File name:

Warblade 1.33.exe

Full analysis: https://app.any.run/tasks/67e5f1aa-b7db-425a-805b-e5e9e8a55101
Verdict: Malicious activity
Analysis date: June 07, 2024, 21:08:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

57E51C317F240B559FA2A17DFD7FA8DA

SHA1:

2AF7E4997DD922FA00A43B9E89FF9A192E634C88

SHA256:

9F600958FE7473902738950BB5A599A935230F82DB56CB2265CD22D8F2D17654

SSDEEP:

98304:OJIHJv8TyaDP0Nlso/WA6zRcrsYFlw4P5O2CRmeJ8WcMpJsd912F+6wufcrCzieQ:0l8LkUIDkZZGYHmd95aOZWKKPxRT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Warblade 1.33.exe (PID: 3992)
      • Warblade 1.33.exe (PID: 864)
      • Warblade 1.33.tmp (PID: 1116)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Warblade 1.33.exe (PID: 864)
      • Warblade 1.33.exe (PID: 3992)
      • Warblade 1.33.tmp (PID: 1116)

    • Process drops legitimate windows executable

      • Warblade 1.33.tmp (PID: 1116)

    • Reads the Internet Settings

      • warblade.exe (PID: 2028)

    • Reads security settings of Internet Explorer

      • warblade.exe (PID: 2028)

    • Reads the Windows owner or organization settings

      • Warblade 1.33.tmp (PID: 1116)

  • INFO

    • Create files in a temporary directory

      • Warblade 1.33.exe (PID: 3992)
      • Warblade 1.33.exe (PID: 864)
      • Warblade 1.33.tmp (PID: 1116)

    • Checks supported languages

      • Warblade 1.33.tmp (PID: 4008)
      • Warblade 1.33.exe (PID: 3992)
      • Warblade 1.33.exe (PID: 864)
      • Warblade 1.33.tmp (PID: 1116)
      • warblade.exe (PID: 2028)

    • Reads the computer name

      • Warblade 1.33.tmp (PID: 4008)
      • Warblade 1.33.tmp (PID: 1116)
      • warblade.exe (PID: 2028)

    • Creates files in the program directory

      • Warblade 1.33.tmp (PID: 1116)

    • Creates a software uninstall entry

      • Warblade 1.33.tmp (PID: 1116)

    • Checks proxy server information

      • warblade.exe (PID: 2028)

    • Reads the machine GUID from the registry

      • warblade.exe (PID: 2028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (60)
.exe | Win32 EXE PECompact compressed (generic) (22.7)
.exe | Win32 Executable Delphi generic (7.7)
.dll | Win32 Dynamic Link Library (generic) (3.6)
.exe | Win32 Executable (generic) (2.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37376
InitializedDataSize: 19968
UninitializedDataSize: -
EntryPoint: 0x9a58
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: EMV Software
FileDescription: Warblade Demo Setup
FileVersion:
LegalCopyright:
ProductName: Warblade Demo
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start warblade 1.33.exe warblade 1.33.tmp no specs warblade 1.33.exe warblade 1.33.tmp warblade.exe

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\Users\admin\AppData\Local\Temp\Warblade 1.33.exe" /SPAWNWND=$20134 /NOTIFYWND=$30138 C:\Users\admin\AppData\Local\Temp\Warblade 1.33.exe
Warblade 1.33.tmp
User:
admin
Company:
EMV Software
Integrity Level:
HIGH
Description:
Warblade Demo Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\warblade 1.33.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1116"C:\Users\admin\AppData\Local\Temp\is-MOAV4.tmp\Warblade 1.33.tmp" /SL5="$30130,14925863,58368,C:\Users\admin\AppData\Local\Temp\Warblade 1.33.exe" /SPAWNWND=$20134 /NOTIFYWND=$30138 C:\Users\admin\AppData\Local\Temp\is-MOAV4.tmp\Warblade 1.33.tmp
Warblade 1.33.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.49.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-moav4.tmp\warblade 1.33.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2028"C:\Program Files\Warblade Demo\warblade.exe"C:\Program Files\Warblade Demo\warblade.exe
Warblade 1.33.tmp
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files\warblade demo\warblade.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3992"C:\Users\admin\AppData\Local\Temp\Warblade 1.33.exe" C:\Users\admin\AppData\Local\Temp\Warblade 1.33.exe
explorer.exe
User:
admin
Company:
EMV Software
Integrity Level:
MEDIUM
Description:
Warblade Demo Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\warblade 1.33.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
4008"C:\Users\admin\AppData\Local\Temp\is-83TBA.tmp\Warblade 1.33.tmp" /SL5="$30138,14925863,58368,C:\Users\admin\AppData\Local\Temp\Warblade 1.33.exe" C:\Users\admin\AppData\Local\Temp\is-83TBA.tmp\Warblade 1.33.tmp—Warblade 1.33.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.49.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-83tba.tmp\warblade 1.33.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
5 765
Read events
5 722
Write events
37
Delete events
6

Modification events

(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.2.3
(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Warblade Demo
(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Warblade Demo\
(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Warblade Demo
(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
desktopicon,quicklaunchicon
(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:DisplayName
Value:
Warblade Demo
(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files\Warblade Demo\unins000.exe"
(PID) Process:(1116) Warblade 1.33.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warblade Demo_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\Warblade Demo\unins000.exe" /SILENT
Executable files
10
Suspicious files
244
Text files
16
Unknown types
82

Dropped files

PID
Process
Filename
Type
1116Warblade 1.33.tmpC:\Program Files\Warblade Demo\data\is-T34HU.tmp —
MD5:—
SHA256:—
1116Warblade 1.33.tmpC:\Program Files\Warblade Demo\data\warblade.pac —
MD5:—
SHA256:—
3992Warblade 1.33.exeC:\Users\admin\AppData\Local\Temp\is-83TBA.tmp\Warblade 1.33.tmpexecutable
MD5:37BA59434CFBEE133E3CED8F56B6391E
SHA256:DE0747E45D12EF559FDA379579B52869265AF5A739F26369DA0C066D97571416
864Warblade 1.33.exeC:\Users\admin\AppData\Local\Temp\is-MOAV4.tmp\Warblade 1.33.tmpexecutable
MD5:37BA59434CFBEE133E3CED8F56B6391E
SHA256:DE0747E45D12EF559FDA379579B52869265AF5A739F26369DA0C066D97571416
1116Warblade 1.33.tmpC:\Program Files\Warblade Demo\is-I7FQ7.tmpimage
MD5:6F1DA2CE56A4BBF334F7D4417C0FE67D
SHA256:7EA4BB9D30BD683FD59A7AB25F7471DB93BB122741813F0AC9753F7DB616C70F
1116Warblade 1.33.tmpC:\Program Files\Warblade Demo\is-BIQJQ.tmptext
MD5:A08B88974C5970414D2D1E71E9267AA6
SHA256:918BF0A0F507CF00CE9F9693D6E87F4B9DDC62EF00BCC800621EBAB5DE427C47
1116Warblade 1.33.tmpC:\Program Files\Warblade Demo\is-L9QV2.tmptext
MD5:0AB958BEFBE69F76B1F4FCDE436E45F0
SHA256:1EA14A1BACA528A658790FB21DDC7D0006DDCF6A13C1426DE15F0E98AEEEF5B4
1116Warblade 1.33.tmpC:\Program Files\Warblade Demo\warblade.icoimage
MD5:6F1DA2CE56A4BBF334F7D4417C0FE67D
SHA256:7EA4BB9D30BD683FD59A7AB25F7471DB93BB122741813F0AC9753F7DB616C70F
1116Warblade 1.33.tmpC:\Program Files\Warblade Demo\Warblade_Manual_V1.33_Eng.txttext
MD5:A08B88974C5970414D2D1E71E9267AA6
SHA256:918BF0A0F507CF00CE9F9693D6E87F4B9DDC62EF00BCC800621EBAB5DE427C47
1116Warblade 1.33.tmpC:\Program Files\Warblade Demo\bass.dllexecutable
MD5:9F163EA61D74488E25DE852D77530993
SHA256:B9E7B89F6FC7545BF514E716CD4F779CCA7497C8035EBFC19DDDAB1CF01CC7F2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
2028
warblade.exe
79.170.80.190:80
www.warblade.as
Sognenett AS
NO
unknown

DNS requests

Domain
IP
Reputation
www.warblade.as
  • 79.170.80.190
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Warblade 1.33.exe