| download: | instbeta.exe |
| Full analysis: | https://app.any.run/tasks/f8189dc7-1e75-462c-8a89-88eb1048ffc1 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | July 05, 2019, 08:58:31 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 0FFF81C5028F52251E3C1F4FE2EC88B6 |
| SHA1: | 0E06A6A97FAB703D57E7EEE90D2A2201E707F507 |
| SHA256: | 90B0CD50ACCC76880D8BDA96C9A3E2CAD392C316E65796936AB6F5EF05546FE7 |
| SSDEEP: | 98304:yBMCdDQ/TUvJ4FL8VZAScm9VjP5DDfHrai1P8Ctk:NmE/M4yVKStPRDfLaSU |
| .exe | | | Win64 Executable (generic) (18) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (2.9) |
| .exe | | | Generic Win/DOS Executable (1.3) |
| .exe | | | DOS Executable Generic (1.3) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:05:24 13:31:49+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 711168 |
| InitializedDataSize: | 3063296 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x81cec |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 12.0.0.1061 |
| ProductVersionNumber: | 12.0.0.1061 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Dynamic link library |
| FileSubtype: | - |
| LanguageCode: | Neutral 2 |
| CharacterSet: | Unicode |
| CompanyName: | 360.cn |
| FileDescription: | 360 安全卫士在线安装程序 |
| FileVersion: | 12, 0, 0, 1061 |
| InternalName: | 360 Installer |
| LegalCopyright: | Copyright 2012 |
| OriginalFileName: | 360Installer.exe |
| ProductName: | 360 安全卫士在线安装程序 |
| ProductVersion: | 12, 0, 0, 1061 |
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 24-May-2019 11:31:49 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | 360.cn |
| FileDescription: | 360 安全卫士在线安装程序 |
| FileVersion: | 12, 0, 0, 1061 |
| InternalName: | 360 Installer |
| LegalCopyright: | Copyright 2012 |
| OriginalFilename: | 360Installer.exe |
| ProductName: | 360 安全卫士在线安装程序 |
| ProductVersion: | 12, 0, 0, 1061 |
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000100 |
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 24-May-2019 11:31:49 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x000AD815 | 0x000ADA00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.65803 |
.rdata | 0x000AF000 | 0x00020080 | 0x00020200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.78575 |
.data | 0x000D0000 | 0x0000C2AC | 0x00008800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.40805 |
.rsrc | 0x000DD000 | 0x002B83F8 | 0x002B8400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.90546 |
.reloc | 0x00396000 | 0x0000AE50 | 0x0000B000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.03121 |
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.26275 | 1064 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 4.56733 | 4264 | Latin 1 / Western European | Chinese - PRC | RT_ICON |
3 | 4.60391 | 1128 | Latin 1 / Western European | Chinese - PRC | RT_ICON |
4 | 4.16294 | 1384 | Latin 1 / Western European | Chinese - PRC | RT_ICON |
5 | 5.70608 | 1128 | Latin 1 / Western European | Chinese - PRC | RT_ICON |
9 | 5.80041 | 512 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
10 | 5.71915 | 656 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
11 | 5.86822 | 558 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
12 | 6.37827 | 654 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
13 | 6.1917 | 416 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
IPHLPAPI.DLL |
KERNEL32.dll |
MSIMG32.dll |
OLEAUT32.dll |
PSAPI.DLL |
SETUPAPI.dll |
SHELL32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 292 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 496 | C:\Windows\system32\lsass.exe | C:\Windows\System32\lsass.exe | — | wininit.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Local Security Authority Process Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 656 | "C:\Users\admin\AppData\Local\Temp\instbeta.exe" | C:\Users\admin\AppData\Local\Temp\instbeta.exe | explorer.exe | ||||||||||||
User: admin Company: 360.cn Integrity Level: HIGH Description: 360 安全卫士在线安装程序 Exit code: 0 Version: 12, 0, 0, 1061 Modules
| |||||||||||||||
| 844 | C:\Windows\system32\svchost.exe -k netsvcs | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 880 | "C:\Program Files\360\360safe\Utils\360IA.exe" /src=probe /dpi=96 | C:\Program Files\360\360safe\Utils\360IA.exe | — | 360tray.exe | |||||||||||
User: admin Company: 360.cn Integrity Level: HIGH Description: 360安全卫士 智能助手模块 Exit code: 0 Version: 12.0.0.1040 Modules
| |||||||||||||||
| 1036 | "C:\Program Files\360\360safe\safemon\360tray.exe" /TrayInstall /showtrayicon /clean | C:\Program Files\360\360safe\safemon\360tray.exe | setupbeta_12.1.0.1001f.exe | ||||||||||||
User: admin Company: 360.cn Integrity Level: HIGH Description: 360安全卫士 安全防护中心模块 Exit code: 0 Version: 12, 0, 0, 1101 Modules
| |||||||||||||||
| 1068 | "C:\Program Files\360\360safe\modules\360PatchMgr.exe" /DisableRestore | C:\Program Files\360\360safe\modules\360PatchMgr.exe | — | 360leakfixer.exe | |||||||||||
User: admin Company: 360.cn Integrity Level: HIGH Description: 360安全卫士 漏洞补丁安装模块 Exit code: 0 Version: 1.0.0.1210 Modules
| |||||||||||||||
| 1228 | "C:\Program Files\360\360safe\Utils\PowerSaver.exe" /flightsigning | C:\Program Files\360\360safe\Utils\PowerSaver.exe | — | setupbeta_12.1.0.1001f.exe | |||||||||||
User: admin Company: 360.cn Integrity Level: HIGH Description: 360安全卫士卸载清理模块 Exit code: 0 Version: 11.0.0.1081 Modules
| |||||||||||||||
| 1232 | "C:\Program Files\360\360safe\Utils\PowerSaver.exe" /HImmu | C:\Program Files\360\360safe\Utils\PowerSaver.exe | — | setupbeta_12.1.0.1001f.exe | |||||||||||
User: admin Company: 360.cn Integrity Level: HIGH Description: 360安全卫士卸载清理模块 Exit code: 0 Version: 11.0.0.1081 Modules
| |||||||||||||||
| 1248 | "C:\Program Files\360\360safe\SoftMgr\360speedld.exe" /rdarg=PFBvcFduZEluZm8+PGR3VHlwZT4zPC9kd1R5cGU+PGR3UElEPjQ4ODwvZHdQSUQ+PHN6UFBhdGg+PCFbQ0RBVEFbQzpcV2luZG93c1xTeXN0ZW0zMlxzZXJ2aWNlcy5leGVdXT48L3N6UFBhdGg+PGR3Um9vdEtleT4tMjE0NzQ4MzY0NjwvZHdSb290S2V5PjxzelN1YktleT48IVtDREFUQVtTWVNURU1cQ3VycmVudENvbnRyb2xTZXRcc2VydmljZXNcZHNtYWluc3J2XV0+PC9zelN1YktleT48c3pWYWx1ZU5hbWU+PCFbQ0RBVEFbSW1hZ2VQYXRoXV0+PC9zelZhbHVlTmFtZT48c3pEYXRhPjwhW0NEQVRBW0M6XFByb2dyYW0gRmlsZXNcMzYwXDM2MHNhZmVcZGVlcHNjYW5cZHNtYWluLmV4ZSAvc3J2XV0+PC9zekRhdGE+PHN6U29mdElEPjwhW0NEQVRBW11dPjwvc3pTb2Z0SUQ+PC9Qb3BXbmRJbmZvPg== | C:\Program Files\360\360safe\SoftMgr\360speedld.exe | — | 360tray.exe | |||||||||||
User: admin Company: 360.cn Integrity Level: HIGH Description: 360软件管家 开机小助手 Exit code: 0 Version: 3, 1, 2, 2505 Modules
| |||||||||||||||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | APPSTARTING |
Value: %SystemRoot%\cursors\clearcur.cur | |||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | ARROW |
Value: %SystemRoot%\cursors\clearcur.cur | |||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | CROSS |
Value: %SystemRoot%\cursors\clearcur.cur | |||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | HAND |
Value: %SystemRoot%\cursors\clearcur.cur | |||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | HELP |
Value: %SystemRoot%\cursors\clearcur.cur | |||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | IBEAM |
Value: %SystemRoot%\cursors\clearcur.cur | |||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | NO |
Value: %SystemRoot%\cursors\clearcur.cur | |||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | SIZEALL |
Value: %SystemRoot%\cursors\clearcur.cur | |||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | SIZENESW |
Value: %SystemRoot%\cursors\clearcur.cur | |||
| (PID) Process: | (2592) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
| Operation: | write | Name: | SIZENS |
Value: %SystemRoot%\cursors\clearcur.cur | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\{B697E7D9-13D6-4abe-AAF2-49D8517BDD6B}.tmp | — | |
MD5:— | SHA256:— | |||
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\{E7907BCC-A640-4eb9-928A-EE2D43DD90D3}.tmp | — | |
MD5:— | SHA256:— | |||
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\!@tEA36.tmp | — | |
MD5:— | SHA256:— | |||
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\!@tEA36.tmp.dir\custom_wnd.ini | — | |
MD5:— | SHA256:— | |||
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\!@tEA36.tmp.dir\desktop_assistant_icon.png | — | |
MD5:— | SHA256:— | |||
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\!@tEA36.tmp.dir\phone_assistant_icon.png | — | |
MD5:— | SHA256:— | |||
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\!@tEA36.tmp.dir\setup.ini | — | |
MD5:— | SHA256:— | |||
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\setupbeta_12.1.0.1001f.exe.P2P | — | |
MD5:— | SHA256:— | |||
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\setupbeta_12.1.0.1001f.exe | — | |
MD5:— | SHA256:— | |||
| 656 | instbeta.exe | C:\Users\admin\AppData\Local\Temp\setupbeta_12.1.0.1001f.exe.mem | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
656 | instbeta.exe | GET | 200 | 171.8.167.89:80 | http://s.360.cn/safe/instcomp.htm?soft=1000&status=1&m=cfe1ce9b8f5123cc37f394accff90c49&from=safebeta_new&vv=10&ver=12.0.0.1061 | CN | — | — | whitelisted |
656 | instbeta.exe | GET | 200 | 171.8.167.89:80 | http://s.360.cn/safe/instcomp.htm?soft=1000&status=12&m=cfe1ce9b8f5123cc37f394accff90c49&from=safebeta_new&vv=10&ver=12.0.0.1061 | CN | — | — | whitelisted |
656 | instbeta.exe | GET | 200 | 171.8.167.89:80 | http://s.360.cn/safe/instcomp.htm?soft=425&status=1&mid=cfe1ce9b8f5123cc37f394accff90c49&from=safebeta_new&ver=12.0.0.1061&vv=10&appkey=&usetime=0&downrate=0&downlen=0 | CN | — | — | whitelisted |
656 | instbeta.exe | GET | 200 | 171.8.167.89:80 | http://s.360.cn/safe/instcomp.htm?soft=1000&status=8&m=cfe1ce9b8f5123cc37f394accff90c49&from=safebeta_new&vv=10&ver=12.0.0.1061 | CN | — | — | whitelisted |
656 | instbeta.exe | GET | 200 | 171.8.167.89:80 | http://s.360.cn/safe/instcomp.htm?soft=1000&status=4&m=cfe1ce9b8f5123cc37f394accff90c49&from=safebeta_new&vv=10&ver=12.0.0.1061 | CN | — | — | whitelisted |
656 | instbeta.exe | GET | — | 104.192.108.21:80 | http://dl.360safe.com/setupbeta_12.1.0.1001f.exe | US | — | — | whitelisted |
656 | instbeta.exe | GET | 200 | 171.8.167.89:80 | http://s.360.cn/safe/instcomp.htm?soft=1000&status=10&m=cfe1ce9b8f5123cc37f394accff90c49&from=safebeta_new&vv=10&ver=12.0.0.1061 | CN | — | — | whitelisted |
656 | instbeta.exe | GET | — | 104.192.108.17:80 | http://dl.360safe.com/setupbeta_12.1.0.1001f.exe | US | — | — | whitelisted |
656 | instbeta.exe | GET | 200 | 171.8.167.89:80 | http://s.360.cn/safe/instcomp.htm?soft=425&status=19&mid=cfe1ce9b8f5123cc37f394accff90c49&from=safebeta_new&ver=12.0.0.1061&vv=10&appkey=&usetime=24531&downrate=0&downlen=0 | CN | — | — | whitelisted |
656 | instbeta.exe | GET | 200 | 171.8.167.89:80 | http://s.360.cn/safe/instcomp.htm?soft=2000&status=11&m=cfe1ce9b8f5123cc37f394accff90c49&from=safebeta_new&vv=10&ver=12.0.0.1061 | CN | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
656 | instbeta.exe | 1.192.136.136:3478 | st.p.360.cn | No.31,Jin-rong Street | CN | unknown |
656 | instbeta.exe | 171.8.167.89:80 | s.360.cn | No.31,Jin-rong Street | CN | suspicious |
— | — | 1.192.136.137:3478 | — | No.31,Jin-rong Street | CN | unknown |
656 | instbeta.exe | 180.163.235.152:443 | pinst.360.cn | China Telecom (Group) | CN | unknown |
656 | instbeta.exe | 104.192.108.21:80 | dl.360safe.com | Beijing Qihu Technology Company Limited | US | malicious |
656 | instbeta.exe | 104.192.108.17:80 | dl.360safe.com | Beijing Qihu Technology Company Limited | US | malicious |
— | — | 113.134.136.21:35738 | — | No.31,Jin-rong Street | CN | unknown |
3336 | setupbeta_12.1.0.1001f.exe | 171.8.167.89:80 | s.360.cn | No.31,Jin-rong Street | CN | suspicious |
656 | instbeta.exe | 175.6.249.99:80 | sd.p.360.cn | Hengyang | CN | unknown |
3708 | 360Safe.exe | 123.125.82.192:80 | skin.wsm.360.cn | China Unicom Beijing Province Network | CN | unknown |
Domain | IP | Reputation |
|---|---|---|
st.p.360.cn |
| whitelisted |
tr.p.360.cn |
| suspicious |
agt.p.360.cn |
| whitelisted |
s.360.cn |
| whitelisted |
pinst.360.cn |
| whitelisted |
dl.360safe.com |
| whitelisted |
agd.p.360.cn |
| whitelisted |
sd.p.360.cn |
| whitelisted |
skin.wsm.360.cn |
| suspicious |
conf.wsm.360.cn |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
656 | instbeta.exe | Generic Protocol Command Decode | ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false) |
656 | instbeta.exe | Generic Protocol Command Decode | ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag true change port flag false) |
656 | instbeta.exe | Generic Protocol Command Decode | ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag true) |
— | — | Generic Protocol Command Decode | ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false) |
— | — | Generic Protocol Command Decode | ET INFO Session Traversal Utilities for NAT (STUN Binding Request obsolete rfc 3489 CHANGE-REQUEST attribute change IP flag false change port flag false) |
656 | instbeta.exe | Misc activity | ET INFO Packed Executable Download |
656 | instbeta.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1036 | 360tray.exe | Potential Corporate Privacy Violation | ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set |
1036 | 360tray.exe | Potential Corporate Privacy Violation | ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set |
— | — | Potential Corporate Privacy Violation | ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set |
Process | Message |
|---|---|
SoftupNotify.exe | /install |
regsvr32.exe | 360softmgr.shellext.SafeExistThread |
regsvr32.exe | 360softmgr.shellext.SafeExistThread leave |
explorer.exe | 360softmgr.shellext.event.wait |
explorer.exe | 360softmgr.shellext.CommandMonitor loop, InterlockedCompareExchange(&lThreadExitFlag_CommandMonitor, 1, 1) -> 0 |
explorer.exe | OpenFileMapping lasterror:0 |
explorer.exe | open Global\360SoftMgr.ShellExt.Share |
explorer.exe | mapview Global\360SoftMgr.ShellExt.Share |
explorer.exe | startmenuUnpin |
explorer.exe | C:\Program Files\360\360safe\SoftMgr\??????????.lnk |