File name:

9sjw9cusa.exe

Full analysis: https://app.any.run/tasks/83536df0-6077-4b4b-a6ac-ef4e664891b9
Verdict: No threats detected
Analysis date: August 19, 2019, 07:57:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

EDF8D6D66AD9E1364AEC1D86F6F9E5D9

SHA1:

EF0FB9B5FE1181E540C7D44BF2BF8BA743D4378F

SHA256:

966EC670D3F36AB6024D4608F6C7572E35A5716B41B50860E2FE86847378C560

SSDEEP:

12288:abd4tJ85YY8yyAbm0sFOvHRse2anNtrgdDJ:abdwsYY8ytbmtQT2anfgd1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 9sjw9cusa.exe (PID: 2564)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2001:06:29 18:31:17+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 73728
InitializedDataSize: 212992
UninitializedDataSize: -
EntryPoint: 0x88f7
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.0.100.1124
ProductVersionNumber: 4.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: This is an OFFICIAL PRODUCTION Build.
CompanyName: Lenovo Group Limited
FileDescription: LENOVO BIOS Setup Utilities
InternalName: stub32
OriginalFileName: stub32i.exe
FileVersion: 9C
LegalCopyright: COPYRIGHT IBM CORPORATION and LENOVO 2005 All RIGHTS RESERVE
ProductName: LENOVO BIOS Setup Utilities
ProductVersion: 9C

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 29-Jun-2001 16:31:17
Detected languages:
  • English - United States
Comments: This is an OFFICIAL PRODUCTION Build.
CompanyName: Lenovo Group Limited
FileDescription: LENOVO BIOS Setup Utilities
InternalName: stub32
OriginalFilename: stub32i.exe
FileVersion: 9C
LegalCopyright: COPYRIGHT IBM CORPORATION and LENOVO 2005 All RIGHTS RESERVE
ProductName: LENOVO BIOS Setup Utilities
ProductVersion: 9C

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 29-Jun-2001 16:31:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00011AC6
0x00012000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.59781
.rdata
0x00013000
0x00001950
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.78188
.data
0x00015000
0x00004E38
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.42849
.rsrc
0x0001A000
0x0002CAA8
0x0002D000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.02307

Resources

Title
Entropy
Size
Codepage
Language
Type
1
2.80312
1640
UNKNOWN
English - United States
RT_VERSION
2
6.39652
1384
UNKNOWN
English - United States
RT_ICON
3
3.18406
424
UNKNOWN
English - United States
RT_STRING
4
3.07096
282
UNKNOWN
English - United States
RT_STRING
19
2.86832
186
UNKNOWN
English - United States
RT_STRING
20
3.28952
870
UNKNOWN
English - United States
RT_STRING
21
2.89596
152
UNKNOWN
English - United States
RT_STRING
103
2.64576
62
UNKNOWN
English - United States
RT_GROUP_ICON
118
7.04133
154530
UNKNOWN
English - United States
RT_BITMAP
132
4.04914
14564
UNKNOWN
English - United States
RT_BITMAP

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
LZ32.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 9sjw9cusa.exe 9sjw9cusa.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2564"C:\Users\admin\AppData\Local\Temp\9sjw9cusa.exe" C:\Users\admin\AppData\Local\Temp\9sjw9cusa.exe
explorer.exe
User:
admin
Company:
Lenovo Group Limited
Integrity Level:
HIGH
Description:
LENOVO BIOS Setup Utilities
Exit code:
0
Version:
9C
Modules
Images
c:\users\admin\appdata\local\temp\9sjw9cusa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3776"C:\Users\admin\AppData\Local\Temp\9sjw9cusa.exe" C:\Users\admin\AppData\Local\Temp\9sjw9cusa.exe—explorer.exe
User:
admin
Company:
Lenovo Group Limited
Integrity Level:
MEDIUM
Description:
LENOVO BIOS Setup Utilities
Exit code:
3221226540
Version:
9C
Modules
Images
c:\users\admin\appdata\local\temp\9sjw9cusa.exe
c:\systemroot\system32\ntdll.dll
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
25649sjw9cusa.exeC:\Users\admin\AppData\Local\Temp\ext9D8E.tmp —
MD5:—
SHA256:—
25649sjw9cusa.exeC:\Users\admin\AppData\Local\Temp\pftE5A4.tmp\pftw1.pkg —
MD5:—
SHA256:—
25649sjw9cusa.exeC:\SWTOOLS\FLASH\9SJW9CUSA\srdos.exeexecutable
MD5:—
SHA256:—
25649sjw9cusa.exeC:\SWTOOLS\FLASH\9SJW9CUSA\CFGWIN.exeexecutable
MD5:—
SHA256:—
25649sjw9cusa.exeC:\SWTOOLS\FLASH\9SJW9CUSA\readme.txttext
MD5:—
SHA256:—
25649sjw9cusa.exeC:\SWTOOLS\FLASH\9SJW9CUSA\srwin.exeexecutable
MD5:—
SHA256:—
25649sjw9cusa.exeC:\Users\admin\AppData\Local\Temp\plf9D8D.tmptext
MD5:9EFCC61A0BAA38A6D7C67A05A97C7B87
SHA256:7CCB3A50CA08C66A220E4DA614CBABA1D05157359EDD174223C788B86D929EDF
25649sjw9cusa.exeC:\SWTOOLS\FLASH\9SJW9CUSA\LeCrud.sysexecutable
MD5:67E776B6D0E23A38C7456F7941E2F86D
SHA256:B0F6175B692477699775D12781A294BC6B7EFDD508C544AEF91289F95437FA30
25649sjw9cusa.exeC:\SWTOOLS\FLASH\9SJW9CUSA\LeCrud64.sysexecutable
MD5:0B1509302DA4002B9C38147AFE3FCB55
SHA256:9D99EA8DBFAAB018A3BB3557780651B9D4E018B7EFBC2DAACDDD5C6DE1362E49
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
9sjw9cusa.exe