analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6

Full analysis: https://app.any.run/tasks/ab376458-976a-4ca8-811b-4ad12fe13b59
Verdict: Malicious activity
Analysis date: May 20, 2019, 21:44:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

41F803B67D8E71BAF3DED52430C59B52

SHA1:

50D621CA671CEF718DA2B3A09744099D19790D3A

SHA256:

9BFAB76542E63A86D45F3B233D54510B2EEB10A7532EB21BF53DBA0288721FE6

SSDEEP:

98304:ovaAQf8VFZN98jGUxFCTXyh9Rs7hlDOoaCauiwWnkgQsk4PojHRMUeVkNWmICs6u:iff98jl/YXyhPuiwd4PgKk4e5fp9m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses SVCHOST.EXE for hidden code execution

      • 9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe (PID: 2368)

    • Changes settings of System certificates

      • svchost.exe (PID: 116)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • svchost.exe (PID: 3260)
      • svchost.exe (PID: 3644)
      • svchost.exe (PID: 2456)
      • svchost.exe (PID: 116)

    • Reads internet explorer settings

      • svchost.exe (PID: 116)
      • svchost.exe (PID: 3260)
      • svchost.exe (PID: 3644)
      • svchost.exe (PID: 2456)

    • Low-level read access rights to disk partition

      • 9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe (PID: 2368)

    • Executable content was dropped or overwritten

      • 9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe (PID: 2368)

    • Adds / modifies Windows certificates

      • svchost.exe (PID: 116)

    • Creates files in the user directory

      • svchost.exe (PID: 116)

  • INFO

    • Reads settings of System Certificates

      • svchost.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (22.8)
.exe | Win32 Executable MS Visual C++ (generic) (17.1)
.exe | Win64 Executable (generic) (15.1)
.exe | UPX compressed Win32 Executable (14.8)
.exe | Win32 EXE Yoda's Crypter (14.5)

EXIF

EXE

Comments: 七日杀反外挂登录器-客户端
LegalCopyright: Yy：9912746
CompanyName: 腾龙网络
ProductVersion: 1.6.8.0
ProductName: 七日杀反外挂登录器-客户端
FileDescription: 七日杀反外挂登录器-客户端
FileVersion: 1.6.8.0
CharacterSet: Unicode
LanguageCode: Chinese (Simplified)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 1.6.8.0
FileVersionNumber: 1.6.8.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0xd34c5
UninitializedDataSize: -
InitializedDataSize: 11206656
CodeSize: 1003520
LinkerVersion: 6
PEType: PE32
TimeStamp: 2018:09:03 12:06:33+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 03-Sep-2018 10:06:33
Detected languages:
  • Chinese - PRC
FileVersion: 1.6.8.0
FileDescription: 七日杀反外挂登录器-客户端
ProductName: 七日杀反外挂登录器-客户端
ProductVersion: 1.6.8.0
CompanyName: 腾龙网络
LegalCopyright: Yy：9912746
Comments: 七日杀反外挂登录器-客户端

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000120

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 03-Sep-2018 10:06:33
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000F42E6
0x000F5000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.47982
.rdata
0x000F6000
0x00A0320A
0x00A04000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.27003
.data
0x00AFA000
0x00068EEA
0x0001B000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.43403
.rsrc
0x00B63000
0x00090128
0x00091000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.42716

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.02094
697
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
2
2.18858
296
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
3.23583
1128
Latin 1 / Western European
UNKNOWN
RT_ICON
4
2.94557
2440
Latin 1 / Western European
UNKNOWN
RT_ICON
5
2.91689
4264
Latin 1 / Western European
UNKNOWN
RT_ICON
6
2.57764
9640
Latin 1 / Western European
UNKNOWN
RT_ICON
7
2.57903
16936
Latin 1 / Western European
UNKNOWN
RT_ICON
8
2.28337
38056
Latin 1 / Western European
UNKNOWN
RT_ICON
9
2.28315
67624
Latin 1 / Western European
UNKNOWN
RT_ICON
10
2.08551
152104
Latin 1 / Western European
UNKNOWN
RT_ICON

Imports

ADVAPI32.dll
AVIFIL32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
MSVFW32.dll
OLEAUT32.dll
RASAPI32.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe no specs 9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe svchost.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3320"C:\Users\admin\AppData\Local\Temp\9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe" C:\Users\admin\AppData\Local\Temp\9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe—explorer.exe
User:
admin
Company:
腾龙网络
Integrity Level:
MEDIUM
Description:
七日杀反外挂登录器-客户端
Exit code:
3221226540
Version:
1.6.8.0
2368"C:\Users\admin\AppData\Local\Temp\9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe" C:\Users\admin\AppData\Local\Temp\9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe
explorer.exe
User:
admin
Company:
腾龙网络
Integrity Level:
HIGH
Description:
七日杀反外挂登录器-客户端
Exit code:
0
Version:
1.6.8.0
116svchost.exeC:\Windows\system32\svchost.exe
9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3644svchost.exeC:\Windows\system32\svchost.exe—9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3260svchost.exeC:\Windows\system32\svchost.exe—9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2456svchost.exeC:\Windows\system32\svchost.exe—9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
433
Read events
365
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
113
Unknown types
6

Dropped files

PID
Process
Filename
Type
23689bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exeC:\Users\admin\AppData\Local\Temp\135806.tmp —
MD5:—
SHA256:—
23689bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exeC:\Users\admin\AppData\Local\Temp\135817.tmp —
MD5:—
SHA256:—
23689bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exeC:\Users\admin\AppData\Local\Temp\135818.tmp —
MD5:—
SHA256:—
116svchost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\view-history[1].jstext
MD5:4A3D081590FE4B2524C40BE1416DD5B2
SHA256:8D8F82A7E7D218E6393EF602DA88CA74BEEED9A1CFF40E455870F9EB51389BAD
116svchost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\cansu521[1].txttext
MD5:A524ACB988B8DC1DF5A50000AFA9AB2A
SHA256:83124F16B4E903454D4A525325AE17980E0D16DCBEF188DDC4994945419C64CF
116svchost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\style[1].csstext
MD5:5B9E429F5DD5007E1303F1A729D52760
SHA256:CBD7C3F10B7D384189E7F40F523D61F2B89BDD4B1A3D44408B942937B8B42E18
116svchost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\icomoon[1].eoteot
MD5:1F35F5A9A3759562E952D62EA4E2040F
SHA256:C83EB9569D0D9F8A00B278D7D528429BF9BF9E2DCA9ED26314F9D0890C4080CB
23689bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6.exeC:\Users\admin\AppData\Local\Temp\TxKePfU.sysexecutable
MD5:EDF9572138AE6456724DBA8C179A28F6
SHA256:0BEA9162EBE35D0CDD0FF27099E88C8A79065BABB5AF730F5C2E0E96EF9C698E
116svchost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\dy_31fad1a6769d0bc02da0d154efaada42[1].jpgimage
MD5:6A40BBFAE5172868152D973B934C890A
SHA256:C3A1E28A3598C503466A3FAE39C9D119F255096BEB023739A5EF2B4858E59C8B
116svchost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019052020190521\index.datdat
MD5:8BD34632CBB3E44C3BBCDD6FC5656583
SHA256:FCDAA2B5601DF4E37200CD3854D54C6499263D22A6848FC4387601CB53E6E318
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
47
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
116
svchost.exe
GET
200
45.249.95.61:80
http://www.mojunyy.cn/css/index.css
CN
text
11.6 Kb
malicious
116
svchost.exe
GET
200
45.249.95.61:80
http://www.mojunyy.cn/js/view-history.js
CN
text
206 Kb
malicious
116
svchost.exe
GET
200
45.249.95.61:80
http://www.mojunyy.cn/images/tubiao.png
CN
image
7.09 Kb
malicious
116
svchost.exe
GET
200
45.249.95.61:80
http://www.mojunyy.cn/images/qrcode.png
CN
image
49.3 Kb
malicious
116
svchost.exe
GET
200
45.249.95.61:80
http://www.mojunyy.cn/
CN
html
42.1 Kb
malicious
116
svchost.exe
GET
200
45.249.95.61:80
http://www.mojunyy.cn/images/logo.png
CN
image
4.43 Kb
malicious
116
svchost.exe
GET
200
99.84.87.89:80
http://p5.qhimg.com/d/dy_d0f5d0d2e4555838cf214a20af1efd90.jpg
US
image
22.9 Kb
whitelisted
116
svchost.exe
GET
200
99.84.87.89:80
http://p5.qhimg.com/d/dy_853190cb781fa29b2ed649f89b5c1903.jpg
US
image
22.2 Kb
whitelisted
116
svchost.exe
GET
200
119.146.74.49:80
http://apps.bdimg.com/libs/jquery/2.0.0/jquery.min.js?ver=0.5
CN
text
28.6 Kb
whitelisted
116
svchost.exe
GET
200
99.84.87.217:80
http://p4.qhimg.com/d/dy_c2c8e5ca2c8f3a449c38c725d0ce2fca.jpg
US
image
32.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
116
svchost.exe
119.146.74.49:80
apps.bdimg.com
Guangdong
CN
suspicious
116
svchost.exe
99.84.87.80:80
p5.qhimg.com
AT&T Services, Inc.
US
suspicious
116
svchost.exe
99.84.87.89:80
p5.qhimg.com
AT&T Services, Inc.
US
suspicious
116
svchost.exe
45.249.95.61:80
www.mojunyy.cn
hongkong kwaifong information service limited
CN
suspicious
116
svchost.exe
99.84.87.152:80
p5.qhimg.com
AT&T Services, Inc.
US
suspicious
116
svchost.exe
220.242.140.187:443
js.users.51.la
—
CN
suspicious
116
svchost.exe
195.27.31.240:443
g.alicdn.com
CW Vodafone Group PLC
DE
unknown
116
svchost.exe
195.27.31.252:443
www.taobao.com
CW Vodafone Group PLC
DE
unknown
116
svchost.exe
183.131.207.66:80
ia.51.la
DaLi
CN
malicious
116
svchost.exe
23.8.2.50:443
assets.alicdn.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.mojunyy.cn
  • 45.249.95.61
malicious
apps.bdimg.com
  • 119.146.74.49
whitelisted
p5.qhimg.com
  • 99.84.87.89
  • 99.84.87.217
  • 99.84.87.152
  • 99.84.87.80
whitelisted
p4.qhimg.com
  • 99.84.87.217
  • 99.84.87.152
  • 99.84.87.80
  • 99.84.87.89
whitelisted
p0.qhimg.com
  • 99.84.87.217
  • 99.84.87.152
  • 99.84.87.80
  • 99.84.87.89
whitelisted
p6.qhimg.com
  • 99.84.87.80
  • 99.84.87.217
  • 99.84.87.152
  • 99.84.87.89
whitelisted
p8.qhimg.com
  • 99.84.87.152
  • 99.84.87.217
  • 99.84.87.80
  • 99.84.87.89
whitelisted
p9.qhimg.com
  • 99.84.87.80
  • 99.84.87.89
  • 99.84.87.152
  • 99.84.87.217
whitelisted
p1.qhimg.com
  • 99.84.87.217
  • 99.84.87.89
  • 99.84.87.152
  • 99.84.87.80
whitelisted
p3.qhimg.com
  • 99.84.87.217
  • 99.84.87.152
  • 99.84.87.89
  • 99.84.87.80
whitelisted

Threats

PID
Process
Class
Message
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
116
svchost.exe
A Network Trojan was detected
ET POLICY Abnormal User-Agent No space after colon - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9bfab76542e63a86d45f3b233d54510b2eeb10a7532eb21bf53dba0288721fe6