File name:

mingw-get-setup.exe

Full analysis: https://app.any.run/tasks/6434be88-80d9-4fa2-b2a2-6c5abada3a9c
Verdict: Malicious activity
Analysis date: November 30, 2018, 16:18:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5:

92D905BDFE13C798A2CDA2BBACDAD932

SHA1:

66F1355F16AC1E328243E877880EB6E45E8B30E2

SHA256:

AAB27BD5547D35DC159288F3B5B8760F21B0CFEC86E8F0032B49DD0410F232BC

SSDEEP:

1536:+sE5jlwWrw6I3N8SFsngkZ4nJ9jHZN+4Ie6fFF6rS7cnouy8VAt:tE5Rw6GN8wsngi4nJ7N+P7Foc8outy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • mingw-get-setup.exe (PID: 2796)

  • SUSPICIOUS

    • Creates files in the user directory

      • mingw-get-setup.exe (PID: 2796)

    • Executable content was dropped or overwritten

      • mingw-get-setup.exe (PID: 2796)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:10:04 21:21:04+02:00
PEType: PE32
LinkerVersion: 2.22
CodeSize: 77824
InitializedDataSize: 12288
UninitializedDataSize: 135168
EntryPoint: 0x33770
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.602.22340.1
ProductVersionNumber: 0.602.22340.1
FileFlagsMask: 0x003f
FileFlags: Pre-release
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Windows, Latin1
ProductName: mingw-get
ProductVersion: 0.6.2-beta-20131004-1
CompanyName: MinGW.org Project
LegalCopyright: Copyright © 2009-2013, MinGW.org Project
OriginalFileName: mingw-get-setup.exe
FileDescription: MinGW Installation Manager Setup Tool
FileVersion: 0.6.2-beta-20131004-1
InternalName: mingw-get-setup

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Oct-2013 19:21:04
Detected languages:
  • English - United Kingdom
  • English - United States
TLS Callbacks: 1 callback(s) detected.
ProductName: mingw-get
ProductVersion: 0.6.2-beta-20131004-1
CompanyName: MinGW.org Project
LegalCopyright: Copyright © 2009-2013, MinGW.org Project
OriginalFileName: mingw-get-setup.exe
FileDescription: MinGW Installation Manager Setup Tool
FileVersion: 0.6.2-beta-20131004-1
InternalName: mingw-get-setup

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 04-Oct-2013 19:21:04
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x00021000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x00022000
0x00013000
0x00012400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.98824
.rsrc
0x00035000
0x00003000
0x00002C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.53095

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.17728
1237
UNKNOWN
English - United States
RT_MANIFEST
7
6.36221
116
UNKNOWN
English - United States
RT_STRING
8
6.36231
106
UNKNOWN
English - United States
RT_STRING
9
7.41137
344
UNKNOWN
English - United States
RT_STRING
100
1.91924
20
UNKNOWN
English - United States
RT_GROUP_ICON
201
7.90544
2140
UNKNOWN
English - United States
RT_DIALOG
202
7.91043
2050
UNKNOWN
English - United States
RT_DIALOG
203
7.83863
1274
UNKNOWN
English - United States
RT_DIALOG
204
7.73022
702
UNKNOWN
English - United States
RT_DIALOG
205
7.86002
1408
UNKNOWN
English - United States
RT_DIALOG

Imports

KERNEL32.DLL
advapi32.dll
comctl32.dll
gdi32.dll
msvcrt.dll
ole32.dll
shell32.dll
user32.dll
wininet.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
30
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mingw-get-setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
2796"C:\Users\admin\AppData\Local\Temp\mingw-get-setup.exe" C:\Users\admin\AppData\Local\Temp\mingw-get-setup.exe
explorer.exe
User:
admin
Company:
MinGW.org Project
Integrity Level:
MEDIUM
Description:
MinGW Installation Manager Setup Tool
Exit code:
0
Version:
0.6.2-beta-20131004-1
Modules
Images
c:\users\admin\appdata\local\temp\mingw-get-setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
63
Read events
35
Write events
28
Delete events
0

Modification events

(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2796) mingw-get-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\mingw-get-setup_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
6
Suspicious files
0
Text files
161
Unknown types
10

Dropped files

PID
Process
Filename
Type
2796mingw-get-setup.exeC:\MinGW\var\cache\mingw-get\packages\.in-transit\mingw-get-0.6.2-mingw32-beta-20131004-1-bin.tar.xz —
MD5:—
SHA256:—
2796mingw-get-setup.exeC:\MinGW\var\cache\mingw-get\packages\.in-transit\mingw-get-0.6.2-mingw32-beta-20131004-1-gui.tar.xz —
MD5:—
SHA256:—
2796mingw-get-setup.exeC:\MinGW\var\cache\mingw-get\packages\.in-transit\mingw-get-0.6.2-mingw32-beta-20131004-1-lic.tar.xz —
MD5:—
SHA256:—
2796mingw-get-setup.exeC:\MinGW\var\cache\mingw-get\packages\.in-transit\mingw-get-setup-0.6.2-mingw32-beta-20131004-1-dll.tar.xz —
MD5:—
SHA256:—
2796mingw-get-setup.exeC:\MinGW\var\cache\mingw-get\packages\.in-transit\mingw-get-setup-0.6.2-mingw32-beta-20131004-1-xml.tar.xz —
MD5:—
SHA256:—
2796mingw-get-setup.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@downloads.sourceforge[1].txttext
MD5:—
SHA256:—
2796mingw-get-setup.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@downloads.sourceforge[2].txttext
MD5:—
SHA256:—
2796mingw-get-setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mingw-get-0.6.2-mingw32-beta-20131004-1-bin.tar[1].xzxz
MD5:6453E5E9A88511A599630013CA0F2871
SHA256:D199842BAD7373BC52CEC841D31ABF42C77FEBDDAA9E3D8A3CF3182523B23B01
2796mingw-get-setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\mingw-get-setup-0.6.2-mingw32-beta-20131004-1-dll.tar[1].xzxz
MD5:6E83037D4DE2A7FEAC46058171F3EB96
SHA256:B2C64229CA64DD71E1CA3B664BEC88D1D9B1C80F3B012E84DCF25C8D7B6A2E6C
2796mingw-get-setup.exeC:\MinGW\var\cache\mingw-get\packages\mingw-get-0.6.2-mingw32-beta-20131004-1-bin.tar.xzxz
MD5:6453E5E9A88511A599630013CA0F2871
SHA256:D199842BAD7373BC52CEC841D31ABF42C77FEBDDAA9E3D8A3CF3182523B23B01
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
25
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2796
mingw-get-setup.exe
GET
302
216.105.38.13:80
http://downloads.sourceforge.net/project/mingw/Installer/mingw-get/mingw-get-0.6.2-beta-20131004-1/mingw-get-0.6.2-mingw32-beta-20131004-1-bin.tar.xz?download=
US
text
228 b
whitelisted
2796
mingw-get-setup.exe
GET
302
216.105.38.13:80
http://downloads.sourceforge.net/project/mingw/Installer/mingw-get/mingw-get-0.6.2-beta-20131004-1/mingw-get-0.6.2-mingw32-beta-20131004-1-gui.tar.xz?download=
US
text
229 b
whitelisted
2796
mingw-get-setup.exe
GET
302
216.105.38.13:80
http://downloads.sourceforge.net/project/mingw/Installer/mingw-get/mingw-get-0.6.2-beta-20131004-1/mingw-get-0.6.2-mingw32-beta-20131004-1-lic.tar.xz?download=
US
text
230 b
whitelisted
2796
mingw-get-setup.exe
GET
302
216.105.38.13:80
http://downloads.sourceforge.net/project/mingw/Installer/mingw-get/mingw-get-0.6.2-beta-20131004-1/mingw-get-setup-0.6.2-mingw32-beta-20131004-1-dll.tar.xz?download=
US
text
235 b
whitelisted
2796
mingw-get-setup.exe
GET
302
216.105.38.13:80
http://downloads.sourceforge.net/project/mingw/Installer/mingw-get/mingw-get-0.6.2-beta-20131004-1/mingw-get-setup-0.6.2-mingw32-beta-20131004-1-xml.tar.xz?download=
US
text
235 b
whitelisted
2796
mingw-get-setup.exe
GET
302
216.105.38.13:80
http://downloads.sourceforge.net/project/mingw/Installer/mingw-get/catalogue/package-list.xml.lzma?download=
US
text
177 b
whitelisted
2796
mingw-get-setup.exe
GET
302
216.105.38.13:80
http://downloads.sourceforge.net/project/mingw/Installer/mingw-get/catalogue/mingw32-package-list.xml.lzma?download=
US
text
187 b
whitelisted
2796
mingw-get-setup.exe
GET
302
216.105.38.13:80
http://downloads.sourceforge.net/project/mingw/Installer/mingw-get/catalogue/mingw32-binutils.xml.lzma?download=
US
text
181 b
whitelisted
2796
mingw-get-setup.exe
GET
302
216.105.38.13:80
http://downloads.sourceforge.net/project/mingw/Installer/mingw-get/catalogue/mingw32-dos2unix.xml.lzma?download=
US
text
187 b
whitelisted
2796
mingw-get-setup.exe
GET
301
216.105.38.13:80
http://prdownloads.sourceforge.net/mingw/mingw-get-0.6.2-mingw32-beta-20131004-1-gui.tar.xz?download
US
text
256 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2796
mingw-get-setup.exe
216.105.38.13:80
prdownloads.sourceforge.net
American Internet Services, LLC.
US
malicious
2796
mingw-get-setup.exe
212.219.56.185:443
kent.dl.sourceforge.net
Jisc Services Limited
GB
unknown
2796
mingw-get-setup.exe
87.121.121.2:443
netix.dl.sourceforge.net
NetIX Communications Ltd.
BG
suspicious
2796
mingw-get-setup.exe
88.191.250.136:443
freefr.dl.sourceforge.net
Free SAS
FR
suspicious
2796
mingw-get-setup.exe
185.152.64.70:443
datapacket.dl.sourceforge.net
Datacamp Limited
CZ
unknown
2796
mingw-get-setup.exe
78.35.24.46:443
netcologne.dl.sourceforge.net
NetCologne GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
prdownloads.sourceforge.net
  • 216.105.38.13
suspicious
kent.dl.sourceforge.net
  • 212.219.56.185
unknown
netix.dl.sourceforge.net
  • 87.121.121.2
suspicious
freefr.dl.sourceforge.net
  • 88.191.250.136
suspicious
datapacket.dl.sourceforge.net
  • 185.152.64.70
unknown
netcologne.dl.sourceforge.net
  • 78.35.24.46
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mingw-get-setup.exe