| File name: | razorlame.exe |
| Full analysis: | https://app.any.run/tasks/c8e8f40e-2ebf-4ae4-a5dd-82387dd26cbd |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | March 09, 2020, 01:54:26 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive |
| MD5: | 11A7CB60EC1750669F881F53466E5A81 |
| SHA1: | 0AE5556B8BB8F0C1E84D13D6E68F17C691C7FEBD |
| SHA256: | A58B9516FBF334D778773B3FCEF080E62A3B13AAFAE5F3F7471BEC86362B93EB |
| SSDEEP: | 12288:7IKETpAqO6CPL4rPe6et+3K7CBwI7/+6/1pLigEKZ4Cux7TzMK1NP9MT:7Iq6CPL4rlet+3oAwsR1pLkvzdd9Y |
| .exe | | | NSIS - Nullsoft Scriptable Install System (91.9) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (3.3) |
| .exe | | | Win64 Executable (generic) (3) |
| .dll | | | Win32 Dynamic Link Library (generic) (0.7) |
| .exe | | | Win32 Executable (generic) (0.4) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2009:06:18 23:33:27+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 23552 |
| InitializedDataSize: | 119808 |
| UninitializedDataSize: | 1024 |
| EntryPoint: | 0x3291 |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.1 |
| ProductVersionNumber: | 1.0.0.1 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Windows, Latin1 |
| FileDescription: | Producer oylc |
| FileVersion: | - |
| LegalCopyright: | (C) |
| ProductName: | - |
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 18-Jun-2009 21:33:27 |
| Detected languages: |
|
| FileDescription: | Producer oylc |
| FileVersion: | - |
| LegalCopyright: | (C) |
| ProductName: | - |
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000C8 |
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 18-Jun-2009 21:33:27 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x00005BC0 | 0x00005C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.47639 |
.rdata | 0x00007000 | 0x00001190 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.18129 |
.data | 0x00009000 | 0x0001AF78 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.72275 |
.ndata | 0x00024000 | 0x00014000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00038000 | 0x00001360 | 0x00001400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.58322 |
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.10609 | 533 | UNKNOWN | English - United States | RT_MANIFEST |
103 | 1.81924 | 20 | UNKNOWN | English - United States | RT_GROUP_ICON |
105 | 2.61238 | 500 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.83629 | 236 | UNKNOWN | English - United States | RT_DIALOG |
111 | 2.86753 | 226 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 860 | C:\Windows\system32\svchost.exe -k netsvcs | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 952 | regsvr32 /s "C:\Program Files\Kuai8\tool\K8Shell.dll" | C:\Windows\system32\regsvr32.exe | — | setup1_1.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1092 | netsh firewall add allowedprogram program="C:\Program Files\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL | C:\Windows\system32\netsh.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1456 | C:\Windows\system32\wbem\unsecapp.exe -Embedding | C:\Windows\system32\wbem\unsecapp.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Sink to receive asynchronous callbacks for WMI client application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1500 | "C:\Program Files\Kuai8\K8GM.exe" -update_data | C:\Program Files\Kuai8\K8GM.exe | setup1_1.exe | ||||||||||||
User: admin Company: 凡游网络 Integrity Level: HIGH Description: 快吧游戏 Exit code: 4294967295 Version: 8.2.1.8311 Modules
| |||||||||||||||
| 1504 | "C:\Users\admin\AppData\Local\Temp\razorlame.exe" | C:\Users\admin\AppData\Local\Temp\razorlame.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Producer oylc Exit code: 0 Modules
| |||||||||||||||
| 1712 | "C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files\Kuai8\K8DLPlatform.exe" name="快吧游戏下载平台" mode=ENABLE scope=ALL | C:\Windows\system32\cmd.exe | — | setup1_1.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1720 | "C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files\Kuai8\K8GM.exe" name="快吧游戏管理器" mode=ENABLE scope=ALL | C:\Windows\system32\cmd.exe | — | setup1_1.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1780 | "C:\Windows\system32\cmd.exe" /c netsh firewall add allowedprogram program="C:\Program Files\Kuai8\K8Flash.exe" name="快吧flash游戏程序" mode=ENABLE scope=ALL | C:\Windows\system32\cmd.exe | — | setup1_1.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2068 | "C:\Program Files\Kuai8\K8Update.exe" -update -delay=3 -type=1 | C:\Program Files\Kuai8\K8Update.exe | K8GM.exe | ||||||||||||
User: admin Company: 凡游网络 Integrity Level: HIGH Description: 快吧游戏版本升级程序 Exit code: 0 Version: 8.2.1.8311 Modules
| |||||||||||||||
| (PID) Process: | (1504) razorlame.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RazorLame.exe |
| Operation: | write | Name: | |
Value: C:\Program Files\RazorLame\RazorLame.exe | |||
| (PID) Process: | (1504) razorlame.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RazorLame(×îÏȽøµÄ MP3 ѹËõ¹¤¾ß) |
| Operation: | write | Name: | DisplayName |
Value: RazorLame(×îÏȽøµÄ MP3 ѹËõ¹¤¾ß) V3.98Alpha11ÂÌÉ«ºº»¯°æ | |||
| (PID) Process: | (1504) razorlame.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RazorLame(×îÏȽøµÄ MP3 ѹËõ¹¤¾ß) |
| Operation: | write | Name: | UninstallString |
Value: C:\Program Files\RazorLame\uninst.exe | |||
| (PID) Process: | (1504) razorlame.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RazorLame(×îÏȽøµÄ MP3 ѹËõ¹¤¾ß) |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\RazorLame\RazorLame.exe | |||
| (PID) Process: | (1504) razorlame.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RazorLame(×îÏȽøµÄ MP3 ѹËõ¹¤¾ß) |
| Operation: | write | Name: | DisplayVersion |
Value: V3.98Alpha11ÂÌÉ«ºº»¯°æ | |||
| (PID) Process: | (1504) razorlame.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | Start Page |
Value: http://www.hao123.com/?tn=29065018_48_hao_pg | |||
| (PID) Process: | (1504) razorlame.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (1504) razorlame.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2340) setup1_1.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2340) setup1_1.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1504 | razorlame.exe | C:\Users\admin\AppData\Local\Temp\nsc72AA.tmp\ioSpecial.ini | text | |
MD5:— | SHA256:— | |||
| 860 | svchost.exe | C:\Windows\appcompat\programs\RecentFileCache.bcf | txt | |
MD5:— | SHA256:— | |||
| 1504 | razorlame.exe | C:\Program Files\RazorLame\RazorLame.exe | executable | |
MD5:— | SHA256:— | |||
| 1504 | razorlame.exe | C:\Program Files\RazorLame\Free-Codecs.txt | text | |
MD5:— | SHA256:— | |||
| 1504 | razorlame.exe | C:\Users\admin\AppData\Local\Temp\nsc72AA.tmp\modern-wizard.bmp | image | |
MD5:— | SHA256:— | |||
| 1504 | razorlame.exe | C:\Program Files\RazorLame\mp3-tech.org\Modem.rlo | text | |
MD5:— | SHA256:— | |||
| 1504 | razorlame.exe | C:\Program Files\RazorLame\lame.css | text | |
MD5:— | SHA256:— | |||
| 1504 | razorlame.exe | C:\Users\admin\AppData\Local\Temp\nsc72AA.tmp\modern-header.bmp | image | |
MD5:— | SHA256:— | |||
| 1504 | razorlame.exe | C:\Program Files\RazorLame\mp3-tech.org\Portable player (maximize playing time).rlo | text | |
MD5:— | SHA256:— | |||
| 1504 | razorlame.exe | C:\Program Files\RazorLame\razorlame.ini | text | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1504 | razorlame.exe | GET | — | 118.212.233.164:80 | http://www.qq5.com/soft.xml | CN | — | — | malicious |
2104 | K8GM.exe | GET | 200 | 202.97.174.81:80 | http://icon.kuai8box.com/slider/201911/20191119151052171.jpg | CN | image | 149 Kb | malicious |
2104 | K8GM.exe | GET | 200 | 183.61.16.216:80 | http://service.kuai8box.com/time.php?data=&md5= | CN | text | 32 b | unknown |
2104 | K8GM.exe | GET | 200 | 163.171.132.119:80 | http://yxh.kuai8box.com/recommend/hot.html | US | html | 191 Kb | malicious |
2104 | K8GM.exe | GET | 200 | 183.61.16.216:80 | http://v2.update.kuai8box.com/status?data=9QKJpu658Exu%2BNrQPLhAjrDOIsGXc6CeZtNzKDYaWz2KzDApMt3HyiLOstjFfpA%2FxiXGRcKoMI4dYXvg6FnwQOXnp0J9cK8IJhBGcm8ih8j4p6mIbchvzwBIllOis9QN7uPC69WUsng145rmxML%2FWTQkqx9CkOD2VufOTpLd2kbniM%2Fj8%2B0QMf7JqhEp59BZ%2B3dI9UQ0kcHAgLY04BbAasFFo7NsqTwcgfnqxwUe0b%2BuLGSDoeHpOtVEjOdWZyAqY7Y7GQh4zRE%3D&md5=6e9c4e40b80adf6e460b9b9cf4cf33d2 | CN | text | 344 b | unknown |
1500 | K8GM.exe | GET | 200 | 183.61.19.140:80 | http://update.kuai8box.com/update_top.php?data=5HVi9SRe0UvW8sEg2u9uEtNJhzW3nPE0dr9FI6EFe04%3D&md5=654bb21f65f494ccec70cba059829bdf | CN | text | 172 b | unknown |
1504 | razorlame.exe | GET | 200 | 115.231.153.141:80 | http://d1.kuai8.com/setup/kuai8_rjaz.exe | CN | executable | 11.8 Mb | malicious |
2104 | K8GM.exe | POST | 200 | 183.61.19.140:80 | http://update.kuai8box.com/update_icon.php?data=5HVi9SRe0UuqHluTGqo3aA%3D%3D&md5=fe0169af3b7e234276759326d9fa7a61 | CN | text | 10.8 Kb | unknown |
1500 | K8GM.exe | GET | 200 | 202.97.174.82:80 | http://gmx.kuai8box.com/update_new/update_161_7/update155_5-161_7.xml | CN | text | 313 Kb | malicious |
2104 | K8GM.exe | GET | 200 | 183.61.19.140:80 | http://update.kuai8box.com/update_database.php?data=5HVi9SRe0UvW8sEg2u9uEjg2k5Q35O1r%2BOE8BBpXv%2B8%3D&md5=090d282c88dfaf8ba0300eafa99dce16 | CN | text | 64 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3408 | K8Update.exe | 106.15.15.135:80 | ip.taobao.com | Hangzhou Alibaba Advertising Co.,Ltd. | CN | malicious |
2104 | K8GM.exe | 183.61.19.140:80 | update.kuai8box.com | Guangdong | CN | unknown |
2104 | K8GM.exe | 183.61.16.216:80 | service.kuai8box.com | Guangdong | CN | unknown |
2104 | K8GM.exe | 163.171.132.119:80 | yxh.kuai8box.com | — | US | malicious |
2104 | K8GM.exe | 183.61.19.138:80 | stat.kuai8box.com | Guangdong | CN | unknown |
2104 | K8GM.exe | 47.98.157.135:80 | query.kuai8box.com | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
2104 | K8GM.exe | 202.97.174.82:80 | d1.kuai8.com | CHINA UNICOM China169 Backbone | CN | malicious |
2104 | K8GM.exe | 202.97.174.81:80 | gmx.kuai8box.com | CHINA UNICOM China169 Backbone | CN | malicious |
2104 | K8GM.exe | 106.15.15.135:80 | ip.taobao.com | Hangzhou Alibaba Advertising Co.,Ltd. | CN | malicious |
2600 | K8Update.exe | 183.61.19.138:80 | stat.kuai8box.com | Guangdong | CN | unknown |
Domain | IP | Reputation |
|---|---|---|
www.qq5.com |
| malicious |
d1.kuai8.com |
| malicious |
update.kuai8box.com |
| unknown |
gmx.kuai8box.com |
| malicious |
stat.kuai8box.com |
| unknown |
ip.taobao.com |
| unknown |
service.kuai8box.com |
| unknown |
v2.update.kuai8box.com |
| unknown |
yxh.kuai8box.com |
| malicious |
query.kuai8box.com |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
1504 | razorlame.exe | Misc activity | ADWARE [PTsecurity] PUA:Win32/Conduit |
1504 | razorlame.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2104 | K8GM.exe | Generic Protocol Command Decode | SURICATA HTTP response header invalid |
2104 | K8GM.exe | Generic Protocol Command Decode | SURICATA HTTP response header invalid |
2104 | K8GM.exe | Generic Protocol Command Decode | SURICATA HTTP response header invalid |
2104 | K8GM.exe | Misc activity | ADWARE [PTsecurity] Unsafe.Game.Installer (.gmp file) |
2104 | K8GM.exe | Misc activity | ADWARE [PTsecurity] Unsafe.Game.Installer (.gmp file) |
2104 | K8GM.exe | Misc activity | ADWARE [PTsecurity] Unsafe.Game.Installer (.gmp file) |
2104 | K8GM.exe | Misc activity | ADWARE [PTsecurity] Unsafe.Game.Installer (.gmp file) |
2104 | K8GM.exe | Misc activity | ADWARE [PTsecurity] Unsafe.Game.Installer (.gmp file) |
Process | Message |
|---|---|
K8GM.exe | show window |