File name:

CouponPrinter.exe

Full analysis: https://app.any.run/tasks/ffd95b98-76ae-4b6f-b034-1d9978562fe1
Verdict: Malicious activity
Analysis date: June 07, 2019, 13:58:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

82C2AF1B8F4DDE40301EF803C3E641A7

SHA1:

41390113AB2C111B2E898AEDBD307841617670B5

SHA256:

A8A7F0E587402A8D2F84E02E6080F8D9C40DDCF69A87AE2679FEEBD12A2E10DC

SSDEEP:

24576:m7gCYQ1LGum4sx8Kofd/uV+wCrCBLkGVcUxXxBmH24t:6gCh1LGumhuW+5rKnVcmBWt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • irsetup.exe (PID: 2844)
      • irsetup.exe (PID: 2588)
      • irsetup.exe (PID: 2476)

    • Changes settings of System certificates

      • irsetup.exe (PID: 2844)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • irsetup.exe (PID: 2844)
      • CouponPrinter.exe (PID: 3592)
      • CouponPrinter.exe (PID: 3380)
      • irsetup.exe (PID: 2588)
      • irsetup.exe (PID: 2476)
      • CouponPrinter.exe (PID: 3040)

    • Adds / modifies Windows certificates

      • irsetup.exe (PID: 2844)

    • Reads internet explorer settings

      • irsetup.exe (PID: 2844)

    • Creates files in the program directory

      • irsetup.exe (PID: 2844)

    • Removes files from Windows directory

      • irsetup.exe (PID: 2844)

    • Creates files in the Windows directory

      • irsetup.exe (PID: 2844)

    • Executed via COM

      • iexplore.exe (PID: 3448)

    • Creates a software uninstall entry

      • irsetup.exe (PID: 2844)

  • INFO

    • Manual execution by user

      • CouponPrinter.exe (PID: 3380)
      • CouponPrinter.exe (PID: 3536)
      • CouponPrinter.exe (PID: 3040)
      • CouponPrinter.exe (PID: 3224)

    • Creates files in the user directory

      • iexplore.exe (PID: 3736)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3736)

    • Changes internet zones settings

      • iexplore.exe (PID: 3448)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (31)
.exe | Win64 Executable (generic) (27.4)
.exe | Win32 EXE Yoda's Crypter (26.4)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:11:06 20:53:27+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 32768
InitializedDataSize: 45056
UninitializedDataSize: -
EntryPoint: 0x3079
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.0.0.0
ProductVersionNumber: 5.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
Comments: Coupon Printer Installer
CompanyName: Coupons.com Incorporated
FileDescription: Coupon Printer Installer
FileVersion: 5.0.0.0
InternalName: sf_rt
LegalCopyright: Copyright © 2009 by Coupons.com Incorporated
OriginalFileName: suf80_launch.exe
ProductName: Coupon Printer
ProductVersion: 5.0.0.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 06-Nov-2009 19:53:27
Detected languages:
  • English - United States
Comments: Coupon Printer Installer
CompanyName: Coupons.com Incorporated
FileDescription: Coupon Printer Installer
FileVersion: 5.0.0.0
InternalName: sf_rt
LegalCopyright: Copyright © 2009 by Coupons.com Incorporated
OriginalFilename: suf80_launch.exe
ProductName: Coupon Printer
ProductVersion: 5.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 06-Nov-2009 19:53:27
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000070A4
0x00008000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.1532
.rdata
0x00009000
0x00002882
0x00003000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.97055
.data
0x0000C000
0x00001928
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.23226
.rsrc
0x0000E000
0x00006D04
0x00007000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.87226

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28514
1139
Latin 1 / Western European
English - United States
RT_MANIFEST
2
4.31421
1384
Latin 1 / Western European
English - United States
RT_ICON
3
5.9477
1128
Latin 1 / Western European
English - United States
RT_ICON
4
3.78233
744
Latin 1 / Western European
English - United States
RT_ICON
5
6.14953
2216
Latin 1 / Western European
English - United States
RT_ICON
6
5.83714
4264
Latin 1 / Western European
English - United States
RT_ICON
7
3.64397
1640
Latin 1 / Western European
English - United States
RT_ICON
8
5.84115
3752
Latin 1 / Western European
English - United States
RT_ICON
9
5.41049
9640
Latin 1 / Western European
English - United States
RT_ICON
101
2.89097
132
Latin 1 / Western European
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start couponprinter.exe irsetup.exe couponprinter.exe no specs couponprinter.exe irsetup.exe iexplore.exe iexplore.exe couponprinter.exe no specs couponprinter.exe irsetup.exe couponprinter.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2476"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" __IRAOFF:662050 "__IRAFN:C:\Users\admin\Desktop\CouponPrinter.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-1302019708-1500728564-335382590-1000"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
CouponPrinter.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
8.2.1.0
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_1\irsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2588"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" __IRAOFF:662050 "__IRAFN:C:\Users\admin\Desktop\CouponPrinter.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-1302019708-1500728564-335382590-1000"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
CouponPrinter.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
5
Version:
8.2.1.0
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_1\irsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
2844"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:662050 "__IRAFN:C:\Users\admin\Desktop\CouponPrinter.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-1302019708-1500728564-335382590-1000"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
CouponPrinter.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
8.2.1.0
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_0\irsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
3040"C:\Users\admin\Desktop\CouponPrinter.exe" C:\Users\admin\Desktop\CouponPrinter.exe
explorer.exe
User:
admin
Company:
Coupons.com Incorporated
Integrity Level:
HIGH
Description:
Coupon Printer Installer
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\desktop\couponprinter.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3132"C:\Users\admin\Desktop\CouponPrinter.exe" C:\Users\admin\Desktop\CouponPrinter.exe—explorer.exe
User:
admin
Company:
Coupons.com Incorporated
Integrity Level:
MEDIUM
Description:
Coupon Printer Installer
Exit code:
0
Version:
5.0.0.0
3224"C:\Users\admin\Desktop\CouponPrinter.exe" C:\Users\admin\Desktop\CouponPrinter.exe—explorer.exe
User:
admin
Company:
Coupons.com Incorporated
Integrity Level:
MEDIUM
Description:
Coupon Printer Installer
Exit code:
3221226540
Version:
5.0.0.0
Modules
Images
c:\users\admin\desktop\couponprinter.exe
c:\systemroot\system32\ntdll.dll
3380"C:\Users\admin\Desktop\CouponPrinter.exe" C:\Users\admin\Desktop\CouponPrinter.exe
explorer.exe
User:
admin
Company:
Coupons.com Incorporated
Integrity Level:
HIGH
Description:
Coupon Printer Installer
Exit code:
5
Version:
5.0.0.0
Modules
Images
c:\users\admin\desktop\couponprinter.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3448"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3536"C:\Users\admin\Desktop\CouponPrinter.exe" C:\Users\admin\Desktop\CouponPrinter.exe—explorer.exe
User:
admin
Company:
Coupons.com Incorporated
Integrity Level:
MEDIUM
Description:
Coupon Printer Installer
Exit code:
3221226540
Version:
5.0.0.0
Modules
Images
c:\users\admin\desktop\couponprinter.exe
c:\systemroot\system32\ntdll.dll
3592"C:\Users\admin\Desktop\CouponPrinter.exe" C:\Users\admin\Desktop\CouponPrinter.exe
explorer.exe
User:
admin
Company:
Coupons.com Incorporated
Integrity Level:
HIGH
Description:
Coupon Printer Installer
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\desktop\couponprinter.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 863
Read events
1 732
Write events
130
Delete events
1

Modification events

(PID) Process:(3592) CouponPrinter.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3592) CouponPrinter.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2844) irsetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2844) irsetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2844) irsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2844) irsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2844) irsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2844) irsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2844) irsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2844) irsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
11
Suspicious files
2
Text files
67
Unknown types
9

Dropped files

PID
Process
Filename
Type
2844irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat —
MD5:—
SHA256:—
2844irsetup.exeC:\Windows\ctest1.txt —
MD5:—
SHA256:—
2844irsetup.exeC:\Program Files\Coupons\Uninstall\uni4411.tmp —
MD5:—
SHA256:—
3592CouponPrinter.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeexecutable
MD5:3FE7C92DBA5C9240B4AB0D6A87E6166A
SHA256:A7818C1E0DAD1CBBA4D17809688887ADEEAFE940A3CB53A6AEABDFCD196F7258
2844irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\Verdana_1.FONexecutable
MD5:—
SHA256:—
2844irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.JPGimage
MD5:EE68D62044AFA6CA5AFEB8228BBB8E10
SHA256:F37706204AC6C67516A74A59DF7E65591075C1A3D21DA1E9B48CDEC74C9C7B86
2844irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPGimage
MD5:549CC74A0E3DEF6B8D850B10678A20A8
SHA256:CF1B2320C45D21B9A62F3D7D4E6B2557A0ADA17CB32C774B4C54385B67C410D4
2844irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.JPGimage
MD5:6FB2B3B60780236D59F8E3DC480C425A
SHA256:1E18EB542AF573D73E7CB3778972D756CBD6C2306157BD06CDD3B4EE3DD72448
2844irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPGimage
MD5:1444AEC1C38996DF19E9CFE9DB9B663C
SHA256:2AD87FC05F59CEC48EB75610678872ACC0AEBFAD7E28B21C3CF119E4D13BFA52
2844irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG7.JPGimage
MD5:E803AEC3D341834DF73154C15EF23CE0
SHA256:7E797A08FA7785DC1527E5E8E0DEACE4F6978999FAE06C306D4116AC691C616A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
5
DNS requests
3
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2844
irsetup.exe
GET
404
64.75.15.145:80
http://connect.coupons.com/validate.asp?i=&s=frag&r=ts&vers=4
US
xml
345 b
suspicious
3736
iexplore.exe
GET
404
104.111.248.235:80
http://www.coupons.com/
NL
xml
345 b
whitelisted
2844
irsetup.exe
GET
404
64.75.15.145:80
http://connect.coupons.com/validate.asp?q=&vers=4
US
xml
345 b
suspicious
2844
irsetup.exe
GET
404
64.75.15.145:80
http://connect.coupons.com/validate.asp
US
xml
345 b
suspicious
2844
irsetup.exe
GET
404
64.75.15.145:80
http://connect.coupons.com/validate.asp
US
xml
345 b
suspicious
2844
irsetup.exe
GET
404
64.75.15.145:80
http://connect.coupons.com/validate.asp
US
xml
345 b
suspicious
3448
iexplore.exe
GET
404
204.79.197.200:80
http://www.bing.com/favicon.ico
US
xml
345 b
whitelisted
2844
irsetup.exe
GET
404
64.75.15.145:80
http://connect.coupons.com/validate.asp
US
xml
345 b
suspicious
2844
irsetup.exe
GET
404
64.75.15.145:80
http://connect.coupons.com/validate.asp
US
xml
345 b
suspicious
2844
irsetup.exe
GET
404
64.75.15.145:80
http://connect.coupons.com/validate.asp
US
xml
345 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2844
irsetup.exe
64.75.15.145:80
connect.coupons.com
Coupons.com Incorporated
US
suspicious
2844
irsetup.exe
64.75.15.145:443
connect.coupons.com
Coupons.com Incorporated
US
suspicious
3448
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3736
iexplore.exe
104.111.248.235:80
www.coupons.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
connect.coupons.com
  • 64.75.15.145
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.coupons.com
  • 104.111.248.235
whitelisted

Threats

Found threats are available for the paid subscriptions
8 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CouponPrinter.exe