analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553

Full analysis: https://app.any.run/tasks/27532955-f87c-4ed6-b53f-cd1fa72e031f
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: March 21, 2019, 21:15:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F39E228CFDAF4ABC6C505DCFF60F8DC0

SHA1:

88337ABF7B9ECD9396A384C4878E3E8674783101

SHA256:

ABFADB6686459F69A92EDE367A2713FC2A1289EBE0C8596964682E4334CEE553

SSDEEP:

12288:pKxb9m2SXGO894qCEqXjIJbnVXpc0Z/oV3R:Ib9jGqCEqT+bnVXpc0ZS3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Writes to a start menu file

      • wininit.exe (PID: 2040)
    • Changes the autorun value in the registry

      • wininit.exe (PID: 2040)
  • SUSPICIOUS

    • Application launched itself

      • abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe (PID: 1476)
      • wininit.exe (PID: 716)
    • Creates files in the user directory

      • abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe (PID: 3984)
      • wininit.exe (PID: 2040)
    • Starts CMD.EXE for commands execution

      • abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe (PID: 3984)
    • Drops self deleting batch file

      • abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe (PID: 3984)
    • Executable content was dropped or overwritten

      • abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe (PID: 3984)
      • wininit.exe (PID: 2040)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (69.4)
.exe | Win64 Executable (generic) (23.3)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:08:21 17:35:17+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 438272
InitializedDataSize: 65536
UninitializedDataSize: -
EntryPoint: 0x1644
OSVersion: 4
ImageVersion: 2.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.7
ProductVersionNumber: 2.1.0.7
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Spanish (Modern)
CharacterSet: Unicode
Comments: Mahab Ghodss
CompanyName: Mahab Ghodss
FileDescription: Mahab Ghodss
LegalCopyright: Mahab Ghodss
LegalTrademarks: Mahab Ghodss
ProductName: Mahab Ghodss
FileVersion: 2.01.0007
ProductVersion: 2.01.0007
InternalName: NuLogic
OriginalFileName: NuLogic.dll

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 21-Aug-2018 15:35:17
Detected languages:
  • Spanish - Spain (International sort)
Comments: Mahab Ghodss
CompanyName: Mahab Ghodss
FileDescription: Mahab Ghodss
LegalCopyright: Mahab Ghodss
LegalTrademarks: Mahab Ghodss
ProductName: Mahab Ghodss
FileVersion: 2.01.0007
ProductVersion: 2.01.0007
InternalName: NuLogic
OriginalFilename: NuLogic.dll

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000B8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 21-Aug-2018 15:35:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0006ABB0
0x0006B000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.88298
.data
0x0006C000
0x00000AA8
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0006D000
0x0000E850
0x0000F000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.79475

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.3424
812
Latin 1 / Western European
Spanish - Spain (International sort)
RT_VERSION
30001
2.94912
744
Latin 1 / Western European
UNKNOWN
RT_ICON
30002
3.0613
2216
Latin 1 / Western European
UNKNOWN
RT_ICON
IMAGE
7.98796
53248
Latin 1 / Western European
UNKNOWN
BANNER
MUSIC
7.88333
1940
Latin 1 / Western European
UNKNOWN
INTRO

Imports

MSVBVM60.DLL
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe no specs abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe wininit.exe no specs cmd.exe no specs wininit.exe

Process information

PID
CMD
Path
Indicators
Parent process
1476"C:\Users\admin\AppData\Local\Temp\abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe" C:\Users\admin\AppData\Local\Temp\abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exeexplorer.exe
User:
admin
Company:
Mahab Ghodss
Integrity Level:
MEDIUM
Description:
Mahab Ghodss
Exit code:
3221225547
Version:
2.01.0007
3984"C:\Users\admin\AppData\Local\Temp\abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe"C:\Users\admin\AppData\Local\Temp\abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe
abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe
User:
admin
Company:
Mahab Ghodss
Integrity Level:
MEDIUM
Description:
Mahab Ghodss
Exit code:
0
Version:
2.01.0007
716C:\Users\admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exeC:\Users\admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exeabfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe
User:
admin
Company:
Mahab Ghodss
Integrity Level:
MEDIUM
Description:
Mahab Ghodss
Exit code:
3221225547
Version:
2.01.0007
3020cmd /c C:\Users\admin\AppData\Local\Temp\F019F121.cmdC:\Windows\system32\cmd.exeabfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2040"C:\Users\admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exe"C:\Users\admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exe
wininit.exe
User:
admin
Company:
Mahab Ghodss
Integrity Level:
MEDIUM
Description:
Mahab Ghodss
Exit code:
0
Version:
2.01.0007
Total events
236
Read events
215
Write events
19
Delete events
2

Modification events

(PID) Process:(1476) abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{1B887DBA-711A-4385-BE40-34D849804ACC}
Operation:delete keyName:
Value:
(PID) Process:(716) wininit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{06C990C5-7E71-47AF-9F99-FF53C295043B}
Operation:delete keyName:
Value:
(PID) Process:(2040) wininit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:wininit
Value:
C:\Users\admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exe
(PID) Process:(2040) wininit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wininit_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2040) wininit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wininit_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2040) wininit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wininit_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2040) wininit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wininit_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2040) wininit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wininit_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2040) wininit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wininit_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2040) wininit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wininit_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
2
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3984abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exeC:\Users\admin\AppData\Local\Temp\F019F121.cmdtext
MD5:2E49A8430B072E484C46499DB3056DE8
SHA256:CDE61343CF622BFC7EB3C8F1EF0CCE60328BDDB100C937D0C810D64B61EB2749
1476abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exeC:\Users\admin\AppData\Local\Temp\~DF587C901E05DDAB53.TMPbinary
MD5:62376FB3D380DD00F8E595A04579848B
SHA256:3AC537C85B5A6D361607556686839FE182493808208868C13274D046AA035351
716wininit.exeC:\Users\admin\AppData\Local\Temp\~DF4D85BC7132436B5C.TMPbinary
MD5:62376FB3D380DD00F8E595A04579848B
SHA256:3AC537C85B5A6D361607556686839FE182493808208868C13274D046AA035351
2040wininit.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.exeexecutable
MD5:F39E228CFDAF4ABC6C505DCFF60F8DC0
SHA256:ABFADB6686459F69A92EDE367A2713FC2A1289EBE0C8596964682E4334CEE553
3984abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exeC:\Users\admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exeexecutable
MD5:F39E228CFDAF4ABC6C505DCFF60F8DC0
SHA256:ABFADB6686459F69A92EDE367A2713FC2A1289EBE0C8596964682E4334CEE553
2040wininit.exeC:\Users\admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\Off.ctext
MD5:81051BCC2CF1BEDF378224B0A93E2877
SHA256:7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2040
wininit.exe
GET
404
208.68.162.229:80
http://coupondemo.dynamicinnovation.net/cgl-bin/gate.php
US
html
1.12 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2040
wininit.exe
208.68.162.229:80
coupondemo.dynamicinnovation.net
Monticello Networks, Inc.
US
malicious
2040
wininit.exe
2.23.106.83:80
www.microsoft.com
Akamai International B.V.
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 2.23.106.83
whitelisted
coupondemo.dynamicinnovation.net
  • 208.68.162.229
malicious

Threats

PID
Process
Class
Message
2040
wininit.exe
A Network Trojan was detected
ET TROJAN Generic gate[.].php GET with minimal headers
No debug info