File name:

13635053139.zip

Full analysis: https://app.any.run/tasks/1d70c32a-3a27-421a-a49c-94c2260b4853
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 19, 2023, 07:43:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

14E906CB832F14F66E80F5778EF4D8D3

SHA1:

FFDFC14AA00DDF7F02F3F836D94EFB6CDC43C86E

SHA256:

8E8B8B81F4DDEE2C7C53FD7AA1D6F8B6DE5AA6DA52DE0B2C425EB14EE94DFFB6

SSDEEP:

98304:6HYBVxJ2v7HyHHUcfY03Ro0jOSYD0QA6FQCKdWlNnj7BWOYZ8ki1cKfOSIGrEmCP:Tm7fE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • game.exe (PID: 1496)

  • SUSPICIOUS

    • Reads the Internet Settings

      • game.exe (PID: 1496)

    • Process requests binary or script from the Internet

      • game.exe (PID: 1496)

    • Drops 7-zip archiver for unpacking

      • game.exe (PID: 1496)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2036)

    • Manual execution by a user

      • game.exe (PID: 1496)

    • Checks supported languages

      • game.exe (PID: 1496)

    • Reads product name

      • game.exe (PID: 1496)

    • Checks proxy server information

      • game.exe (PID: 1496)

    • Creates files or folders in the user directory

      • game.exe (PID: 1496)

    • Reads Environment values

      • game.exe (PID: 1496)

    • Reads the computer name

      • game.exe (PID: 1496)

    • Reads the machine GUID from the registry

      • game.exe (PID: 1496)

    • Create files in a temporary directory

      • game.exe (PID: 1496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xa85db53c
ZipCompressedSize: 3422465
ZipUncompressedSize: 4369800
ZipFileName: 14c49f7b950ebe76cd9142d5bcd6997ae6f7240ccc34a375874d4cc5877eb6f5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs game.exe

Process information

PID
CMD
Path
Indicators
Parent process
1496"C:\Users\admin\Desktop\game.exe" C:\Users\admin\Desktop\game.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
游戏微端
Exit code:
0
Version:
65535.0.260.1007
Modules
Images
c:\users\admin\desktop\game.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2036"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\13635053139.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
1 324
Read events
1 272
Write events
52
Delete events
0

Modification events

(PID) Process:(2036) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
12
Suspicious files
8
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
2036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2036.31589\14c49f7b950ebe76cd9142d5bcd6997ae6f7240ccc34a375874d4cc5877eb6f5executable
MD5:63A5193A62D271996416F56576D0FC30
SHA256:14C49F7B950EBE76CD9142D5BCD6997AE6F7240CCC34A375874D4CC5877EB6F5
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\Uninst.exeexecutable
MD5:01B346761F16A7A356E7C1BD6027D141
SHA256:0A2A3DAEFB74DF1FE6504C632C8EA69C9D8A37348B7A51D81DE49B30EE45B082
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\ui.uicompressed
MD5:D4AF9A12EDD4ED099CE981C2170EC71A
SHA256:7043870ED1D420709FA828218162B85F5C1B3676493A6C32B6DE16A041C7A425
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\CefView.exeexecutable
MD5:43F06852F39316B8A9FB66CDF1655E50
SHA256:E2EC8057D4BCEA3896881B6B8A774E35141FF24EB555ECBE37D68355F480B980
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\CefHelper.dllexecutable
MD5:3174D34D57B134B5199A0A71FAD6E05F
SHA256:F3CADA2143700C405B283E04A043BCE6397F7E986E02DF34905657F976CC681E
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\progress.gifimage
MD5:EF09AFA5BF49F5B03B7E8CC5B7AA7E33
SHA256:2A5A7ACE6A323882946C20AD8B4DCB89CB09E2F8BBB4215FACDD64AA48C38B16
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\res.7z.tempcompressed
MD5:D540DAA0AB2D26676D84D6C60D29ABE1
SHA256:AF42B069D7B667074A15D9747D4F16F91EAA5137AF3EA370390D60DD8BECC640
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\wzzx2\wzzx2.uicompressed
MD5:D4AF9A12EDD4ED099CE981C2170EC71A
SHA256:7043870ED1D420709FA828218162B85F5C1B3676493A6C32B6DE16A041C7A425
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\WebView.dllexecutable
MD5:A1C2A27D04EAC0A29B0059CDBF928A4B
SHA256:12E25824F5BBD24326DB59D63093E8E744BE9FE0DFCDDB5C136D72BA9AA97E40
1496game.exeC:\Users\admin\AppData\Roaming\MicroGame\wzzx2\wzzx2.icoimage
MD5:A86528AC1F0853254942BF81986360DA
SHA256:3F05E5B1EFF93448558740A778473567402A06018849BE6C83D8AD49C6EA5248
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
13
DNS requests
5
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1496
game.exe
GET
200
101.226.28.188:80
http://cdn-file-ssl-wan.ludashi.com/wan/wan/7z.dll
unknown
executable
1.06 Mb
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=7z_download_start&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=7z_noexist&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=start&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=install&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
200
139.224.193.172:80
http://s.ludashi.com/wan?type=microgame&action=7z_download_success&from=popwd_wzzx21012_A&channel=popwd_wzzx21012_A&mid=b8c075ec50c0ffb37ec9c97cc27794fb&appver=65535.0.260.1007&modver=65535.0.260.1007&ex_ary[app]=microgame&ex_ary[game]=wzzx2&ex_ary[mid2]=011b00cdbd9e1c1f7684abbec64ea951322b71672b6b&ex_ary[open_type]=self&ex_ary[os]=1&ex_ary[osbuild]=7601&ex_ary[osver]=6.1&ex_ary[pid]=&ex_ary[platform]=pc&ex_ary[push_type]=&ex_ary[scene]=0&ex_ary[sr]=0&ex_ary[stage]=microgame
unknown
text
2 b
unknown
1496
game.exe
GET
—
61.170.97.157:80
http://cdn-file-ssl-pc.ludashi.com/pc/cef/CefRes.dll
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1496
game.exe
101.226.28.188:80
cdn-file-ssl-wan.ludashi.com
China Telecom Group
CN
unknown
1496
game.exe
139.224.193.172:80
s.ludashi.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
1496
game.exe
61.170.97.157:80
cdn-file-ssl-pc.ludashi.com
China Telecom Group
CN
unknown

DNS requests

Domain
IP
Reputation
cdn-file-ssl-wan.ludashi.com
  • 101.226.28.188
  • 101.226.28.182
  • 101.226.28.185
  • 101.226.28.186
  • 101.226.28.187
  • 101.226.28.184
  • 101.226.28.183
  • 101.226.28.148
malicious
s.ludashi.com
  • 139.224.193.172
unknown
cdn-file-ssl-pc.ludashi.com
  • 61.170.97.157
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1496
game.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1496
game.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1496
game.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
13635053139.zip