analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

PascProbe_v1_3_19_314(14MAR2019).zip

Full analysis: https://app.any.run/tasks/19dc3ba0-850a-4688-9044-7206020467f5
Verdict: Malicious activity
Analysis date: September 19, 2019, 06:04:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

B9EEC8F655B4F84980A357D001514026

SHA1:

6DC4AA68002220EB1564E9D7CE096A5598F3C340

SHA256:

95CD8409EFBBC60F50F7E90093EDEFD116D853B80CE65C94E7107B2E7C5F19A2

SSDEEP:

12288:ZQ6oSJ0XtqZPnUcJCaiLaHXSD04Cwy7MZVRFBhK+waBSAm:Z+HAPfJ2LaCDCwy7MPRbhKNaQAm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PacsProbe.exe (PID: 2644)
      • PacsProbe.exe (PID: 3456)

  • SUSPICIOUS

    • Starts Internet Explorer

      • PacsProbe.exe (PID: 2644)

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2400)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3528)

  • INFO

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2400)
      • iexplore.exe (PID: 3560)

    • Changes internet zones settings

      • iexplore.exe (PID: 3344)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3344)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3560)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3560)

    • Manual execution by user

      • PacsProbe.exe (PID: 2644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: PacsProbe.exe
ZipUncompressedSize: 574464
ZipCompressedSize: 537934
ZipCRC: 0xcddbd86d
ZipModifyDate: 2019:03:14 22:23:10
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe pacsprobe.exe no specs pacsprobe.exe no specs iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3528"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PascProbe_v1_3_19_314(14MAR2019).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3456"C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.14504\PacsProbe.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3528.14504\PacsProbe.exe—WinRAR.exe
User:
admin
Company:
CardWerk Technologies
Integrity Level:
MEDIUM
Description:
PacsProbe.exe
Exit code:
0
Version:
1.3.19.314
2644"C:\Users\admin\Desktop\PacsProbe.exe" C:\Users\admin\Desktop\PacsProbe.exe—explorer.exe
User:
admin
Company:
CardWerk Technologies
Integrity Level:
MEDIUM
Description:
PacsProbe.exe
Version:
1.3.19.314
3344"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
PacsProbe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3560"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3344 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2400C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
Total events
999
Read events
886
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
0
Text files
22
Unknown types
16

Dropped files

PID
Process
Filename
Type
3344iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
3344iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ZYV5K8A\cardwerk_com[1].txt —
MD5:—
SHA256:—
3528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3528.14504\scardsynx64.dllexecutable
MD5:0E8725C0F7F802CB0E7656A56378FE6C
SHA256:6FDF2BF6280AF5C726585549357FAA400CFF957BB027FBA875DABD02F625ECC1
3528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3528.14504\scardsyn.dllexecutable
MD5:10F415C061DC1EE41CE7BE95C72DAB08
SHA256:98ABF8A38A6DDE0F3F613660C6E4CA3A39C93EE08CD75CED208FF653390D5B11
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WC5LF9GC\MULTOS-logo[1].jpgimage
MD5:7594D35486E2B47F889DDB4FBDE8CB25
SHA256:5DC33A39F0205F9332C5F424F46D225F86E7EEBFE0277EF386260014EF75674D
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WC5LF9GC\KeyCard256x256-150x150[1].gifimage
MD5:3477846977E24AC6ED10BE189D91C8AA
SHA256:35F8E70E6AE57C5F7B7481DBFE2B65DD6021F60B9C15BEE5AA1C6615BBF2B283
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6ZYV5K8A\cardwerk_com[1].htmhtml
MD5:0B2D621C744CE6173B76CCA0B73A886D
SHA256:F0CDD600FC90C8EE0BDFB123CD413CBC91A9405E5B23A2F0F54E105D8FFEB498
3528WinRAR.exeC:\Users\admin\Desktop\PacsProbe.exeexecutable
MD5:184CD687A27E98D3CB90358318FBDE95
SHA256:4D9D700C1ACBF3FEDDD51D05CC6D939EEB1B3848E1CDE4DFC6EBAC559C9E2437
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:2A9A50BE2DBDB126BEB9507C4201C35D
SHA256:B0DCC5A4C4AC5948AE5BCAAD9D8FA996244081BE4F1F37538F57C19CAA55F61C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
26
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3560
iexplore.exe
GET
301
173.231.214.208:80
http://www.cardwerk.com/
US
—
—
unknown
3344
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3560
iexplore.exe
216.58.207.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3560
iexplore.exe
173.231.214.208:80
www.cardwerk.com
tzulo, inc.
US
unknown
3560
iexplore.exe
216.58.207.78:443
www.google-analytics.com
Google Inc.
US
whitelisted
3560
iexplore.exe
172.217.16.131:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3560
iexplore.exe
89.187.169.79:443
cardwerk.b-cdn.net
—
CZ
suspicious
3560
iexplore.exe
173.231.214.208:443
www.cardwerk.com
tzulo, inc.
US
unknown
3344
iexplore.exe
173.231.214.208:443
www.cardwerk.com
tzulo, inc.
US
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.cardwerk.com
  • 173.231.214.208
unknown
cardwerk.b-cdn.net
  • 89.187.169.79
whitelisted
www.google-analytics.com
  • 216.58.207.78
whitelisted
fonts.googleapis.com
  • 216.58.207.42
whitelisted
fonts.gstatic.com
  • 172.217.16.131
whitelisted
cardwerk.com
  • 173.231.214.208
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PascProbe_v1_3_19_314(14MAR2019).zip