File name:

6.rar

Full analysis: https://app.any.run/tasks/338466d3-cd97-4333-aff7-1e8228bf5d66
Verdict: Malicious activity
Analysis date: April 23, 2019, 09:07:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

02564D0BD314556D9CE43B6809C5689A

SHA1:

6D5E2AE3EB28C4FF7FEA8B75E709429EB0C1B8A2

SHA256:

8E84AB33FC1AA797026E6834625998E6A96B99A28657FCE16884563674C99341

SSDEEP:

6144:3T1+s4jsjjSznoPau+z5ozjO6NgXUkeG6fvaYJeChc:3TqsjunEde5cjO6yXUkYvxEJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads settings of System Certificates

      • Proxy Shark 2015 v2.7.exe (PID: 3372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs proxy shark 2015  v2.7.exe

Process information

PID
CMD
Path
Indicators
Parent process
3372"C:\Users\admin\Desktop\Proxy Shark 2015\Proxy Shark 2015 v2.7.exe" C:\Users\admin\Desktop\Proxy Shark 2015\Proxy Shark 2015 v2.7.exe
explorer.exe
User:
admin
Company:
Pooria Sharaffodin www.ProxyShark.net - www.Babatools.com
Integrity Level:
MEDIUM
Description:
Proxy Shark 2015 (Vip Pro Edition) v2.7
Exit code:
0
Version:
2.7.0.0
Modules
Images
c:\users\admin\desktop\proxy shark 2015\proxy shark 2015 v2.7.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3848"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\6.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
475
Read events
445
Write events
30
Delete events
0

Modification events

(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3848) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\6.rar
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3372) Proxy Shark 2015 v2.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Proxy Shark 2015 v2_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3372) Proxy Shark 2015 v2.7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Proxy Shark 2015 v2_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
5
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.2141\Proxy Shark 2015\Proxy Shark 2015 v2.7.exe —
MD5:—
SHA256:—
3372Proxy Shark 2015 v2.7.exeC:\Users\admin\AppData\Local\Temp\CabD04D.tmp —
MD5:—
SHA256:—
3372Proxy Shark 2015 v2.7.exeC:\Users\admin\AppData\Local\Temp\TarD04E.tmp —
MD5:—
SHA256:—
3372Proxy Shark 2015 v2.7.exeC:\Users\admin\AppData\Local\Temp\CabD07E.tmp —
MD5:—
SHA256:—
3372Proxy Shark 2015 v2.7.exeC:\Users\admin\AppData\Local\Temp\TarD07F.tmp —
MD5:—
SHA256:—
3372Proxy Shark 2015 v2.7.exeC:\Users\admin\AppData\Local\Temp\CabD10D.tmp —
MD5:—
SHA256:—
3372Proxy Shark 2015 v2.7.exeC:\Users\admin\AppData\Local\Temp\TarD10E.tmp —
MD5:—
SHA256:—
3372Proxy Shark 2015 v2.7.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015compressed
MD5:—
SHA256:—
3372Proxy Shark 2015 v2.7.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416binary
MD5:—
SHA256:—
3372Proxy Shark 2015 v2.7.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
81
TCP/UDP connections
8
DNS requests
7
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3372
Proxy Shark 2015 v2.7.exe
GET
302
216.105.38.10:80
http://proxysearcher.sourceforge.net/ProxyList.php?type=http&filtered=true
US
—
—
malicious
3372
Proxy Shark 2015 v2.7.exe
GET
200
216.105.38.10:80
http://proxysearcher.sourceforge.net/Proxy%20List.php?type=http&filtered=true
US
html
77.8 Kb
malicious
3372
Proxy Shark 2015 v2.7.exe
GET
200
172.217.16.129:80
http://newfreshproxies24.blogspot.com/
US
html
5.40 Kb
whitelisted
3372
Proxy Shark 2015 v2.7.exe
GET
403
158.69.213.59:80
http://free-proxy.cz/en/proxylist/main/9
CA
html
162 b
whitelisted
3372
Proxy Shark 2015 v2.7.exe
GET
301
18.218.46.130:80
http://www.xroxy.com/free-proxy-list/?port=&type=&ssl=&country=&latency=&reliability=&sort=reliability&desc=true&pnum=0
US
html
359 b
suspicious
3372
Proxy Shark 2015 v2.7.exe
GET
403
158.69.213.59:80
http://free-proxy.cz/en/proxylist/main/8
CA
html
162 b
whitelisted
3372
Proxy Shark 2015 v2.7.exe
GET
403
158.69.213.59:80
http://free-proxy.cz/en/proxylist/main/1
CA
html
162 b
whitelisted
3372
Proxy Shark 2015 v2.7.exe
GET
302
172.217.16.129:80
http://newfreshproxies24.blogspot.de/
US
html
220 b
whitelisted
3372
Proxy Shark 2015 v2.7.exe
GET
403
158.69.213.59:80
http://free-proxy.cz/en/proxylist/main/3
CA
html
162 b
whitelisted
3372
Proxy Shark 2015 v2.7.exe
GET
403
158.69.213.59:80
http://free-proxy.cz/en/proxylist/main/4
CA
html
162 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3372
Proxy Shark 2015 v2.7.exe
172.217.16.129:80
newfreshproxies24.blogspot.de
Google Inc.
US
whitelisted
3372
Proxy Shark 2015 v2.7.exe
158.69.213.59:80
free-proxy.cz
OVH SAS
CA
suspicious
3372
Proxy Shark 2015 v2.7.exe
18.218.46.130:80
www.xroxy.com
Amazon.com, Inc.
US
unknown
3372
Proxy Shark 2015 v2.7.exe
18.218.46.130:443
www.xroxy.com
Amazon.com, Inc.
US
unknown
3372
Proxy Shark 2015 v2.7.exe
143.204.208.222:80
x.ss2.us
—
US
suspicious
—
—
8.248.247.254:80
www.download.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
3372
Proxy Shark 2015 v2.7.exe
216.105.38.10:80
proxysearcher.sourceforge.net
American Internet Services, LLC.
US
malicious

DNS requests

Domain
IP
Reputation
newfreshproxies24.blogspot.de
  • 172.217.16.129
whitelisted
proxysearcher.sourceforge.net
  • 216.105.38.10
malicious
free-proxy.cz
  • 158.69.213.59
whitelisted
newfreshproxies24.blogspot.com
  • 172.217.16.129
whitelisted
www.xroxy.com
  • 18.218.46.130
  • 3.18.41.3
suspicious
x.ss2.us
  • 143.204.208.222
  • 143.204.208.196
  • 143.204.208.228
  • 143.204.208.42
whitelisted
www.download.windowsupdate.com
  • 8.248.247.254
  • 8.248.243.254
  • 8.247.205.126
  • 8.247.201.254
  • 8.247.206.254
whitelisted

Threats

PID
Process
Class
Message
3372
Proxy Shark 2015 v2.7.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
No debug info