File name: | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
Full analysis: | https://app.any.run/tasks/1715900f-b436-4b77-b1bb-1f1ab092313d |
Verdict: | Malicious activity |
Analysis date: | July 12, 2020, 21:19:14 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
MD5: | 0C7D67D28E7D2E37D06AA53145F1B1E4 |
SHA1: | D816DB1CCBD43D2A4A21124462119EC19E37EF5D |
SHA256: | A51BEBC0503334C3D3DF66C5FEE4B7205485C3B81CE24612CAF7045729D90AF5 |
SSDEEP: | 1536:dFJz/vArEqF8F1DXE2HCIkjDL6jlT/V1Ayj4m/QWR/Rlq88vlnRqPR/1aVixQQaf:dvs4dDXEGCLElp1Tj4mYWR/R4nkPR/1c |
.exe | | | Generic Win/DOS Executable (50) |
---|---|---|
.exe | | | DOS Executable Generic (49.9) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x19760 |
UninitializedDataSize: | 57344 |
InitializedDataSize: | 4096 |
CodeSize: | 45056 |
LinkerVersion: | 2.5 |
PEType: | PE32 |
TimeStamp: | 2006:03:02 18:50:37+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 02-Mar-2006 17:50:37 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0004 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0005 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0006 |
OEM identifier: | 0x0004 |
OEM information: | 0x0002 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 6 |
Time date stamp: | 02-Mar-2006 17:50:37 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x0000E000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.bvxzt | 0x0000F000 | 0x0000B000 | 0x0000B200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.73888 |
.yno | 0x0001A000 | 0x00001000 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.00701 |
.vzkj | 0x0001B000 | 0x00001000 | 0x00000200 | 2.47674 | |
.lygia | 0x0001C000 | 0x00001000 | 0x00000200 | 1.13655 | |
.o | 0x0001D000 | 0x00001000 | 0x00000200 | 2.12572 |
ADVAPI32.dll |
KERNEL32.DLL |
MPR.dll |
SHELL32.dll |
USER32.dll |
WS2_32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
628 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM | ||||
340 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | — | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
User: admin Integrity Level: MEDIUM | ||||
3084 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | — | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
User: admin Integrity Level: MEDIUM | ||||
1084 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | — | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
User: admin Integrity Level: MEDIUM | ||||
2952 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | — | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
User: admin Integrity Level: MEDIUM | ||||
1072 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | — | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
User: admin Integrity Level: MEDIUM | ||||
2512 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | — | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
User: admin Integrity Level: MEDIUM | ||||
900 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | — | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
User: admin Integrity Level: MEDIUM | ||||
2824 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | — | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
User: admin Integrity Level: MEDIUM | ||||
2540 | "C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe" | C:\Users\admin\AppData\Local\Temp\Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | — | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian kicking xxx [milf] titts .avi.exe | executable | |
MD5:1B65FEB5806380F6A7130B78C545E188 | SHA256:ABB327814277C023584CA5578546668F7758A0499407A7607A051668603FA2C2 | |||
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Local\Microsoft\Device Metadata\dmrccache\downloads\fucking [free] glans .rar.exe | executable | |
MD5:A757226B942B7A7AF61C51681FE7DAB0 | SHA256:E130FD6AC1F0911E30BAD116C804953BEFCD5ACA119789C264F697A6346E5C07 | |||
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Roaming\Microsoft\Templates\xxx big young .mpeg.exe | executable | |
MD5:E1F5F5B00C3D2568F4FBC0974870E2C4 | SHA256:D7F745F6317E2560CFECC6CFB68EBC840E931397AA1B3C265B0B0EE62B875E68 | |||
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\bukkake several models .rar.exe | executable | |
MD5:3E82964FAA38252D1FB33F62F9D1818F | SHA256:B7C9FB86D7A411833DF8575F6EFEDC50B49D037505F7716EFF8140823771ED95 | |||
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\japanese fetish blowjob [bangbus] cock .zip.exe | executable | |
MD5:270DA8597334573B44DBBED8CFAF3EC9 | SHA256:2455102D620405D78D9EE406BC5AA2A47933BF1A31806AA453BB57D17E4343F9 | |||
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\russian horse fucking voyeur bedroom .avi.exe | executable | |
MD5:CBF31BE7F4FEE95CA65A1B3988BCAA5A | SHA256:384DB6B7F54EA59A88CFF008CFC53A5E473CB1046AF75F9E0EB4C0D3E720A136 | |||
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\black animal horse catfight cock .avi.exe | executable | |
MD5:E5A3908193444175FA875FFABEEA00EF | SHA256:D9F75F4B607DA48576C35D02538208D246D296B7DF10B1F6FEB4E4D4FC4E65A5 | |||
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\lingerie big feet bedroom .mpg.exe | executable | |
MD5:2E54A76228CE07EA7DAB21CCD196FDCF | SHA256:1F80729F87C876F65E4AB569983A65D8CFE06F99B2DADAEA18B3D6A9E47249BD | |||
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\animal sperm full movie titts .mpg.exe | executable | |
MD5:61411A20207F187E242ECDB60BB1C2C7 | SHA256:B2EC93079AC6E0CAD016ECAB93FEA3601C4AC22CEBB7D92C4E3CE32D6B00F3DD | |||
628 | Trojan.Autorun.ATA_virussign.com_0c7d67d28e7d2e37d06aa53145f1b1e4.exe | C:\Users\admin\AppData\Local\Temp\hardcore masturbation cock 40+ .zip.exe | executable | |
MD5:981DB4AC694A40DA8E2CF294580ACE7F | SHA256:4E11DC21077397DDBCE5950C6F78DD3C771BEA08FDF99318A2A66B68D8A912EC |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 22.129.208.248:137 | — | — | US | unknown |
— | — | 150.178.72.143:137 | — | Consortium GARR | IT | unknown |
— | — | 111.63.127.172:137 | — | Hebei Mobile Communication Company Limited | CN | unknown |
— | — | 206.29.116.59:137 | — | Savvis | US | unknown |
— | — | 11.229.207.136:137 | — | — | US | unknown |
Domain | IP | Reputation |
---|---|---|
59.116.29.206.in-addr.arpa |
| unknown |
123.140.156.233.in-addr.arpa |
| unknown |
248.208.129.22.in-addr.arpa |
| unknown |
81.198.65.37.in-addr.arpa |
| unknown |
172.127.63.111.in-addr.arpa |
| unknown |
143.72.178.150.in-addr.arpa |
| unknown |
242.160.133.242.in-addr.arpa |
| unknown |
217.11.135.228.in-addr.arpa |
| unknown |
136.207.229.11.in-addr.arpa |
| unknown |
224.115.125.234.in-addr.arpa |
| unknown |