File name:

flashplayer32pp_en_install.exe

Full analysis: https://app.any.run/tasks/a135ccd8-fe92-4e3f-ac61-4e6dc51deba6
Verdict: Malicious activity
Analysis date: December 05, 2022, 17:54:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5:

00D0E4CA05766C1087C0DF448410BBB7

SHA1:

0566FB563B7572C441D87C7C7D9F838589BAB338

SHA256:

ACC5E0EDEBC37AF8A334F7ED3F942D55F7FF9F855D1649239A358E0D5225C17C

SSDEEP:

24576:r/yNTHZRz6TjVI2UHMyCPm0dYosTOEHNAB1vdCibBh+ZN3vZC5JV31qGB4SgHPat:0yFIFsNddYogtA9dCiFytEDlqQgHPaCk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads Internet Explorer settings

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads the Internet Settings

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Checks Windows Trust Settings

      • flashplayer32pp_en_install.exe (PID: 2328)

    • Reads Microsoft Outlook installation path

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads security settings of Internet Explorer

      • flashplayer32pp_en_install.exe (PID: 1124)
      • flashplayer32pp_en_install.exe (PID: 2328)

    • Reads settings of System Certificates

      • flashplayer32pp_en_install.exe (PID: 1124)
      • flashplayer32pp_en_install.exe (PID: 2328)

    • Detected use of alternative data streams (AltDS)

      • flashplayer32pp_en_install.exe (PID: 1124)

  • INFO

    • Reads the computer name

      • flashplayer32pp_en_install.exe (PID: 1124)
      • flashplayer32pp_en_install.exe (PID: 2328)

    • Creates a file in a temporary directory

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Checks proxy server information

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Checks supported languages

      • flashplayer32pp_en_install.exe (PID: 2328)
      • flashplayer32pp_en_install.exe (PID: 1124)

    • Application launched itself

      • iexplore.exe (PID: 892)

    • Starts Internet Explorer

      • flashplayer32pp_en_install.exe (PID: 1124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (v2.x) (54.1)
.exe | Win32 EXE PECompact compressed (generic) (38)
.exe | Win32 Executable (generic) (4.1)
.exe | Generic Win/DOS Executable (1.8)
.exe | DOS Executable Generic (1.8)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-May-06 13:09:35
Detected languages:
  • English - United States
CompanyName: Adobe Inc
FileDescription: Adobe Download Manager
FileVersion: 2.0.0.589s
InternalName: Adobe Download Manager
LegalCopyright: Copyright 2019 Adobe Inc. All rights reserved.
OriginalFilename: Adobe Download Manager
ProductName: Adobe Download Manager
ProductVersion: 2.0.0.589s

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 296

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2021-May-06 13:09:35
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
4767744
1193984
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99983
.rsrc
4771840
49152
47616
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.84495
.reloc
4820992
512
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.216207

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.55395
3752
Latin 1 / Western European
English - United States
RT_ICON
2
3.09028
2216
Latin 1 / Western European
English - United States
RT_ICON
3
2.05167
1384
Latin 1 / Western European
English - United States
RT_ICON
4
7.89204
10847
Latin 1 / Western European
English - United States
RT_ICON
5
3.43985
9640
Latin 1 / Western European
English - United States
RT_ICON
6
3.58326
4264
Latin 1 / Western European
English - United States
RT_ICON
7
4.01266
1128
Latin 1 / Western European
English - United States
RT_ICON
8
0
308
Latin 1 / Western European
English - United States
RT_CURSOR
9
0
180
Latin 1 / Western European
English - United States
RT_CURSOR
10
0
308
Latin 1 / Western European
English - United States
RT_CURSOR

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
gdiplus.dll
kernel32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start flashplayer32pp_en_install.exe flashplayer32pp_en_install.exe iexplore.exe explorer.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
892"C:\Program Files\Internet Explorer\iexplore.exe" https://get.adobe.com/flashplayer/C:\Program Files\Internet Explorer\iexplore.exe
flashplayer32pp_en_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
968"C:\Windows\explorer.exe"C:\Windows\explorer.exe—flashplayer32pp_en_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
1124"C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe" C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe
Explorer.EXE
User:
admin
Company:
Adobe Inc
Integrity Level:
MEDIUM
Description:
Adobe Download Manager
Exit code:
0
Version:
2.0.0.589s
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\flashplayer32pp_en_install.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2328"C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe" --pipename={C4E7A31B-937F-4F48-BA46-05B6B61CC159} --pid=1124C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe
flashplayer32pp_en_install.exe
User:
admin
Company:
Adobe Inc
Integrity Level:
HIGH
Description:
Adobe Download Manager
Exit code:
0
Version:
2.0.0.589s
Modules
Images
c:\users\admin\appdata\local\temp\flashplayer32pp_en_install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
2392"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:892 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
19 962
Read events
19 808
Write events
154
Delete events
0

Modification events

(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2328) flashplayer32pp_en_install.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(892) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
Executable files
0
Suspicious files
16
Text files
105
Unknown types
17

Dropped files

PID
Process
Filename
Type
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_x_200.pngimage
MD5:8E680B8EF37CFFCE4A9CD767D343A175
SHA256:6B9CAE182EC085BD8CC7D52DE0FD175CE7CB0186119C8E6E85230FCF9D10E318
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_x_125.pngimage
MD5:B33C312C95B36E4A3B0F4984B9FE09F2
SHA256:BA0D355243271CB79F5E3EAA3BCAA8BF9169C2E5B0B8E98C6E8418CF6F15AB9D
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\progressbar_blue_active_150.pngimage
MD5:A78E3DD64D86A9B46CCDFF105793DCE6
SHA256:151DBC44177A314FB720ED909EAD366760B69C69DAF676FEA52248AC7AD71D9A
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_check_125.pngimage
MD5:CD14309BBB8F5AD698E3196BBFCA88B6
SHA256:CF9AF9956E356D637E43A0B82C9328B13764ECD0BB3E3686A08AA2C2640A6C8B
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_caution_125.pngimage
MD5:4A2BF8C96F910B1B2AE63A9F4A0D4B8F
SHA256:0CB2F4EE1C451A8825EB8EDB45858B28345F73423C7A7AEF4168C46F7E3638BF
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_x_150.pngimage
MD5:5CC222F110ED5839F910FBBA15F35368
SHA256:EEE6E710161A3AA8488FB4C1F118B43FA5C377ECDEDFFAAE78A81865F16CF288
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\progressbar_darkgray_base_200.pngimage
MD5:CD614F26DD67507EF8C17E5A3133A45E
SHA256:30558D6E8D8F862D10D1DF81DBB6C54503F3ADE7DD134DC2CE1E3F0AC9C4D0BC
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_check_100.pngimage
MD5:74172250EC6AA49412189DBC0C1ED6E2
SHA256:B7771AC44AB547A772787C6DB58AFCAB0E603E8F9127F3A486A7792EE3E04A90
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\progressbar_darkgray_base_100.pngimage
MD5:E60583E0C49F0D046D2CFEF1179A8390
SHA256:E90F2CD8CA1D0FEB9A8C73908CA021B085816A9F469C4B4CA07C12F1996C7A59
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\progressbar_blue_active_125.pngimage
MD5:5E3F8861E897F1D865A1DCA095AFB15A
SHA256:A2C424618DE66C97F91833FE2EDB4BB05E03561E60AC40405771D2DEBB8CCB41
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
53
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEA95Ok0GmrFdC8AJhrPYb3E%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAluWvAdxhD7DNM77mH2T5w%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2392
iexplore.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e8e760c5bb646f60
US
compressed
4.70 Kb
whitelisted
2392
iexplore.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?26e7cf4e3ecd803e
US
compressed
4.70 Kb
whitelisted
892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAgc6MqDgv0wV8eDxz8g8WU%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1124
flashplayer32pp_en_install.exe
2.18.233.74:443
dlmping2.adobe.com
AKAMAI-AS
DE
whitelisted
1124
flashplayer32pp_en_install.exe
23.36.163.233:443
get.adobe.com
Akamai International B.V.
DE
suspicious
2392
iexplore.exe
23.36.163.233:443
get.adobe.com
Akamai International B.V.
DE
suspicious
2392
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2392
iexplore.exe
23.48.23.178:443
www.adobe.com
Akamai International B.V.
DE
unknown
2392
iexplore.exe
2.18.232.23:443
assets.adobedtm.com
AKAMAI-AS
DE
whitelisted
2392
iexplore.exe
23.48.23.163:443
cc-prod.scene7.com
Akamai International B.V.
DE
unknown
2392
iexplore.exe
15.236.176.210:443
sstats.adobe.com
AMAZON-02
FR
suspicious
892
iexplore.exe
131.253.33.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
892
iexplore.exe
23.48.23.178:443
www.adobe.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
get.adobe.com
  • 23.36.163.233
  • 23.36.163.225
whitelisted
dlmping2.adobe.com
  • 2.18.233.74
whitelisted
ctldl.windowsupdate.com
  • 8.253.204.120
  • 8.241.121.254
  • 8.248.145.254
  • 8.241.121.126
  • 8.248.133.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.adobe.com
  • 23.48.23.178
  • 23.48.23.151
whitelisted
use.typekit.net
  • 184.24.77.156
  • 184.24.77.144
whitelisted
auth.services.adobe.com
  • 108.156.60.4
  • 108.156.60.120
  • 108.156.60.12
  • 108.156.60.63
whitelisted
assets.adobedtm.com
  • 2.18.232.23
whitelisted
dpm.demdex.net
  • 52.16.234.218
  • 52.30.252.118
  • 34.247.60.250
  • 54.217.130.182
  • 34.243.172.78
  • 34.248.89.83
  • 54.228.74.230
  • 54.170.10.162
whitelisted
s.go-mpulse.net
  • 104.111.214.229
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
flashplayer32pp_en_install.exe