URL:

http://hmtalk.com/dava/davademo.php

Full analysis: https://app.any.run/tasks/2e5af0a2-9190-4780-8e1b-80cdb75865a1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 25, 2022, 00:59:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

AB09EF2028D812E8D744D37C21728F5F

SHA1:

907D84D6AFB5698A3DE44B4D8B5D6D2CAE5E4096

SHA256:

91517B89924327C9A807A047611FE1EF92F8BDBBFED4BAD0B8AC195866573A17

SSDEEP:

3:N1KWIqkKPTiVn:CWTkETiVn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • IEInstal.exe (PID: 4004)

    • Loads dropped or rewritten executable

      • iexplore.exe (PID: 884)
      • IEInstal.exe (PID: 4004)
      • iexplore.exe (PID: 3336)
      • SearchProtocolHost.exe (PID: 3788)
      • Explorer.EXE (PID: 1108)

    • Application was dropped or rewritten from another process

      • DaView.exe (PID: 2896)
      • DaView.exe (PID: 3008)

  • SUSPICIOUS

    • Starts Internet Explorer

      • Explorer.EXE (PID: 1108)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 884)
      • iexplore.exe (PID: 3336)
      • iexplore.exe (PID: 2876)

    • Executed via COM

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 1876)
      • IEInstal.exe (PID: 4004)

    • Checks supported languages

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 1876)
      • DaView.exe (PID: 3008)
      • IEInstal.exe (PID: 4004)

    • Reads the computer name

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 1876)
      • IEInstal.exe (PID: 4004)
      • DaView.exe (PID: 3008)

    • Adds / modifies Windows certificates

      • IEInstal.exe (PID: 4004)

    • Executable content was dropped or overwritten

      • IEInstal.exe (PID: 4004)
      • iexplore.exe (PID: 2876)
      • iexplore.exe (PID: 3336)

    • Creates files in the Windows directory

      • IEInstal.exe (PID: 4004)

    • Removes files from Windows directory

      • IEInstal.exe (PID: 4004)

    • Drops a file that was compiled in debug mode

      • IEInstal.exe (PID: 4004)

    • Creates files in the user directory

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 1876)
      • Explorer.EXE (PID: 1108)

    • Reads default file associations for system extensions

      • Explorer.EXE (PID: 1108)

    • Uses RUNDLL32.EXE to load library

      • Explorer.EXE (PID: 1108)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3336)

    • Reads the computer name

      • iexplore.exe (PID: 3336)
      • iexplore.exe (PID: 884)
      • iexplore.exe (PID: 2876)
      • SearchProtocolHost.exe (PID: 3788)
      • explorer.exe (PID: 2224)
      • notepad.exe (PID: 1268)
      • rundll32.exe (PID: 1336)

    • Checks supported languages

      • iexplore.exe (PID: 884)
      • iexplore.exe (PID: 3336)
      • iexplore.exe (PID: 2876)
      • SearchProtocolHost.exe (PID: 3788)
      • explorer.exe (PID: 2224)
      • rundll32.exe (PID: 1336)
      • notepad.exe (PID: 1268)
      • Explorer.EXE (PID: 1108)

    • Reads internet explorer settings

      • iexplore.exe (PID: 884)
      • iexplore.exe (PID: 2876)

    • Changes internet zones settings

      • iexplore.exe (PID: 3336)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3336)
      • iexplore.exe (PID: 884)
      • IEInstal.exe (PID: 4004)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3336)
      • iexplore.exe (PID: 884)
      • IEInstal.exe (PID: 4004)

    • Creates files in the user directory

      • iexplore.exe (PID: 884)
      • iexplore.exe (PID: 3336)

    • Reads CPU info

      • iexplore.exe (PID: 884)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3336)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3336)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3336)

    • Manual execution by user

      • explorer.exe (PID: 2224)

    • Reads Microsoft Office registry keys

      • Explorer.EXE (PID: 1108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
12
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs ieinstal.exe daview.exe no specs daview.exe iexplore.exe searchprotocolhost.exe no specs explorer.exe no specs explorer.exe no specs rundll32.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
884"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3336 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1108C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1268"C:\Windows\system32\notepad.exe" C:\Windows\system32\notepad.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1336"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Downloads\htluu.dllC:\Windows\system32\rundll32.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1876C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe� Flash� Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2224"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2876"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3336 CREDAT:1119560 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2896"C:\Windows\Downloaded Program Files\DaView.exe" "http://112.171.126.85:8080/DaViewForEG/DaViewSvc?filename=http://www.hmtalk.com/download/DaOffice_%ED%99%9C%EC%9A%A9%EC%84%A4%EB%AA%85%EC%84%9C.doc" -EM:VIEW "-HC:1111111111" "-FILENAME:DaOffice_?????.doc" -AXC~!*\|}&@^$+#C:\Windows\Downloaded Program Files\DaView.exe—iexplore.exe
User:
admin
Company:
Humantalk .Corp
Integrity Level:
LOW
Description:
DaVu - Viewer for All Documents.
Exit code:
0
Version:
9.14.8.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\downloaded program files\daview.exe
3008"C:\Windows\Downloaded Program Files\DaView.exe" "http://112.171.126.85:8080/DaViewForEG/DaViewSvc?filename=http://www.hmtalk.com/download/DaOffice_%ED%99%9C%EC%9A%A9%EC%84%A4%EB%AA%85%EC%84%9C.doc" -EM:VIEW "-HC:1111111111" "-FILENAME:DaOffice_?????.doc" -AXC~!*\|}&@^$+#C:\Windows\Downloaded Program Files\DaView.exe
iexplore.exe
User:
admin
Company:
Humantalk .Corp
Integrity Level:
MEDIUM
Description:
DaVu - Viewer for All Documents.
Exit code:
0
Version:
9.14.8.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\downloaded program files\daview.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3336"C:\Program Files\Internet Explorer\iexplore.exe" "http://hmtalk.com/dava/davademo.php"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\version.dll
Total events
46 632
Read events
45 373
Write events
1 250
Delete events
9

Modification events

(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
25275360
(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30943715
(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
325279110
(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30943715
(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3336) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
24
Suspicious files
20
Text files
249
Unknown types
83

Dropped files

PID
Process
Filename
Type
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\tmenu_line[1].gifimage
MD5:—
SHA256:—
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\base[1].csstext
MD5:—
SHA256:—
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\menu[1].jstext
MD5:—
SHA256:—
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\tmenu_04[1].gifimage
MD5:—
SHA256:—
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\leftmenu022[1].jpgimage
MD5:—
SHA256:—
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\davademo[1].htmhtml
MD5:—
SHA256:—
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\tmenu_01[1].gifimage
MD5:—
SHA256:—
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\table[1].csstext
MD5:—
SHA256:—
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\tmenu_03[1].gifimage
MD5:—
SHA256:—
884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\leftmenu023[1].jpgimage
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
243
TCP/UDP connections
104
DNS requests
29
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
884
iexplore.exe
GET
200
112.175.246.70:80
http://hmtalk.com/dava/davademo.php
KR
html
15.0 Kb
suspicious
884
iexplore.exe
GET
200
112.175.246.70:80
http://hmtalk.com/js/menu.js
KR
text
1001 b
suspicious
884
iexplore.exe
GET
200
112.175.246.70:80
http://hmtalk.com/images/index/tmenu_02.gif
KR
image
960 b
suspicious
884
iexplore.exe
GET
200
112.175.246.70:80
http://hmtalk.com/inc/gAnalytics.js
KR
text
639 b
suspicious
884
iexplore.exe
GET
200
112.175.246.70:80
http://hmtalk.com/css/table.css
KR
text
494 b
suspicious
884
iexplore.exe
GET
200
112.175.246.70:80
http://hmtalk.com/images/index/tmenu_03.gif
KR
image
918 b
suspicious
884
iexplore.exe
GET
200
112.175.246.70:80
http://hmtalk.com/images/index/tmenu_04.gif
KR
image
1.02 Kb
suspicious
884
iexplore.exe
GET
404
112.175.246.70:80
http://hmtalk.com/images/hmtalk_main.jpg
KR
html
193 b
suspicious
884
iexplore.exe
GET
200
112.175.246.70:80
http://hmtalk.com/images/common/leftmenu/leftmenu022.jpg
KR
image
2.35 Kb
suspicious
884
iexplore.exe
GET
200
112.175.246.70:80
http://hmtalk.com/images/index/tmenu_01.gif
KR
image
459 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
884
iexplore.exe
142.250.186.42:80
ajax.googleapis.com
Google Inc.
US
whitelisted
884
iexplore.exe
112.175.246.70:80
hmtalk.com
Korea Telecom
KR
suspicious
3336
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3336
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3336
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
XO Communications
US
suspicious
3336
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
884
iexplore.exe
203.245.12.156:80
jteckorea.weblog.cafe24.com
Korea Telecom
KR
unknown
884
iexplore.exe
2.18.233.74:443
geo2.adobe.com
Akamai International B.V.
—
whitelisted
—
—
142.250.181.238:443
www.google-analytics.com
Google Inc.
US
whitelisted
884
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
hmtalk.com
  • 112.175.246.70
suspicious
ajax.googleapis.com
  • 142.250.186.42
whitelisted
www.hmtalk.com
  • 112.175.246.70
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 23.32.238.201
  • 23.32.238.178
  • 67.27.159.254
  • 67.27.158.254
  • 67.26.139.254
  • 8.253.207.120
  • 8.253.95.121
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
jteckorea.weblog.cafe24.com
  • 203.245.12.156
unknown
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
2876
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://hmtalk.com/dava/davademo.php