File name: | setup.exe |
Full analysis: | https://app.any.run/tasks/59053c25-54ad-49ad-9965-4c1eb4d86b5f |
Verdict: | Malicious activity |
Analysis date: | October 19, 2020, 20:08:24 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 1AAAC8234D2AE26DCB298C12CB2BD2E1 |
SHA1: | 7E1B3508AA73EB57CBD75DD877F5B4A40162ADBC |
SHA256: | 9AC6F216ADABCDD20D9CA352935F78DCBD5CCCF2F4D597C10F1812E82F9A01FE |
SSDEEP: | 196608:JvtAZj41WJ6pzqZjwT6p14pwOYWNyi9KDecyPGtvM:JKZ9JozqZjWaKhsCc56 |
.exe | | | Inno Setup installer (77.7) |
---|---|---|
.exe | | | Win32 Executable Delphi generic (10) |
.dll | | | Win32 Dynamic Link Library (generic) (4.6) |
.exe | | | Win32 Executable (generic) (3.1) |
.exe | | | Win16/32 Executable Delphi generic (1.4) |
ProductVersion: | |
---|---|
ProductName: | The Evil Within |
LegalCopyright: | FitGirl |
FileVersion: | |
FileDescription: | The Evil Within Setup |
CompanyName: | |
Comments: | This installation was built with Inno Setup. |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 0.0.0.0 |
FileVersionNumber: | 0.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5 |
ImageVersion: | 6 |
OSVersion: | 5 |
EntryPoint: | 0x16478 |
UninitializedDataSize: | - |
InitializedDataSize: | 53760 |
CodeSize: | 86016 |
LinkerVersion: | 2.25 |
PEType: | PE32 |
TimeStamp: | 2012:10:02 07:04:04+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 02-Oct-2012 05:04:04 |
Detected languages: |
|
Comments: | This installation was built with Inno Setup. |
CompanyName: | - |
FileDescription: | The Evil Within Setup |
FileVersion: | - |
LegalCopyright: | FitGirl |
ProductName: | The Evil Within |
ProductVersion: | - |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 8 |
Time date stamp: | 02-Oct-2012 05:04:04 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000143F8 | 0x00014400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.4822 |
.itext | 0x00016000 | 0x00000BE8 | 0x00000C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.01516 |
.data | 0x00017000 | 0x00000D9C | 0x00000E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.66929 |
.bss | 0x00018000 | 0x00005750 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x0001E000 | 0x00000F9E | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.96778 |
.tls | 0x0001F000 | 0x00000008 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x00020000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.190489 |
.rsrc | 0x00021000 | 0x0000B200 | 0x0000B200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.15744 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.06505 | 1376 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 3.47151 | 1384 | UNKNOWN | Chinese - PRC | RT_ICON |
3 | 3.91708 | 744 | UNKNOWN | Chinese - PRC | RT_ICON |
4 | 3.91366 | 2216 | UNKNOWN | Chinese - PRC | RT_ICON |
4091 | 3.13038 | 196 | UNKNOWN | UNKNOWN | RT_STRING |
4092 | 3.36196 | 204 | UNKNOWN | UNKNOWN | RT_STRING |
4093 | 3.34841 | 372 | UNKNOWN | UNKNOWN | RT_STRING |
4094 | 3.29351 | 924 | UNKNOWN | UNKNOWN | RT_STRING |
4095 | 3.34579 | 844 | UNKNOWN | UNKNOWN | RT_STRING |
4096 | 3.28057 | 660 | UNKNOWN | UNKNOWN | RT_STRING |
advapi32.dll |
comctl32.dll |
kernel32.dll |
oleaut32.dll |
user32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2788 | "C:\Users\admin\AppData\Local\Temp\setup.exe" | C:\Users\admin\AppData\Local\Temp\setup.exe | — | explorer.exe |
User: admin Company: Integrity Level: MEDIUM Description: The Evil Within Setup Exit code: 3221226540 Version: | ||||
2508 | "C:\Users\admin\AppData\Local\Temp\setup.exe" | C:\Users\admin\AppData\Local\Temp\setup.exe | explorer.exe | |
User: admin Company: Integrity Level: HIGH Description: The Evil Within Setup Version: | ||||
956 | "C:\Users\admin\AppData\Local\Temp\is-7POEN.tmp\setup.tmp" /SL5="$B0164,6763554,140800,C:\Users\admin\AppData\Local\Temp\setup.exe" | C:\Users\admin\AppData\Local\Temp\is-7POEN.tmp\setup.tmp | setup.exe | |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Version: 51.1052.0.0 | ||||
3660 | "C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\FlushFileCache.exe" | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\FlushFileCache.exe | — | setup.tmp |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
3224 | "C:\Games\The Evil Within\unins000.exe" /VERYSILENT | C:\Games\The Evil Within\unins000.exe | setup.tmp | |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 | ||||
2540 | "C:\Users\admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\The Evil Within\unins000.exe" /FIRSTPHASEWND=$30208 /VERYSILENT | C:\Users\admin\AppData\Local\Temp\_iu14D2N.tmp | unins000.exe | |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\cls-lolzx_x64.exe | executable | |
MD5:1AA4F56CFD9D0685B03807626E12DF9A | SHA256:4CB2243D60B3C84683F88F97394DD020BE455196AA61A414A358A77D67BF902E | |||
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\ISDone.dll | executable | |
MD5:4FEAFA8B5E8CDB349125C8AF0AC43974 | SHA256:BB8A0245DCC5C10A1C7181BAD509B65959855009A8105863EF14F2BB5B38AC71 | |||
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\wintb.dll | executable | |
MD5:9436DF49E08C83BAD8DDC906478C2041 | SHA256:1910537AA95684142250CA0C7426A0B5F082E39F6FBDBDBA649AECB179541435 | |||
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\cls-lolly.dll | executable | |
MD5:0EF04BC15FD1B28975AFF2951B857F03 | SHA256:F84677643D9977AA1E8A4AA8C85A12665D29A4E8292485A0B4DF846DD161F824 | |||
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\BASS.dll | executable | |
MD5:8005750EC63EB5292884AD6183AE2E77 | SHA256:DF9F56C4DA160101567B0526845228EE481EE7D2F98391696FA27FE41F8ACF15 | |||
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\cls-lolzi_x64.exe | executable | |
MD5:1CDF04881EB33F5D2CDDE21F4D1934E7 | SHA256:8CE66660890D99E78A86EF24F185D189EB01DFE3E7028C360958016281D10C89 | |||
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\cls-lolly_x86.exe | executable | |
MD5:9A993745FACE8B99D0C3B873A0B7627A | SHA256:97359790449FC59577D9D5D0EBCEFD289D1CF95BB632EF58286F39B744C5313E | |||
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\cls-lolzi_x86.exe | executable | |
MD5:2A108C93DFCF6B488880D0423D1F0EC7 | SHA256:CBC1D8A42AC2FF81C1F0D817312867D86A4EC2A7058D56E56C282F062113B9E0 | |||
956 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-9Q0V7.tmp\idp.dll | executable | |
MD5:AF555AC9C073F88FE5BF0D677F085025 | SHA256:F4FC0187491A9CB89E233197FF72C2405B5EC02E8B8EA640EE68D034DDBC44BB |