File name: | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf |
Full analysis: | https://app.any.run/tasks/e1dd2f26-48ab-4211-b074-56f6afae26c2 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2022, 04:53:39 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 20C9D400119D3E05E3034E4F1C5C8185 |
SHA1: | 7891864033334401EB2E5A02F16133E7415AF52A |
SHA256: | AA55DA81DDD4B8AB7D6AC28660671F57FAF0FF58A11E3A046452C92AA9CB38BF |
SSDEEP: | 3072:4QzoUD1kloqrofPVTTyCZ2vSw2xn/0NouK+GgnkqzozE:44oUR4oqMdyreN+hkqL |
.dll | | | Win32 Dynamic Link Library (generic) (43.5) |
---|---|---|
.exe | | | Win32 Executable (generic) (29.8) |
.exe | | | Generic Win/DOS Executable (13.2) |
.exe | | | DOS Executable Generic (13.2) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2011-Mar-11 12:10:24 |
Detected languages: |
|
CompanyName: | It Systems |
FileDescription: | Covering Software |
FileVersion: | 1.2.8800.0 (xpscanner010817-1148) |
InternalName: | sdffdfc |
LegalCopyright: | © It Systems Corp. All rights reserved. |
OriginalFilename: | fwrscsf.exe |
ProductName: | AV SoftWare © |
ProductVersion: | 4.6.3311.0 |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 232 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 3 |
TimeDateStamp: | 2011-Mar-11 12:10:24 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 82640 | 82944 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.99166 |
.data | 90112 | 158096 | 1536 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.71656 |
.rsrc | 249856 | 49284 | 49664 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.91156 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 7.99126 | 21719 | UNKNOWN | UNKNOWN | PNG |
2 | 7.99254 | 24473 | UNKNOWN | UNKNOWN | PNG |
95 | 3.75988 | 296 | UNKNOWN | UNKNOWN | RT_ICON |
1 (#2) | 1.52999 | 296 | UNKNOWN | UNKNOWN | RT_ICON |
1 (#3) | 1.84274 | 20 | UNKNOWN | UNKNOWN | RT_GROUP_ICON |
1 (#4) | 3.49914 | 800 | UNKNOWN | UNKNOWN | RT_VERSION |
1 (#5) | 4.87491 | 667 | UNKNOWN | UNKNOWN | RT_MANIFEST |
gdi32.dll |
kernel32.dll |
user32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1580 | "C:\Users\admin\AppData\Local\Temp\aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe" | C:\Users\admin\AppData\Local\Temp\aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe | Explorer.EXE | |
User: admin Company: It Systems Integrity Level: MEDIUM Description: Covering Software Version: 1.2.8800.0 (xpscanner010817-1148) | ||||
2452 | "c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\accessories\promptcommand26436.exe" | c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\accessories\promptcommand26436.exe | — | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe |
User: admin Company: It Systems Integrity Level: MEDIUM Description: Covering Software Version: 1.2.8800.0 (xpscanner010817-1148) | ||||
3668 | "c:\users\admin\appdata\roaming\microsoft\windows\sendto\folderzfsendtotarcompressed.exe" | c:\users\admin\appdata\roaming\microsoft\windows\sendto\folderzfsendtotarcompressed.exe | — | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe |
User: admin Company: It Systems Integrity Level: MEDIUM Description: Covering Software Version: 1.2.8800.0 (xpscanner010817-1148) | ||||
4068 | "c:\users\admin\appdata\local\google\chrome\user data\pepperflash\32.0.0.433\shockwaveadobe.exe" | c:\users\admin\appdata\local\google\chrome\user data\pepperflash\32.0.0.433\shockwaveadobe.exe | — | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe |
User: admin Company: It Systems Integrity Level: MEDIUM Description: Covering Software Version: 1.2.8800.0 (xpscanner010817-1148) | ||||
2548 | "c:\users\admin\appdata\local\google\chrome\user data\default\storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\persistentnetwork20960.exe" | c:\users\admin\appdata\local\google\chrome\user data\default\storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\persistentnetwork20960.exe | — | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe |
User: admin Company: It Systems Integrity Level: MEDIUM Description: Covering Software Version: 1.2.8800.0 (xpscanner010817-1148) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1580 | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\PersistentNetwork20960.exe | executable | |
MD5:20C9D400119D3E05E3034E4F1C5C8185 | SHA256:AA55DA81DDD4B8AB7D6AC28660671F57FAF0FF58A11E3A046452C92AA9CB38BF | |||
1580 | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PromptCommand26436.exe | executable | |
MD5:20C9D400119D3E05E3034E4F1C5C8185 | SHA256:AA55DA81DDD4B8AB7D6AC28660671F57FAF0FF58A11E3A046452C92AA9CB38BF | |||
1580 | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe | C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\BlocksdBuiltIn968.exe | executable | |
MD5:20C9D400119D3E05E3034E4F1C5C8185 | SHA256:AA55DA81DDD4B8AB7D6AC28660671F57FAF0FF58A11E3A046452C92AA9CB38BF | |||
1580 | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe | C:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\ChromeGoogle.exe | executable | |
MD5:20C9D400119D3E05E3034E4F1C5C8185 | SHA256:AA55DA81DDD4B8AB7D6AC28660671F57FAF0FF58A11E3A046452C92AA9CB38BF | |||
1580 | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\PepperFlash\32.0.0.433\ShockwaveAdobe.exe | executable | |
MD5:20C9D400119D3E05E3034E4F1C5C8185 | SHA256:AA55DA81DDD4B8AB7D6AC28660671F57FAF0FF58A11E3A046452C92AA9CB38BF | |||
1580 | aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\FolderZFSendToTarCompressed.exe | executable | |
MD5:20C9D400119D3E05E3034E4F1C5C8185 | SHA256:AA55DA81DDD4B8AB7D6AC28660671F57FAF0FF58A11E3A046452C92AA9CB38BF |
Domain | IP | Reputation |
---|---|---|
web-peoplesopport.us |
| unknown |
1670302434.websmart-ideas.be |
| unknown |
1670302441.websmart-ideas.be |
| unknown |
1670302445.websmart-ideas.be |
| unknown |
1670302449.websmart-ideas.be |
| unknown |