File name:

13635053139.zip

Full analysis: https://app.any.run/tasks/1d70c32a-3a27-421a-a49c-94c2260b4853
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 19, 2023, 07:43:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

14E906CB832F14F66E80F5778EF4D8D3

SHA1:

FFDFC14AA00DDF7F02F3F836D94EFB6CDC43C86E

SHA256:

8E8B8B81F4DDEE2C7C53FD7AA1D6F8B6DE5AA6DA52DE0B2C425EB14EE94DFFB6

SSDEEP:

98304:6HYBVxJ2v7HyHHUcfY03Ro0jOSYD0QA6FQCKdWlNnj7BWOYZ8ki1cKfOSIGrEmCP:Tm7fE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • game.exe (PID: 1496)

  • SUSPICIOUS

    • Reads the Internet Settings

      • game.exe (PID: 1496)

    • Process requests binary or script from the Internet

      • game.exe (PID: 1496)

    • Drops 7-zip archiver for unpacking

      • game.exe (PID: 1496)

  • INFO

    • Reads product name

      • game.exe (PID: 1496)

    • Manual execution by a user

      • game.exe (PID: 1496)

    • Checks supported languages

      • game.exe (PID: 1496)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2036)

    • Reads the computer name

      • game.exe (PID: 1496)

    • Reads Environment values

      • game.exe (PID: 1496)

    • Creates files or folders in the user directory

      • game.exe (PID: 1496)

    • Checks proxy server information

      • game.exe (PID: 1496)

    • Reads the machine GUID from the registry

      • game.exe (PID: 1496)

    • Create files in a temporary directory

      • game.exe (PID: 1496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xa85db53c
ZipCompressedSize: 3422465
ZipUncompressedSize: 4369800
ZipFileName: 14c49f7b950ebe76cd9142d5bcd6997ae6f7240ccc34a375874d4cc5877eb6f5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs game.exe

Process information

PID
CMD
Path
Indicators
Parent process
1496"C:\Users\admin\Desktop\game.exe" C:\Users\admin\Desktop\game.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
游戏微端
Exit code:
0
Version:
65535.0.260.1007
Modules
Images
c:\users\admin\desktop\game.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2036"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\13635053139.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
1 324
Read events
1 272
Write events
52
Delete events
0

Modification events

(PID) Process:(2036) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
12
Suspicious files
8
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\NetBridge.zip.tempcompressed
MD5:4B0B04E9057182CA4EB4B604510DB969
SHA256:8D70DBD844505235BB2DAD874C153E1544FE088C8E0C96E07DFC39C36D9156F8
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\ui.uicompressed
MD5:D4AF9A12EDD4ED099CE981C2170EC71A
SHA256:7043870ED1D420709FA828218162B85F5C1B3676493A6C32B6DE16A041C7A425
1496game.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\wan[1].txttext
MD5:444BCB3A3FCF8389296C49467F27E1D6
SHA256:2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\NetBridge.zipbinary
MD5:275392C38624B06D5C7E8B27702F5F13
SHA256:F6001E3865BDB25DFDEF3CA6D2E305651F3EE24DBF965C237C725F5518902C13
1496game.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\wan[1].txttext
MD5:444BCB3A3FCF8389296C49467F27E1D6
SHA256:2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\Utils\7z.dllexecutable
MD5:C4AA6D9E72A1721B3F65646E04E702CF
SHA256:D4298C89FC52459842E7658EBF3AA34A9F6E061A97B8984790239609B492F696
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\res.7zbinary
MD5:E657FFA7589B017A8898967318309299
SHA256:F11D22F98FBE74AEED19F72785BBBD6F6CC4FCEA138AE77798A69B21E3571A21
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\res.7z.tempcompressed
MD5:D540DAA0AB2D26676D84D6C60D29ABE1
SHA256:AF42B069D7B667074A15D9747D4F16F91EAA5137AF3EA370390D60DD8BECC640
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\CefHelper.dllexecutable
MD5:3174D34D57B134B5199A0A71FAD6E05F
SHA256:F3CADA2143700C405B283E04A043BCE6397F7E986E02DF34905657F976CC681E
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\progress.gifimage
MD5:EF09AFA5BF49F5B03B7E8CC5B7AA7E33
SHA256:2A5A7ACE6A323882946C20AD8B4DCB89CB09E2F8BBB4215FACDD64AA48C38B16
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
13
DNS requests
5
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1496
game.exe
GET
200
101.226.28.188:80
http://cdn-file-ssl-wan.ludashi.com/wan/wan/7z.dll
unknown
executable
1.06 Mb
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=7z_download_start&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=7z_noexist&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=start&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=install&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=7z_download_success&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
—
61.170.97.157:80
http://cdn-file-ssl-pc.ludashi.com/pc/cef/CefRes.dll
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1496
game.exe
101.226.28.188:80
cdn-file-ssl-wan.ludashi.com
China Telecom Group
CN
unknown
1496
game.exe
139.224.193.172:80
s.ludashi.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
1496
game.exe
61.170.97.157:80
cdn-file-ssl-pc.ludashi.com
China Telecom Group
CN
unknown

DNS requests

Domain
IP
Reputation
cdn-file-ssl-wan.ludashi.com
  • 101.226.28.188
  • 101.226.28.182
  • 101.226.28.185
  • 101.226.28.186
  • 101.226.28.187
  • 101.226.28.184
  • 101.226.28.183
  • 101.226.28.148
malicious
s.ludashi.com
  • 139.224.193.172
unknown
cdn-file-ssl-pc.ludashi.com
  • 61.170.97.157
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1496
game.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1496
game.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1496
game.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
13635053139.zip