File name: | HskDDNS_5.0.0.21724.exe |
Full analysis: | https://app.any.run/tasks/38391ed1-0860-42fc-9de3-b0194ff903f0 |
Verdict: | Malicious activity |
Analysis date: | November 16, 2019, 07:53:54 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
MD5: | 78FC0052D63A8B68D7000F47F9AA81D8 |
SHA1: | 9567F025A68EFF7D22503A98101177505EA26FEF |
SHA256: | 950E4BCF1841481B53E2C8C7774BE2F1A09C20BE5F8AEDCEB8AC65B05D6CBB70 |
SSDEEP: | 98304:9rC2JcwApx3vqm5h0wCqNo3alPapkk37i86ZRlR+X22aCffy4aO8JOQjhVXtd5uA:kRTN5h01qN4a9aZIZNvhXpOQjpdIJ0h5 |
.exe | | | UPX compressed Win32 Executable (43.5) |
---|---|---|
.exe | | | Win32 EXE Yoda's Crypter (42.7) |
.exe | | | Win32 Executable (generic) (7.2) |
.exe | | | Generic Win/DOS Executable (3.2) |
.exe | | | DOS Executable Generic (3.2) |
ProductVersion: | 5.0.0.21724 |
---|---|
ProductName: | 花生壳动态域名 |
OriginalFileName: | HskDDNS.exe |
LegalCopyright: | 上海贝锐 版权所有 |
InternalName: | HskDDNS.exe |
FileVersion: | 5.0.0.21724 |
FileDescription: | 花生壳程序 |
CompanyName: | 上海贝锐信息科技股份有限公司 |
Comments: | 花生壳程序 |
CharacterSet: | Unicode |
LanguageCode: | Chinese (Simplified) |
FileSubtype: | - |
ObjectFileType: | Unknown |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0017 |
ProductVersionNumber: | 5.0.0.21724 |
FileVersionNumber: | 5.0.0.21724 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0xa9fbd0 |
UninitializedDataSize: | 5349376 |
InitializedDataSize: | 462848 |
CodeSize: | 5787648 |
LinkerVersion: | 14 |
PEType: | PE32 |
TimeStamp: | 2019:06:24 22:27:10+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 24-Jun-2019 20:27:10 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000140 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 24-Jun-2019 20:27:10 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x0051A000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x0051B000 | 0x00585000 | 0x00585000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.85281 |
.rsrc | 0x00AA0000 | 0x00071000 | 0x00070400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.44856 |
ADVAPI32.dll |
COMCTL32.dll |
COMDLG32.dll |
GDI32.dll |
IMM32.dll |
IPHLPAPI.DLL |
KERNEL32.DLL |
MSIMG32.dll |
OLEAUT32.dll |
SHELL32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3048 | "C:\Users\admin\AppData\Local\Temp\HskDDNS_5.0.0.21724.exe" | C:\Users\admin\AppData\Local\Temp\HskDDNS_5.0.0.21724.exe | — | explorer.exe |
User: admin Company: 上海贝锐信息科技股份有限公司 Integrity Level: MEDIUM Description: 花生壳程序 Exit code: 0 Version: 5.0.0.21724 | ||||
3896 | "C:\Users\admin\AppData\Local\Temp\HskDDNS_5.0.0.21724.exe" "C:\Users\admin\AppData\Local\Temp\HskDDNS_5.0.0.21724.exe" | C:\Users\admin\AppData\Local\Temp\HskDDNS_5.0.0.21724.exe | HskDDNS_5.0.0.21724.exe | |
User: admin Company: 上海贝锐信息科技股份有限公司 Integrity Level: HIGH Description: 花生壳程序 Exit code: 0 Version: 5.0.0.21724 | ||||
2284 | "C:\Program Files\Oray\HskDDNS\phtunnel.exe" -S -v | C:\Program Files\Oray\HskDDNS\phtunnel.exe | services.exe | |
User: SYSTEM Company: 上海贝锐信息科技股份有限公司 Integrity Level: SYSTEM Description: 花生壳程序 Version: 1.0.0.1 | ||||
3196 | "C:\Program Files\Oray\HskDDNS\HskDDNSMaint.exe" 2284 0 HskService | C:\Program Files\Oray\HskDDNS\HskDDNSMaint.exe | phtunnel.exe | |
User: SYSTEM Company: Shanghai Best Oray Integrity Level: SYSTEM Description: SunLogin Clients Maintainence Process Version: 3, 5, 18, 18283 | ||||
1972 | "C:\Program Files\Oray\HskDDNS\HskDDNS.exe" | C:\Program Files\Oray\HskDDNS\HskDDNS.exe | HskDDNS_5.0.0.21724.exe | |
User: admin Company: 上海贝锐信息科技股份有限公司 Integrity Level: HIGH Description: 花生壳程序 Version: 5.0.0.21724 | ||||
3732 | "C:\Program Files\Oray\HskDDNS\HskDDNS.exe" --mod=localscan -i 0 -w 85.203.20.11 | C:\Program Files\Oray\HskDDNS\HskDDNS.exe | phtunnel.exe | |
User: SYSTEM Company: 上海贝锐信息科技股份有限公司 Integrity Level: SYSTEM Description: 花生壳程序 Exit code: 255 Version: 5.0.0.21724 | ||||
3064 | C:\Windows\system32\WerFault.exe -u -p 3732 -s 1088 | C:\Windows\system32\WerFault.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1972 | HskDDNS.exe | C:\Users\admin\AppData\Local\Temp\mspaint.48x48.png | image | |
MD5:AFF91CFDA9632EC7D988DA072A2F842C | SHA256:6011983856DB3ADF6958005A41190AA4774D20A4B100F129E420FC10622D6FA0 | |||
3896 | HskDDNS_5.0.0.21724.exe | C:\Program Files\Oray\HskDDNS\HskDDNS.exe | executable | |
MD5:78FC0052D63A8B68D7000F47F9AA81D8 | SHA256:950E4BCF1841481B53E2C8C7774BE2F1A09C20BE5F8AEDCEB8AC65B05D6CBB70 | |||
1972 | HskDDNS.exe | C:\Users\admin\AppData\Local\Temp\mblctr.48x48.png | image | |
MD5:DD86AD27DF464D287D9290B72DCC0E2A | SHA256:7A67B7E08F94A9BECF7C8492D59DF717090871069272D4EAF90345BE2F10A1A2 | |||
1972 | HskDDNS.exe | C:\Users\admin\AppData\Local\Temp\sapisvr.48x48.png | image | |
MD5:59D05797C5EC8EAFDCDF5D35BC494A7E | SHA256:91DF6BA3A5993A56BA9CC9502C07AE503185D7C0DD89E49CEE575236C00502D5 | |||
3896 | HskDDNS_5.0.0.21724.exe | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\花生壳\花生壳.lnk | lnk | |
MD5:564CBB0D2C87D57314AE334ABA872AAE | SHA256:5814802AF5301DD73BC65B2B179FECE37E75BF5FAFB4853C6762325D85FD52F0 | |||
3896 | HskDDNS_5.0.0.21724.exe | C:\Program Files\Oray\HskDDNS\HskDDNSMaint.exe | executable | |
MD5:8BC19CC265C5732EBF2800E34EE6E905 | SHA256:9A66D29989DFD4E25306928EA63B3E9D371C3B252432832AEF7E0A8E3D697F4D | |||
1972 | HskDDNS.exe | C:\Users\admin\AppData\Local\Temp\NetProj.48x48.png | image | |
MD5:EB128548D171E158D55A9324EAC9ACBD | SHA256:640BD10707A94C0983E78D96DFF49468B0D1C65D52FC7ED91DE6AC20C63BEE36 | |||
2284 | phtunnel.exe | C:\Program Files\Oray\HskDDNS\phtunnel.json | text | |
MD5:6340262783ECFACE8500D0DEB9CA2DF1 | SHA256:FEA86A0A5727B91640639514993622B0B0D142588362EA3E034C36E975FA8C81 | |||
2284 | phtunnel.exe | C:\Windows\system32\config\systemprofile\phtunnel.pid | text | |
MD5:7DC149965BE269753E1CDB8E581CADA4 | SHA256:16BC62AF2F83648030DE9BEE349D7DF1715EDE0BD857B663C3E3F2DA05C95A98 | |||
3896 | HskDDNS_5.0.0.21724.exe | C:\Program Files\Oray\HskDDNS\oraylog.dll | executable | |
MD5:79186064E2310681C28052F0BE5C4652 | SHA256:A9612CC064B472BFA2CAC89CDF2C73B0F804BFA98A8DBCA767D2A329A205B20B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3896 | HskDDNS_5.0.0.21724.exe | GET | 200 | 222.73.7.11:80 | http://client.oray.net/feedback/install?isgreen=0&track=oray.com&r=1573890871&version=5.0.0.21724&key=6311a6471a6072b349c1f10ec549e40c&client=ddns | CN | text | 7 b | unknown |
3896 | HskDDNS_5.0.0.21724.exe | POST | 200 | 114.55.209.149:80 | http://ph-tk.oray.com/track | CN | text | 50 b | unknown |
3896 | HskDDNS_5.0.0.21724.exe | POST | 200 | 114.55.209.149:80 | http://ph-tk.oray.com/track | CN | text | 50 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3896 | HskDDNS_5.0.0.21724.exe | 114.55.209.149:80 | ph-tk.oray.com | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
2284 | phtunnel.exe | 118.31.225.247:443 | hsk-api.oray.com | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
3896 | HskDDNS_5.0.0.21724.exe | 222.73.7.11:80 | client.oray.net | China Telecom (Group) | CN | unknown |
2284 | phtunnel.exe | 47.99.166.140:6061 | phsle5-std01.oray.net | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
1972 | HskDDNS.exe | 118.31.225.247:443 | hsk-api.oray.com | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
3896 | HskDDNS_5.0.0.21724.exe | 172.217.21.238:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
ph-tk.oray.com |
| unknown |
client.oray.net |
| unknown |
hsk-api.oray.com |
| unknown |
phsle5-std01.oray.net |
| unknown |
www.google-analytics.com |
| whitelisted |
2.100.168.192.in-addr.arpa |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2284 | phtunnel.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
Process | Message |
---|---|
HskDDNSMaint.exe | load oraylog.dll
|
HskDDNSMaint.exe | CreateFileMapping oraylog file mapping ok, |
HskDDNSMaint.exe | Global\764F2066-E3C5-4108-A748-B7D2D1003748C__PROGRA~1_Oray_HskDDNS_oraylog.dll.sd.share |
HskDDNSMaint.exe | |
HskDDNSMaint.exe | oraylog MapViewOfFile ok
|
HskDDNS.exe | 2019-11-16 07:54:44.524 - Info - [interface] now status is 4
|
HskDDNS.exe | [string "..."]:4547: attempt to index a nil value (global 'password_edit') |
HskDDNS.exe | [string "..."]:4547: attempt to index a nil value (global 'password_edit') |