| File name: | 2345SafeDownLoader.exe |
| Full analysis: | https://app.any.run/tasks/c3fa46b9-c0ea-4109-8405-a298059de354 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | June 14, 2020, 03:11:32 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 803372D8EE8F950221507F038D632C91 |
| SHA1: | 14D857449C325F318DFB0EC6692AB66DC670E2EA |
| SHA256: | 91844D64697BA70C4A36CB5AB7911262D7FECDFB550A621047C580AC5B411DBC |
| SSDEEP: | 98304:4wM/frnMJMkEzMjiWQcC6v6INe/WPNGEhkyW:l2kEzobQt6bNhkp |
| .exe | | | Win32 Executable MS Visual C++ (generic) (19.9) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (2.8) |
| .exe | | | Generic Win/DOS Executable (1.2) |
| .exe | | | DOS Executable Generic (1.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:04:20 10:41:24+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 12 |
| CodeSize: | 2838016 |
| InitializedDataSize: | 989696 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x147e4c |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.2.47 |
| ProductVersionNumber: | 1.0.2.47 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | 2345移动科技 |
| FileDescription: | 2345安全卫士下载器 |
| FileVersion: | 1.0.2.47 |
| LegalCopyright: | 版权所有 (C) 2020, 2345移动科技 |
| PrivateBuild: | 1 1 1 0 1 1 100161 0 BEE1D737 |
| ProductName: | 2345安全卫士下载器 |
| ProductVersion: | 1.0.2.47 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 184 | "C:\Users\admin\AppData\Roaming\SoftMgr_2345\2345SoftMgr.exe" --shortcut=notify --from=s --entry=12 --package="C:\Users\admin\AppData\Roaming\SoftMgr_2345\2345softmgr_v5.3.0.11631.7z" --nwinst=1 | C:\Users\admin\AppData\Roaming\SoftMgr_2345\2345SoftMgr.exe | — | 2345ShellPro.exe | |||||||||||
User: admin Company: 2345.cc Integrity Level: HIGH Description: 2345软件管家-主模块 Exit code: 0 Version: 5.3.0.11631 | |||||||||||||||
| 1100 | "C:\Users\admin\AppData\Roaming\2345PCSafe\Download\2345pcsafe_100161_dhqd.exe" /S /LOCKSTATE=1 /AUTOLAUNCH=1 /D=C:\Program Files\2345Soft\2345PCSafe | C:\Users\admin\AppData\Roaming\2345PCSafe\Download\2345pcsafe_100161_dhqd.exe | 2345SafeDownLoader.exe | ||||||||||||
User: admin Company: 2345.cc Integrity Level: HIGH Description: 2345安全卫士 v5.6 安装程序 Exit code: 0 Version: 5.6.0.12087 Modules
| |||||||||||||||
| 1776 | "C:\Users\admin\AppData\Local\Temp\2345SafeDownLoader.exe" | C:\Users\admin\AppData\Local\Temp\2345SafeDownLoader.exe | — | explorer.exe | |||||||||||
User: admin Company: 2345移动科技 Integrity Level: MEDIUM Description: 2345安全卫士下载器 Exit code: 3221226540 Version: 1.0.2.47 Modules
| |||||||||||||||
| 1792 | "C:\Windows\System32\ipconfig.exe" /flushdns | C:\Windows\System32\ipconfig.exe | — | 2345RTProtect.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: IP Configuration Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1844 | "C:\Program Files\2345Soft\2345PCSafe\5.6.0.12087\2345SafeSvc.exe" | C:\Program Files\2345Soft\2345PCSafe\5.6.0.12087\2345SafeSvc.exe | services.exe | ||||||||||||
User: SYSTEM Company: 2345.cc Integrity Level: SYSTEM Description: 2345安全卫士-服务程序 Exit code: 0 Version: 5.6.0.12087 Modules
| |||||||||||||||
| 2336 | "C:\Program Files\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterSvc.exe" | C:\Program Files\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterSvc.exe | services.exe | ||||||||||||
User: SYSTEM Company: 2345.cc Integrity Level: SYSTEM Description: 2345安全中心-服务程序 Exit code: 0 Version: 5.12.3.8233 Modules
| |||||||||||||||
| 2480 | "C:\Program Files\2345Soft\2345PCSafe\5.6.0.12087\2345ShellPro.exe" --type=install --installtype=new --lockCheckState=1 --silent=1 | C:\Program Files\2345Soft\2345PCSafe\5.6.0.12087\2345ShellPro.exe | 2345pcsafe_100161_dhqd.exe | ||||||||||||
User: admin Company: 2345.cc Integrity Level: HIGH Description: 2345安全卫士-安装辅助程序 Exit code: 0 Version: 5.6.0.12087 Modules
| |||||||||||||||
| 2512 | "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeBho.dll" | C:\Windows\System32\regsvr32.exe | — | 2345SafeCenterInstaller.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2564 | "C:\Program Files\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterCrashReport.exe" --crashtype=Driver | C:\Program Files\2345Soft\2345SafeCenter\5.12.3.8233\2345SafeCenterCrashReport.exe | — | 2345RTProtect.exe | |||||||||||
User: admin Company: 2345.cc Integrity Level: HIGH Description: 2345安全中心-错误报告 Exit code: 1 Version: 5.12.3.8233 Modules
| |||||||||||||||
| 2576 | "C:\Program Files\2345Soft\2345PCSafe\5.6.0.12087\2345ShellPro.exe" --type=repair | C:\Program Files\2345Soft\2345PCSafe\5.6.0.12087\2345ShellPro.exe | — | 2345RTProtect.exe | |||||||||||
User: admin Company: 2345.cc Integrity Level: HIGH Description: 2345安全卫士-安装辅助程序 Exit code: 0 Version: 5.6.0.12087 Modules
| |||||||||||||||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\2345.com |
| Operation: | write | Name: | UUID |
Value: 844FBA9552F9B03632826CA060B9FAC1 2409 | |||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\2345.com\2345PCSafe |
| Operation: | write | Name: | LADValue |
Value: 1592104310 1806 | |||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\2345.com\2345PCSafe |
| Operation: | write | Name: | ADValue |
Value: 1 17424 | |||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3748) 2345SafeDownLoader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3748 | 2345SafeDownLoader.exe | C:\Users\admin\AppData\Roaming\2345PCSafe\Data\SafeDownloader.lock | — | |
MD5:— | SHA256:— | |||
| 3748 | 2345SafeDownLoader.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\2345pcsafe_100161_dhqd[1].exe | — | |
MD5:— | SHA256:— | |||
| 3748 | 2345SafeDownLoader.exe | C:\Users\admin\AppData\Roaming\2345PCSafe\Download\2345pcsafe_100161_dhqd.exe.tmp | — | |
MD5:— | SHA256:— | |||
| 3748 | 2345SafeDownLoader.exe | C:\Users\admin\AppData\Roaming\2345PCSafe\Download\2345pcsafe_100161_dhqd.exe | — | |
MD5:— | SHA256:— | |||
| 3748 | 2345SafeDownLoader.exe | C:\Users\admin\AppData\Roaming\2345PCSafe\Data\SafeDownloader | binary | |
MD5:— | SHA256:— | |||
| 3748 | 2345SafeDownLoader.exe | C:\Users\admin\AppData\Roaming\2345PCSafe\Data\SafeDownloader.time | text | |
MD5:— | SHA256:— | |||
| 1100 | 2345pcsafe_100161_dhqd.exe | C:\Users\admin\AppData\Local\Temp\nso7212.tmp\FileInfo.dll | executable | |
MD5:— | SHA256:— | |||
| 1100 | 2345pcsafe_100161_dhqd.exe | C:\Program Files\2345Soft\2345PCSafe\5.6.0.12087\Uninstall.exe | executable | |
MD5:— | SHA256:— | |||
| 1100 | 2345pcsafe_100161_dhqd.exe | C:\Program Files\2345Soft\2345PCSafe\5.6.0.12087\2345MPCSafe.exe | executable | |
MD5:— | SHA256:— | |||
| 1100 | 2345pcsafe_100161_dhqd.exe | C:\Program Files\2345Soft\2345PCSafe\5.6.0.12087\2345Uninst.exe | executable | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2740 | 2345RTProtect.exe | GET | — | 42.62.30.180:80 | http://42.62.30.180/ | CN | — | — | whitelisted |
2740 | 2345RTProtect.exe | POST | 200 | 221.228.75.123:80 | http://push.khd.2345.cc/token | CN | text | 112 b | unknown |
3748 | 2345SafeDownLoader.exe | POST | 200 | 221.228.75.3:80 | http://update.khd.2345.cc/safe/downloader.php | CN | text | 336 b | malicious |
3748 | 2345SafeDownLoader.exe | POST | 200 | 221.228.75.2:80 | http://t.safe.2345.com/safe_realtime/index.php | CN | text | 40 b | malicious |
3748 | 2345SafeDownLoader.exe | POST | 200 | 221.228.75.2:80 | http://t.safe.2345.com/safe_realtime/index.php | CN | text | 40 b | malicious |
3100 | 2345SafeCenterInstaller.exe | POST | 200 | 221.228.75.2:80 | http://t.safe.2345.com/safe_realtime/index.php | CN | text | 40 b | malicious |
3748 | 2345SafeDownLoader.exe | POST | 200 | 221.228.75.2:80 | http://t.safe.2345.com/safe_realtime/index.php | CN | text | 40 b | malicious |
3100 | 2345SafeCenterInstaller.exe | POST | 200 | 221.228.75.3:80 | http://update.khd.2345.cc/safe_center/index.php | CN | binary | 1 b | malicious |
3100 | 2345SafeCenterInstaller.exe | POST | 200 | 221.228.75.2:80 | http://t.safe.2345.com/safe_realtime/index.php | CN | text | 40 b | malicious |
— | — | POST | 200 | 221.228.75.234:80 | http://t.khd.2345.cc/tcp/push/index.php | CN | text | 40 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3748 | 2345SafeDownLoader.exe | 221.228.75.2:80 | t.safe.2345.com | No.31,Jin-rong Street | CN | malicious |
3748 | 2345SafeDownLoader.exe | 221.228.75.3:80 | update.khd.2345.cc | No.31,Jin-rong Street | CN | malicious |
3748 | 2345SafeDownLoader.exe | 120.221.148.21:80 | download.2345.com | Shandong Mobile Communication Company Limited | CN | suspicious |
3100 | 2345SafeCenterInstaller.exe | 221.228.75.2:80 | t.safe.2345.com | No.31,Jin-rong Street | CN | malicious |
3100 | 2345SafeCenterInstaller.exe | 221.228.75.3:80 | update.khd.2345.cc | No.31,Jin-rong Street | CN | malicious |
2740 | 2345RTProtect.exe | 221.228.75.123:80 | push.khd.2345.cc | No.31,Jin-rong Street | CN | unknown |
— | — | 221.228.75.2:80 | t.safe.2345.com | No.31,Jin-rong Street | CN | malicious |
2740 | 2345RTProtect.exe | 42.62.30.180:80 | — | China Unicom Beijing Province Network | CN | unknown |
— | — | 221.228.75.234:80 | t.khd.2345.cc | No.31,Jin-rong Street | CN | malicious |
Domain | IP | Reputation |
|---|---|---|
t.safe.2345.com |
| malicious |
update.khd.2345.cc |
| unknown |
download.2345.com |
| suspicious |
push.khd.2345.cc |
| unknown |
yb.safe.2345.com |
| malicious |
t.khd.2345.cc |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
3748 | 2345SafeDownLoader.exe | Misc activity | ADWARE [PTsecurity] PUA.Puamson!8.108E8 (CLOUD) |
3748 | 2345SafeDownLoader.exe | Misc activity | ADWARE [PTsecurity] PUA.Puamson!8.108E8 (CLOUD) |
1056 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
3748 | 2345SafeDownLoader.exe | Misc activity | ADWARE [PTsecurity] PUA.Puamson!8.108E8 (CLOUD) |
3748 | 2345SafeDownLoader.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3748 | 2345SafeDownLoader.exe | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |
3748 | 2345SafeDownLoader.exe | Misc activity | ADWARE [PTsecurity] PUA.Puamson!8.108E8 (CLOUD) |
3100 | 2345SafeCenterInstaller.exe | Misc activity | ADWARE [PTsecurity] PUA.Puamson!8.108E8 (CLOUD) |
1056 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
3100 | 2345SafeCenterInstaller.exe | Misc activity | ADWARE [PTsecurity] PUA.Puamson!8.108E8 (CLOUD) |
Process | Message |
|---|---|
2345SafeCenterSvc.exe | RpcServerUseProtseqEpW 6cc
|
2345SafeCenterSvc.exe | [2336:3440:0614/041319:12937068us:INFO:crash_service.cc(467)] pipe name is \\.\pipe\57E60541-1540-4E0A-B505-88F6D4A547C8
|
2345SafeCenterSvc.exe | [2336:3440:0614/041319:12937068us:INFO:crash_service.cc(486)] dump start successfully
|
2345SafeCenterSvc.exe | [2336:3440:0614/041319:12937068us:INFO:crash_service.cc(468)] dumps at C:\Windows\TEMP\2345_Crashes
|
2345SafeCenterSvc.exe | [2336:3440:0614/041319:12937068us:INFO:crash_service_interface.cc(72)] ready to process crash requests
|
2345SafeCenterSvc.exe | [2336:3584:0614/041321:12937078us:INFO:crash_service.cc(510)] client start. pid = 2740
|
2345SafeSvc.exe | [1844:3832:0614/041322:12937223us:INFO:crash_service.cc(467)] pipe name is \\.\pipe\FD439895-091C-4492-B2F7-16AA7CB46B87
|
2345SafeSvc.exe | [1844:3832:0614/041322:12937223us:INFO:crash_service.cc(486)] dump start successfully
|
2345SafeSvc.exe | [1844:3832:0614/041322:12937223us:INFO:crash_service.cc(468)] dumps at C:\Windows\TEMP\2345_Crashes
|
2345SafeSvc.exe | [1844:3832:0614/041322:12937223us:INFO:crash_service_interface.cc(72)] ready to process crash requests
|