download: | hdf-viewer.2.0.2.zip |
Full analysis: | https://app.any.run/tasks/5f796d3e-fbb3-4648-a4d8-ebfb931ee62d |
Verdict: | Malicious activity |
Analysis date: | July 18, 2019, 08:54:46 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | DA9966612B7396EDA9A36262CB27BA0A |
SHA1: | 07A3E4BF121ED505D9EAAC3647C88D03D5B53531 |
SHA256: | 9E80583A5DAC3256511FE9269C6B1101DF01AD2540E1530B3452355E635F3FBA |
SSDEEP: | 24576:svlnKuZaLXmnVCiTUBFdl3hpyxW3kAhYGpfPO40iSyzd0KtVrDxz0CdqsgAICZ:0Qm/Kd3pq9A6GVz+yzd0KtVr1KspPZ |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2015:08:09 02:00:01 |
ZipCRC: | 0x5f42c3bd |
ZipCompressedSize: | 5393 |
ZipUncompressedSize: | 14986 |
ZipFileName: | HDFviewer.txt |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3880 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\hdf-viewer.2.0.2.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3840 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.11705\HDFviewer.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.11705\HDFviewer.exe | WinRAR.exe | |
User: admin Company: SatSignal Software, Edinburgh Integrity Level: MEDIUM Description: HDF Viewer Version: 2.0.2.75 | ||||
3548 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.11705\HDFviewer.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.11705\HDFviewer.exe | — | HDFviewer.exe |
User: admin Company: SatSignal Software, Edinburgh Integrity Level: MEDIUM Description: HDF Viewer Version: 2.0.2.75 | ||||
1860 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.14486\HDFviewer.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.14486\HDFviewer.exe | WinRAR.exe | |
User: admin Company: SatSignal Software, Edinburgh Integrity Level: MEDIUM Description: HDF Viewer Version: 2.0.2.75 | ||||
2488 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.14486\HDFviewer.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.14486\HDFviewer.exe | — | HDFviewer.exe |
User: admin Company: SatSignal Software, Edinburgh Integrity Level: MEDIUM Description: HDF Viewer Version: 2.0.2.75 | ||||
3972 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa3880.15403\HDFviewer.txt | C:\Windows\system32\NOTEPAD.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2224 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.19978\HDFviewer.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.19978\HDFviewer.exe | WinRAR.exe | |
User: admin Company: SatSignal Software, Edinburgh Integrity Level: MEDIUM Description: HDF Viewer Version: 2.0.2.75 | ||||
3976 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.19978\HDFviewer.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.19978\HDFviewer.exe | — | HDFviewer.exe |
User: admin Company: SatSignal Software, Edinburgh Integrity Level: MEDIUM Description: HDF Viewer Version: 2.0.2.75 | ||||
1668 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3880 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.14486\HDFviewer.txt | text | |
MD5:F744B7CD586FB503AD0B1489A559121F | SHA256:729563349BAA87126616A44CDEE044FBF6F7E2F5D2F2BF00C059C2CDA4A02775 | |||
3880 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.11705\HDFviewer.txt | text | |
MD5:F744B7CD586FB503AD0B1489A559121F | SHA256:729563349BAA87126616A44CDEE044FBF6F7E2F5D2F2BF00C059C2CDA4A02775 | |||
3880 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3880.15403\HDFviewer.txt | text | |
MD5:F744B7CD586FB503AD0B1489A559121F | SHA256:729563349BAA87126616A44CDEE044FBF6F7E2F5D2F2BF00C059C2CDA4A02775 | |||
3880 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.11705\HDFviewer.exe | executable | |
MD5:A7606C4D56828117900B7E735A24CE78 | SHA256:91BCF018C00C073BF1CA9C6AC03C8B345371CBD9F9DE8456B7176B00A06EAE8A | |||
3880 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.19978\HDFviewer.txt | text | |
MD5:F744B7CD586FB503AD0B1489A559121F | SHA256:729563349BAA87126616A44CDEE044FBF6F7E2F5D2F2BF00C059C2CDA4A02775 | |||
3880 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.14486\HDFviewer.exe | executable | |
MD5:A7606C4D56828117900B7E735A24CE78 | SHA256:91BCF018C00C073BF1CA9C6AC03C8B345371CBD9F9DE8456B7176B00A06EAE8A | |||
3880 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\hdf-viewer.2.0.2\HDFviewer.exe | executable | |
MD5:A7606C4D56828117900B7E735A24CE78 | SHA256:91BCF018C00C073BF1CA9C6AC03C8B345371CBD9F9DE8456B7176B00A06EAE8A | |||
3880 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3880.19978\HDFviewer.exe | executable | |
MD5:A7606C4D56828117900B7E735A24CE78 | SHA256:91BCF018C00C073BF1CA9C6AC03C8B345371CBD9F9DE8456B7176B00A06EAE8A |
Process | Message |
---|---|
HDFviewer.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
HDFviewer.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
HDFviewer.exe | The instruction at 771B2239 tried to write to |
HDFviewer.exe | The instruction at 771B2239 tried to write to |
HDFviewer.exe | an invalid address, 00000014
|
HDFviewer.exe | *** enter .exr 0012EBC0 for the exception record
|
HDFviewer.exe | *** enter .cxr 0012EBDC for the context
|
HDFviewer.exe | *** then kb to get the faulting stack
|
HDFviewer.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
HDFviewer.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |