File name: | avira_en_vpnb0___pvpnws.exe |
Full analysis: | https://app.any.run/tasks/d07e1d66-1ca4-4590-a30d-e422aa38da3e |
Verdict: | Malicious activity |
Analysis date: | March 30, 2020, 16:50:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 60395DE4A177237F92584433B9E1EF18 |
SHA1: | 15BCAB4D1198F50BF148993DB8D86F9182B219D1 |
SHA256: | 956180895B6E50747B905E98718618C87A9A5007C582EAD563A37A53EB57D9B7 |
SSDEEP: | 196608:4hfUU8Z9Z0/v6YC83CzZ+pC+JDsKlbpP43:4RUjzZ0/v68OgpjZsgV43 |
.exe | | | Win64 Executable (generic) (76.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (12.4) |
.exe | | | Generic Win/DOS Executable (5.5) |
.exe | | | DOS Executable Generic (5.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2020:02:26 17:49:16+01:00 |
PEType: | PE32 |
LinkerVersion: | 12 |
CodeSize: | 288768 |
InitializedDataSize: | 306176 |
UninitializedDataSize: | - |
EntryPoint: | 0x37f09 |
OSVersion: | 5.1 |
ImageVersion: | - |
SubsystemVersion: | 5.1 |
Subsystem: | Windows GUI |
FileVersionNumber: | 1.2.144.30330 |
ProductVersionNumber: | 1.2.144.30330 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Windows, Latin1 |
CompanyName: | Avira Operations GmbH & Co. KG |
FileDescription: | Avira |
FileVersion: | 1.2.144.30330 |
InternalName: | setup |
LegalCopyright: | Copyright © 2019 Avira Operations GmbH & Co. KG and its Licensors |
OriginalFileName: | Avira.OE.Setup.Bundle.exe |
ProductName: | Avira |
ProductVersion: | 1.2.144.30330 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 26-Feb-2020 16:49:16 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | Avira Operations GmbH & Co. KG |
FileDescription: | Avira |
FileVersion: | 1.2.144.30330 |
InternalName: | setup |
LegalCopyright: | Copyright © 2019 Avira Operations GmbH & Co. KG and its Licensors |
OriginalFilename: | Avira.OE.Setup.Bundle.exe |
ProductName: | Avira |
ProductVersion: | 1.2.144.30330 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 7 |
Time date stamp: | 26-Feb-2020 16:49:16 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0004660E | 0x00046800 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.54363 |
.rdata | 0x00048000 | 0x0001D86C | 0x0001DA00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.93956 |
.data | 0x00066000 | 0x000035E0 | 0x00001600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.58198 |
.wixburn8 | 0x0006A000 | 0x00000038 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.742974 |
.tls | 0x0006B000 | 0x00000009 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x0006C000 | 0x00027610 | 0x00027800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.55843 |
.reloc | 0x00094000 | 0x00003E3C | 0x00004000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.73 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.30829 | 1234 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 2.39986 | 67624 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 2.49457 | 38056 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 2.65675 | 16936 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 2.80124 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 3.07284 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 3.46786 | 2440 | Latin 1 / Western European | English - United States | RT_ICON |
8 | 3.88962 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
ADVAPI32.dll |
GDI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
RPCRT4.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll (delay-loaded) |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2828 | "C:\Users\admin\Desktop\avira_en_vpnb0___pvpnws.exe" | C:\Users\admin\Desktop\avira_en_vpnb0___pvpnws.exe | explorer.exe | |
User: admin Company: Avira Operations GmbH & Co. KG Integrity Level: MEDIUM Description: Avira Version: 1.2.144.30330 | ||||
3052 | "C:\Users\admin\AppData\Local\Temp\{71A914A1-2297-4131-A6CE-70DB630B7FE4}\.cr\avira_en_vpnb0___pvpnws.exe" -burn.clean.room="C:\Users\admin\Desktop\avira_en_vpnb0___pvpnws.exe" -burn.filehandle.attached=148 -burn.filehandle.self=156 | C:\Users\admin\AppData\Local\Temp\{71A914A1-2297-4131-A6CE-70DB630B7FE4}\.cr\avira_en_vpnb0___pvpnws.exe | avira_en_vpnb0___pvpnws.exe | |
User: admin Company: Avira Operations GmbH & Co. KG Integrity Level: MEDIUM Description: Avira Version: 1.2.144.30330 | ||||
1800 | "C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.be\Avira.OE.Setup.Bundle.exe" -q -burn.elevated BurnPipe.{23D49202-E153-4EA2-8681-521C0293319A} {24AEAE96-D177-47D9-9B04-DF9E3F0381F6} 3052 | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.be\Avira.OE.Setup.Bundle.exe | avira_en_vpnb0___pvpnws.exe | |
User: admin Company: Avira Operations GmbH & Co. KG Integrity Level: HIGH Description: Avira Version: 1.2.144.30330 | ||||
1920 | "C:\ProgramData\Package Cache\03728D13C6B8152C05F3C44FA7C264A9F4C5D751\Avira.OE.Setup.Prerequisites.exe" /enableMsiService /checkRebootRequired | C:\ProgramData\Package Cache\03728D13C6B8152C05F3C44FA7C264A9F4C5D751\Avira.OE.Setup.Prerequisites.exe | — | Avira.OE.Setup.Bundle.exe |
User: admin Company: Avira Operations GmbH & Co. KG Integrity Level: HIGH Description: Avira.OE.Setup.Prerequisites Exit code: 0 Version: 1.2.144.30330 | ||||
3808 | "C:\ProgramData\Package Cache\03728D13C6B8152C05F3C44FA7C264A9F4C5D751\Avira.OE.Setup.Prerequisites.exe" /writeCrossDetectionKey | C:\ProgramData\Package Cache\03728D13C6B8152C05F3C44FA7C264A9F4C5D751\Avira.OE.Setup.Prerequisites.exe | — | Avira.OE.Setup.Bundle.exe |
User: admin Company: Avira Operations GmbH & Co. KG Integrity Level: HIGH Description: Avira.OE.Setup.Prerequisites Exit code: 0 Version: 1.2.144.30330 | ||||
3076 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2948 | C:\Windows\system32\MsiExec.exe -Embedding 24C2533349C9A7718620B78999225981 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2844 | rundll32.exe "C:\Windows\Installer\MSIBBD6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_10927250 1 Avira.OE.Setup.CustomActions!Avira.OE.Setup.CustomActions.DesktopShortcut.CheckForShortcuts | C:\Windows\system32\rundll32.exe | MsiExec.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2092 | rundll32.exe "C:\Windows\Installer\MSIC0CB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_10928328 13 Avira.OE.Setup.CustomActions!Avira.OE.Setup.CustomActions.Migration.MigrateSettingsFile | C:\Windows\system32\rundll32.exe | — | MsiExec.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3720 | rundll32.exe "C:\Windows\Installer\MSIC1A6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_10928546 20 Avira.OE.Setup.CustomActions!Avira.OE.Setup.CustomActions.Configuration.SetSimpleCacheVersion | C:\Windows\system32\rundll32.exe | — | MsiExec.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3052 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.ba\Ui\css\styles.ie8.css | text | |
MD5:B830A30DF2636BBE68D4F2746F676C61 | SHA256:9116729A52CF5B1D31B7D366A073E302F43E083C5210C3986A60B836FB698714 | |||
3052 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.ba\Ui\page.html | html | |
MD5:8D12108DF79297A8A3709DC913501EF2 | SHA256:D2E1CDD3244338F219978C725BE1375956CD06BCF65E1634453F33C4AFF18221 | |||
3052 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.ba\thm.xml | xml | |
MD5:EC0BDB2B232D6ACAD037CC13281CBD15 | SHA256:9AECD08839F1D3223188029DEBE49504D760314148EFFDA1520BCEE5CEA451F2 | |||
3052 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.ba\Ui\images\loading.ie8.gif | image | |
MD5:8039A24504716835C871673883E59820 | SHA256:362DEA985E7C5BDE02D65380C45CD37DB0CC5DDD10CD277D0E20B0E0C666FA9F | |||
3052 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.ba\Ui\images\illustration_fss.png | image | |
MD5:F2D6D84DFDCA1507FE7BA84DDA886DD5 | SHA256:8B36218FB27E3931E8F7F465056C2CC84C6897D6A1B85F391352D765EAE0BDD8 | |||
3052 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.ba\Ui\fonts\co-icon-font.eot | eot | |
MD5:DC7AF97FD125F09920BFBCF4E67A5779 | SHA256:FA3E72F29F73A8EE08FB6D2DD976AB9E2A91A7EF7470D0ED01B95742825FF55F | |||
3052 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.ba\WixStdBA.dll | executable | |
MD5:E51A694889E8131D808D83633B380C25 | SHA256:BF99547EF929566620AE3237D770F51C79580C5B520825B411BD8988CF55582F | |||
2828 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{71A914A1-2297-4131-A6CE-70DB630B7FE4}\.cr\avira_en_vpnb0___pvpnws.exe | executable | |
MD5:10A392994D3A72B026D7CE78DF576A40 | SHA256:702AD17DBEBD15533A9C84F0FFE44ABF7DD2C9157E191FFE45FAC2CBEF55ACCA | |||
3052 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.ba\Ui\css\styles.css | text | |
MD5:74281F215157CB90DE6719616D3E3011 | SHA256:F49CD3360E5B37E6ADA1E07905FB638F5CC6867F16602733B56A0AECF57B41BD | |||
3052 | avira_en_vpnb0___pvpnws.exe | C:\Users\admin\AppData\Local\Temp\{9F05649F-F2BB-4812-B6A5-73D69B3BF7A1}\.ba\logo.png | image | |
MD5:199AD0AE37D27171CEB3F99666D037FF | SHA256:DF9B0C0EB348162383522A326E2BFC9E0BA0D9621478AB6EFCCF30E6C698F117 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3052 | avira_en_vpnb0___pvpnws.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D | US | der | 727 b | whitelisted |
3052 | avira_en_vpnb0___pvpnws.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQLqIKj6Gi5thHaqKC1ECU9aXsCRQQUmvMr2s%2BtT7YvuypISCoStxtCwSQCEBLOxnPQyWHOCM2d3uZuQ04%3D | US | der | 471 b | whitelisted |
3052 | avira_en_vpnb0___pvpnws.exe | GET | 200 | 151.139.128.14:80 | http://crl.usertrust.com/AddTrustExternalCARoot.crl | US | der | 673 b | whitelisted |
2988 | Avira.ServiceHost.exe | GET | 200 | 23.55.161.155:80 | http://www.msftncsi.com/ncsi.txt | US | text | 14 b | whitelisted |
2988 | Avira.ServiceHost.exe | GET | 200 | 23.55.161.155:80 | http://www.msftncsi.com/ncsi.txt | US | text | 14 b | whitelisted |
2988 | Avira.ServiceHost.exe | GET | 200 | 23.55.161.155:80 | http://www.msftncsi.com/ncsi.txt | US | text | 14 b | whitelisted |
2988 | Avira.ServiceHost.exe | GET | 200 | 23.55.161.155:80 | http://www.msftncsi.com/ncsi.txt | US | text | 14 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 151.139.128.14:80 | ocsp.usertrust.com | Highwinds Network Group, Inc. | US | suspicious |
3052 | avira_en_vpnb0___pvpnws.exe | 151.139.128.14:80 | ocsp.usertrust.com | Highwinds Network Group, Inc. | US | suspicious |
3052 | avira_en_vpnb0___pvpnws.exe | 18.196.112.115:443 | api.my.avira.com | Amazon.com, Inc. | DE | unknown |
2988 | Avira.ServiceHost.exe | 23.55.161.155:80 | www.msftncsi.com | Akamai International B.V. | US | suspicious |
2988 | Avira.ServiceHost.exe | 18.153.6.21:443 | ssldev.oes.avira.com | — | US | unknown |
2988 | Avira.ServiceHost.exe | 130.211.34.183:443 | api.mixpanel.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
api.my.avira.com |
| unknown |
ocsp.usertrust.com |
| whitelisted |
crl.usertrust.com |
| whitelisted |
ocsp.comodoca.com |
| whitelisted |
ssldev.oes.avira.com |
| unknown |
www.msftncsi.com |
| whitelisted |
api.mixpanel.com |
| whitelisted |