download: | FreeAudioEditor.exe |
Full analysis: | https://app.any.run/tasks/c64f3148-74bf-463a-9473-6a032e15e2bb |
Verdict: | Malicious activity |
Analysis date: | December 06, 2022, 02:27:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | E646274C6F8C8F89CAD6E9AA9975DB04 |
SHA1: | 128FAFDFB591C3542FDF6FC96C72B89BCB459A11 |
SHA256: | 9D30E013E6BD6574D96470C7D031A6A587C469503628F7FD01D9344C390F693B |
SSDEEP: | 196608:G+NE47IQ3Lmf7qL764H5FjB0Oq1SCt9mmA8SQ72/N/SNp:lNDlbZy4H5FF5q1Vt4m9L72/wv |
.exe | | | Inno Setup installer (51.8) |
---|---|---|
.exe | | | InstallShield setup (20.3) |
.exe | | | Win32 EXE PECompact compressed (generic) (19.6) |
.dll | | | Win32 Dynamic Link Library (generic) (3.1) |
.exe | | | Win32 Executable (generic) (2.1) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2020-May-21 05:56:23 |
Detected languages: |
|
Comments: | This installation was built with Inno Setup. |
CompanyName: | Copyright© 2005-2019 FAEMedia, Inc. |
FileDescription: | Free Audio Editor 2019 Setup |
FileVersion: | - |
LegalCopyright: | - |
OriginalFileName: | - |
ProductName: | Free Audio Editor 2019 |
ProductVersion: | - |
e_magic: | MZ |
---|---|
e_cblp: | 80 |
e_cp: | 2 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | 15 |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | 26 |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 256 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 10 |
TimeDateStamp: | 2020-May-21 05:56:23 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 734724 | 735232 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.35433 |
.itext | 741376 | 5764 | 6144 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.9709 |
.data | 749568 | 14244 | 14336 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.04216 |
.bss | 765952 | 28064 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.idata | 794624 | 3894 | 4096 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.8987 |
.didata | 798720 | 420 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.75636 |
.edata | 802816 | 154 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.87222 |
.tls | 806912 | 24 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.rdata | 811008 | 93 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.38389 |
.rsrc | 815104 | 18432 | 18432 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.42686 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.25755 | 296 | UNKNOWN | Dutch - Netherlands | RT_ICON |
2 | 3.47151 | 1384 | UNKNOWN | Dutch - Netherlands | RT_ICON |
3 | 3.91708 | 744 | UNKNOWN | Dutch - Netherlands | RT_ICON |
4 | 3.91366 | 2216 | UNKNOWN | Dutch - Netherlands | RT_ICON |
4086 | 3.16547 | 864 | UNKNOWN | UNKNOWN | RT_STRING |
4087 | 3.40938 | 608 | UNKNOWN | UNKNOWN | RT_STRING |
4088 | 3.31153 | 1116 | UNKNOWN | UNKNOWN | RT_STRING |
4089 | 3.33977 | 1036 | UNKNOWN | UNKNOWN | RT_STRING |
4090 | 3.36723 | 724 | UNKNOWN | UNKNOWN | RT_STRING |
4091 | 3.33978 | 184 | UNKNOWN | UNKNOWN | RT_STRING |
advapi32.dll |
comctl32.dll |
kernel32.dll |
kernel32.dll (delay-loaded) |
netapi32.dll |
oleaut32.dll |
user32.dll |
version.dll |
Title | Ordinal | Address |
---|---|---|
dbkFCallWrapperAddr | 1 | 779836 |
__dbk_fcall_wrapper | 2 | 53408 |
TMethodImplementationIntercept | 3 | 344152 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1752 | "C:\Users\admin\Downloads\FreeAudioEditor.exe" | C:\Users\admin\Downloads\FreeAudioEditor.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Copyright© 2005-2019 FAEMedia, Inc. Integrity Level: MEDIUM Description: Free Audio Editor 2019 Setup Version: Modules
| |||||||||||||||
2280 | "C:\Users\admin\AppData\Local\Temp\is-9EK5J.tmp\FreeAudioEditor.tmp" /SL5="$50198,6785671,780800,C:\Users\admin\Downloads\FreeAudioEditor.exe" | C:\Users\admin\AppData\Local\Temp\is-9EK5J.tmp\FreeAudioEditor.tmp | — | FreeAudioEditor.exe | |||||||||||
User: admin Company: Copyright© 2005-2019 FAEMedia, Inc. Integrity Level: MEDIUM Description: Setup/Uninstall Version: 51.1052.0.0 Modules
| |||||||||||||||
2872 | "C:\Users\admin\Downloads\FreeAudioEditor.exe" /SPAWNWND=$501C8 /NOTIFYWND=$50198 | C:\Users\admin\Downloads\FreeAudioEditor.exe | FreeAudioEditor.tmp | ||||||||||||
User: admin Company: Copyright© 2005-2019 FAEMedia, Inc. Integrity Level: HIGH Description: Free Audio Editor 2019 Setup Version: Modules
| |||||||||||||||
3612 | "C:\Users\admin\AppData\Local\Temp\is-16LII.tmp\FreeAudioEditor.tmp" /SL5="$40128,6785671,780800,C:\Users\admin\Downloads\FreeAudioEditor.exe" /SPAWNWND=$501C8 /NOTIFYWND=$50198 | C:\Users\admin\AppData\Local\Temp\is-16LII.tmp\FreeAudioEditor.tmp | FreeAudioEditor.exe | ||||||||||||
User: admin Company: Copyright© 2005-2019 FAEMedia, Inc. Integrity Level: HIGH Description: Setup/Uninstall Version: 51.1052.0.0 Modules
| |||||||||||||||
2412 | "C:\Users\admin\AppData\Local\Temp\is-F058P.tmp\rk_setup.exe" -c: 3024 -lang: 1 | C:\Users\admin\AppData\Local\Temp\is-F058P.tmp\rk_setup.exe | — | FreeAudioEditor.tmp | |||||||||||
User: admin Company: TMRG Integrity Level: HIGH Description: RelevantKnowledge Setup Setup Version: 1.1.0 Modules
| |||||||||||||||
3096 | "C:\Users\admin\AppData\Local\Temp\is-94JJI.tmp\rk_setup.tmp" /SL5="$40136,2022387,721408,C:\Users\admin\AppData\Local\Temp\is-F058P.tmp\rk_setup.exe" -c: 3024 -lang: 1 | C:\Users\admin\AppData\Local\Temp\is-94JJI.tmp\rk_setup.tmp | rk_setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Version: 51.1052.0.0 Modules
|
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Owner |
Value: 1C0E0000DEFEF7541A09D901 | |||
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | SessionHash |
Value: DDA043691524C0835C66CA839E8304EEE29021978A4E6D8C21177A331EC312FE | |||
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Sequence |
Value: 1 | |||
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (3612) FreeAudioEditor.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
3612 | FreeAudioEditor.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 | binary | |
MD5:0A4DB1D273F30A41D1608B546BF4F122 | SHA256:C94ACA94F4DBE3FA8013161B61108CC66A89C0AE7F70252D6C26C4C5AB6B2AB6 | |||
3612 | FreeAudioEditor.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6A2279C2CA42EBEE26F14589F0736E50 | binary | |
MD5:4CB4BA327707BF1EE3511F64D7C924E8 | SHA256:2A081A27402DDDB191CE45B564648FD4CB626B2AEBAF1A770B5624149E68C855 | |||
3612 | FreeAudioEditor.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 | der | |
MD5:EAA4DCE3EAE1609F49EBAE7323D80FEF | SHA256:DF398498CCD10951E5B64A54A0D10547E36A78D1CBCA6369EE8AABC83363AD83 | |||
3612 | FreeAudioEditor.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F | binary | |
MD5:ABCF2DB6F2D2B8551FA418B56055A15F | SHA256:B0DAFE46F6594619B01C1730A32A6F93A7934D68F2510AD4991ED9D4D4F20C43 | |||
3612 | FreeAudioEditor.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:235CA780AFD3AEC30D65910666455A95 | SHA256:35559C0B02AF2CE033FFE52366EA77C5C2ACF0081FA6A56B007A9A0FF45B2591 | |||
3612 | FreeAudioEditor.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_A64994129CF3C47134E28604281D42C0 | der | |
MD5:DD65D2EBBB52A6FE0CA1CB04933983FB | SHA256:93751D2D71A59E8C6B24C9896C6413517FCE85624FCC9FE50B7A03F02959DF82 | |||
3612 | FreeAudioEditor.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F | der | |
MD5:673EBC6BD420C2311ED712DEAFC5E744 | SHA256:7E2C61C3A97760BB147863EF5B32476E7AD40281C49F88F96B626987CF87DAA8 | |||
3612 | FreeAudioEditor.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D6243C18F0F8F9AEC6638DD210F1984_A64994129CF3C47134E28604281D42C0 | binary | |
MD5:C843AEA11058A1BA33D7F8AC10404B81 | SHA256:79F93FB27C0C250AE484A643B0C3C88C125B9310EE953B00E14272118F71B3C9 | |||
3612 | FreeAudioEditor.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62 | der | |
MD5:61A43AD7B5E0EFB0FD2A3468D3D3EC4A | SHA256:0E01A5872AD78B80CD0DBD9F4A68B0B7578E1B2CB4C335A48FE6E3B906B8228F | |||
2872 | FreeAudioEditor.exe | C:\Users\admin\AppData\Local\Temp\is-16LII.tmp\FreeAudioEditor.tmp | executable | |
MD5:9C28F155FCE4A9084651422D1A315A53 | SHA256:F1CBAB9390B5EF9B73F6607E2F99EC88E2ACBC81721F4B212F301C4CB0A618CB |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3612 | FreeAudioEditor.tmp | GET | 200 | 13.225.84.92:80 | http://s.ss2.us/r.crl | US | der | 486 b | whitelisted |
3612 | FreeAudioEditor.tmp | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?25f63f5f1211d90a | US | compressed | 4.70 Kb | whitelisted |
3612 | FreeAudioEditor.tmp | GET | 200 | 52.222.250.185:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D | US | der | 1.39 Kb | shared |
3612 | FreeAudioEditor.tmp | GET | 200 | 108.138.24.78:80 | http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAUZ3POCwZAt%2FahDdyBSP1M%3D | US | der | 471 b | whitelisted |
3612 | FreeAudioEditor.tmp | GET | 200 | 52.222.250.42:80 | http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D | US | der | 1.51 Kb | whitelisted |
3612 | FreeAudioEditor.tmp | GET | 200 | 13.227.211.189:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3612 | FreeAudioEditor.tmp | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
3612 | FreeAudioEditor.tmp | 13.225.78.114:443 | dpd.securestudies.com | AMAZON-02 | US | suspicious |
— | — | 13.225.84.92:80 | s.ss2.us | AMAZON-02 | US | malicious |
3612 | FreeAudioEditor.tmp | 52.222.250.42:80 | ocsp.rootg2.amazontrust.com | AMAZON-02 | US | whitelisted |
3612 | FreeAudioEditor.tmp | 13.227.211.145:80 | o.ss2.us | AMAZON-02 | US | unknown |
3612 | FreeAudioEditor.tmp | 52.222.250.185:80 | ocsp.rootg2.amazontrust.com | AMAZON-02 | US | whitelisted |
3096 | rk_setup.tmp | 13.225.78.114:443 | dpd.securestudies.com | AMAZON-02 | US | suspicious |
3096 | rk_setup.tmp | 165.193.78.234:443 | post.securestudies.com | CENTURYLINK-LEGACY-SAVVIS | US | malicious |
3612 | FreeAudioEditor.tmp | 108.138.24.78:80 | ocsp.sca1b.amazontrust.com | AMAZON-02 | US | whitelisted |
3612 | FreeAudioEditor.tmp | 13.227.211.189:80 | o.ss2.us | AMAZON-02 | US | unknown |
Domain | IP | Reputation |
---|---|---|
dpd.securestudies.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
o.ss2.us |
| whitelisted |
s.ss2.us |
| whitelisted |
ocsp.rootg2.amazontrust.com |
| whitelisted |
ocsp.rootca1.amazontrust.com |
| shared |
ocsp.sca1b.amazontrust.com |
| whitelisted |
post.securestudies.com |
| malicious |