN
unknown
564
kkbinddown.exe
58.215.143.2:80
client.gamebox.duowan.com
No.31,Jin-rong Street
CN
unknown
1600
yygamebox.exe
36.99.142.241:80
down.gamebox.duowan.com
No.31,Jin-rong Street
CN
unknown
1600
yygamebox.exe
14.17.112.251:80
config.hiido.com
CHINANET Guangdong province network
CN
unknown
1600
yygamebox.exe
124.232.141.3:80
ylog.hiido.com
No.293,Wanbao Avenue
CN
malicious
1600
yygamebox.exe
183.218.12.248:80
kkupd.gamebox.duowan.com
Guangdong Mobile Communication Co.Ltd.
CN
unknown

DNS requests

Domain
IP
Reputation
trans.hiido.com
  • 14.17.119.61
  • 14.17.119.57
  • 221.228.105.173
malicious
config.hiido.com
  • 14.17.112.251
unknown
ylog.hiido.com
  • 124.232.141.3
  • 14.17.112.235
  • 14.17.112.237
  • 14.17.112.232
  • 14.17.112.234
  • 14.17.112.236
  • 14.17.112.233
malicious
kk.stat.kuaikuai.cn
  • —
unknown
cnlog.hiido.cn
  • 183.61.2.14
  • 183.61.2.13
  • 183.61.2.12
  • 183.61.2.11
unknown
stat.game.yy.com
  • 221.228.79.225
  • 113.107.236.195
  • 14.17.109.66
malicious
f2e.duowan.com
  • 221.228.79.225
  • 113.107.236.195
malicious
p2pm.kuaikuai.cn
  • 115.238.171.161
unknown
client.gamebox.duowan.com
  • 58.215.143.2
unknown
down.gamebox.duowan.com
  • 36.99.142.241
  • 36.99.142.195
  • 36.99.142.248
  • 36.99.142.244
  • 36.99.142.200
  • 36.99.142.243
  • 36.99.142.199
  • 36.99.142.242
suspicious

Threats

PID
Process
Class
Message
3660
gamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
3660
gamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
1600
yygamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
1600
yygamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
1600
yygamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
3660
gamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
3660
gamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
1600
yygamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
1600
yygamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
1600
yygamebox.exe
A Network Trojan was detected
AV TROJAN Ygdata Exfil data CnC
7 ETPRO signatures available at the full report
Process
Message
gamebox.exe
???????:0
yygamebox.exe
20191111_08:32:15 INFO [yygamebox] -- yygamebox??????
yygamebox.exe
20191111_08:32:15 INFO [yygamebox] -- KK_UpdatePopupScheduleTask ????????!
yygamebox.exe
20191111_08:32:15 INFO [yygamebox] -- KK_UpdatePopupScheduleTask ????????!
yygamebox.exe
enter KKDN_LibHelper
yygamebox.exe
*****************************CPhoneDeviceStateWatcher::StartWatch
yygamebox.exe
*****************************CPhoneDeviceStateWatcher::OnStart
yygamebox.exe
*****************************CPhoneDeviceStateWatcher::OnFinished connect empty
yygamebox.exe
20191111_08:32:16 INFO [httpdownload] -- CreateTask()-- lpSrcFile = C:\YYGameBox\tmp\client_message_index.html,lpTarDir=http://client.gamebox.duowan.com/yy/client_message_index.html?rad=10257.
yygamebox.exe
20191111_08:32:16 INFO [httpdownload] -- CreateTask()-- lpSrcFile = C:\YYGameBox\tmp\appinfo.xml,lpTarDir=http://client.gamebox.duowan.com/yy/appinfo.xml?rad=19348.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
gamebox