File name:

pumpkin-2.7.3.exe

Full analysis: https://app.any.run/tasks/48f6b89c-11c4-4348-aafc-440bb49f625f
Verdict: Malicious activity
Analysis date: September 29, 2020, 20:16:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C70DF19686F26DEBC376CCCD7CE301A3

SHA1:

C7AB4A5B2A34BB9702F55ECEDC17A9FA7DEBC59A

SHA256:

A1B0099A0BC502993158F6BB8DAF3C96506F2362418AA78C1FE9B8425376AEE9

SSDEEP:

3072:dGIjgwfvvGVnP+9530FqiONtoMp/7ZNPHGuOLR:dxjPvcG95kcNmgznPHGP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PumpKIN.exe (PID: 2580)

  • SUSPICIOUS

    • Creates a software uninstall entry

      • pumpkin-2.7.3.exe (PID: 3180)

    • Creates files in the program directory

      • pumpkin-2.7.3.exe (PID: 3180)

    • Executable content was dropped or overwritten

      • pumpkin-2.7.3.exe (PID: 3180)

  • INFO

    • Manual execution by user

      • explorer.exe (PID: 1592)
      • explorer.exe (PID: 2504)
      • PumpKIN.exe (PID: 2580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ 4.x (63.9)
.exe | Win32 Executable MS Visual C++ (generic) (14.8)
.exe | Win64 Executable (generic) (13.1)
.dll | Win32 Dynamic Link Library (generic) (3.1)
.exe | Win32 Executable (generic) (2.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:04:27 18:26:06+02:00
PEType: PE32
LinkerVersion: 4.2
CodeSize: 29696
InitializedDataSize: 122368
UninitializedDataSize: -
EntryPoint: 0x2fc0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.7.3.0
ProductVersionNumber: 2.7.3.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Klever Group (http://www.klever.net/)
FileDescription: INSTALL: PumpKIN, tftp client/daemon
FileVersion: 2, 7, 3, 0
InternalName: INSTALL
LegalCopyright: Copyright © 1997-2011 Klever Group (http://www.klever.net/)
LegalTrademarks: Klever Group (http://www.klever.net/)
OriginalFileName: INSTALL.EXE
ProductName: PumpKIN
ProductVersion: 2, 7, 3, 0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-Apr-2011 16:26:06
Detected languages:
  • English - United States
CompanyName: Klever Group (http://www.klever.net/)
FileDescription: INSTALL: PumpKIN, tftp client/daemon
FileVersion: 2, 7, 3, 0
InternalName: INSTALL
LegalCopyright: Copyright © 1997-2011 Klever Group (http://www.klever.net/)
LegalTrademarks: Klever Group (http://www.klever.net/)
OriginalFilename: INSTALL.EXE
ProductName: PumpKIN
ProductVersion: 2, 7, 3, 0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 27-Apr-2011 16:26:06
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00007356
0x00007400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.37814
.rdata
0x00009000
0x00000A70
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.84053
.data
0x0000A000
0x00002C24
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.63052
.idata
0x0000D000
0x0000082C
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.45342
.rsrc
0x0000E000
0x00018F7C
0x00019000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.64161
.reloc
0x00027000
0x000009DA
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
5.49914

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.57303
992
UNKNOWN
English - United States
RT_VERSION
2
3.8204
2216
UNKNOWN
English - United States
RT_ICON
102
2.91487
264
UNKNOWN
English - United States
RT_DIALOG
105
2.37447
34
UNKNOWN
English - United States
RT_GROUP_ICON
PUMPKIN.CN_
6.16414
236
UNKNOWN
English - United States
RT_RCDATA
PUMPKIN.EX_
7.72705
85779
UNKNOWN
English - United States
RT_RCDATA
PUMPKIN.HL_
7.24054
11407
UNKNOWN
English - United States
RT_RCDATA

Imports

ADVAPI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pumpkin-2.7.3.exe explorer.exe no specs explorer.exe no specs pumpkin.exe no specs pumpkin-2.7.3.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1592"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2504"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2580"C:\Program Files\Klever\Nothings\PumpKIN.exe" C:\Program Files\Klever\Nothings\PumpKIN.exe—explorer.exe
User:
admin
Company:
Klever Group (http://www.klever.net/)
Integrity Level:
MEDIUM
Description:
PumpKIN, tftp client/daemon
Exit code:
0
Version:
2, 7, 3, 0
Modules
Images
c:\program files\klever\nothings\pumpkin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2680"C:\Users\admin\AppData\Local\Temp\pumpkin-2.7.3.exe" C:\Users\admin\AppData\Local\Temp\pumpkin-2.7.3.exe—explorer.exe
User:
admin
Company:
Klever Group (http://www.klever.net/)
Integrity Level:
MEDIUM
Description:
INSTALL: PumpKIN, tftp client/daemon
Exit code:
3221226540
Version:
2, 7, 3, 0
Modules
Images
c:\users\admin\appdata\local\temp\pumpkin-2.7.3.exe
c:\systemroot\system32\ntdll.dll
3180"C:\Users\admin\AppData\Local\Temp\pumpkin-2.7.3.exe" C:\Users\admin\AppData\Local\Temp\pumpkin-2.7.3.exe
explorer.exe
User:
admin
Company:
Klever Group (http://www.klever.net/)
Integrity Level:
HIGH
Description:
INSTALL: PumpKIN, tftp client/daemon
Exit code:
0
Version:
2, 7, 3, 0
Modules
Images
c:\users\admin\appdata\local\temp\pumpkin-2.7.3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
227
Read events
216
Write events
11
Delete events
0

Modification events

(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Klever Group
Operation:writeName:PumpKINPath
Value:
C:\Program Files\Klever\Nothings
(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Klever Group
Operation:writeName:KINPath
Value:
C:\Program Files\Klever\Nothings
(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PumpKIN
Operation:writeName:DisplayName
Value:
Klever PumpKIN 2.7.3
(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PumpKIN
Operation:writeName:UninstallString
Value:
RunDll32 setupapi.dll,InstallHinfSection Uninstall 132 C:\PROGRA~1\Klever\Nothings\PumpKIN.INF
(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PumpKIN
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Klever\Nothings\PumpKIN.exe;0
(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PumpKIN
Operation:writeName:lComment
Value:
Klever PumpKIN
(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PumpKIN
Operation:writeName:DisplayVersion
Value:
2.7.3
(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PumpKIN
Operation:writeName:InstallLocation
Value:
C:\Program Files\Klever\Nothings
(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PumpKIN
Operation:writeName:Publisher
Value:
Klever Group
(PID) Process:(3180) pumpkin-2.7.3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PumpKIN
Operation:writeName:URLInfoAbout
Value:
http://www.klever.net/
Executable files
1
Suspicious files
0
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
3180pumpkin-2.7.3.exeC:\Users\admin\AppData\Local\Temp\KGIC644.tmp —
MD5:—
SHA256:—
3180pumpkin-2.7.3.exeC:\Program Files\Klever\Nothings\temp.000 —
MD5:—
SHA256:—
3180pumpkin-2.7.3.exeC:\Users\admin\AppData\Local\Temp\KGIC645.tmp —
MD5:—
SHA256:—
3180pumpkin-2.7.3.exeC:\Users\admin\AppData\Local\Temp\KGIC646.tmp —
MD5:—
SHA256:—
3180pumpkin-2.7.3.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Klever Group\PumpKIN.lnklnk
MD5:—
SHA256:—
3180pumpkin-2.7.3.exeC:\Program Files\Klever\Nothings\PumpKIN.hlphlp
MD5:FBEEBDE591B531D13D6FDEC502336C25
SHA256:E4128F775D0D8B3B732139F7EBE397609AF9DD7B789D3452C9332D10588C835D
3180pumpkin-2.7.3.exeC:\Program Files\Klever\Nothings\PumpKIN.cnttext
MD5:685BAB4BE28BA2839D7303F1D4559504
SHA256:C0AF4774AC5FD0B81C3C8596B906DA726A4003B0630DD7F773A66B87D1B22505
3180pumpkin-2.7.3.exeC:\Program Files\Klever\Nothings\PumpKIN.INFini
MD5:7665936CB568C2F8A877A6466732373B
SHA256:0BB3C0164D3774F6212036EDC2C95F106BDD8027D7D37DE4364D48C32418EC14
3180pumpkin-2.7.3.exeC:\Program Files\Klever\Nothings\PumpKIN.exeexecutable
MD5:3EACA496B28E680A42100D0197DE0927
SHA256:71F5DF87D74EB101E95B7BD6127469BB72C84BC87C813BC8178A042E4D962F3A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pumpkin-2.7.3.exe