analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

flashplayer32pp_en_install.exe

Full analysis: https://app.any.run/tasks/a135ccd8-fe92-4e3f-ac61-4e6dc51deba6
Verdict: Malicious activity
Analysis date: December 05, 2022, 17:54:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5:

00D0E4CA05766C1087C0DF448410BBB7

SHA1:

0566FB563B7572C441D87C7C7D9F838589BAB338

SHA256:

ACC5E0EDEBC37AF8A334F7ED3F942D55F7FF9F855D1649239A358E0D5225C17C

SSDEEP:

24576:r/yNTHZRz6TjVI2UHMyCPm0dYosTOEHNAB1vdCibBh+ZN3vZC5JV31qGB4SgHPat:0yFIFsNddYogtA9dCiFytEDlqQgHPaCk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Application launched itself

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads security settings of Internet Explorer

      • flashplayer32pp_en_install.exe (PID: 1124)
      • flashplayer32pp_en_install.exe (PID: 2328)

    • Reads Microsoft Outlook installation path

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads Internet Explorer settings

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Checks Windows Trust Settings

      • flashplayer32pp_en_install.exe (PID: 2328)

    • Detected use of alternative data streams (AltDS)

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads settings of System Certificates

      • flashplayer32pp_en_install.exe (PID: 2328)
      • flashplayer32pp_en_install.exe (PID: 1124)

  • INFO

    • Checks supported languages

      • flashplayer32pp_en_install.exe (PID: 1124)
      • flashplayer32pp_en_install.exe (PID: 2328)

    • Reads the computer name

      • flashplayer32pp_en_install.exe (PID: 1124)
      • flashplayer32pp_en_install.exe (PID: 2328)

    • Creates a file in a temporary directory

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Checks proxy server information

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Starts Internet Explorer

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Application launched itself

      • iexplore.exe (PID: 892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (v2.x) (54.1)
.exe | Win32 EXE PECompact compressed (generic) (38)
.exe | Win32 Executable (generic) (4.1)
.exe | Generic Win/DOS Executable (1.8)
.exe | DOS Executable Generic (1.8)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-May-06 13:09:35
Detected languages:
  • English - United States
CompanyName: Adobe Inc
FileDescription: Adobe Download Manager
FileVersion: 2.0.0.589s
InternalName: Adobe Download Manager
LegalCopyright: Copyright 2019 Adobe Inc. All rights reserved.
OriginalFilename: Adobe Download Manager
ProductName: Adobe Download Manager
ProductVersion: 2.0.0.589s

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 296

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2021-May-06 13:09:35
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
4767744
1193984
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99983
.rsrc
4771840
49152
47616
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.84495
.reloc
4820992
512
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.216207

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.55395
3752
Latin 1 / Western European
English - United States
RT_ICON
2
3.09028
2216
Latin 1 / Western European
English - United States
RT_ICON
3
2.05167
1384
Latin 1 / Western European
English - United States
RT_ICON
4
7.89204
10847
Latin 1 / Western European
English - United States
RT_ICON
5
3.43985
9640
Latin 1 / Western European
English - United States
RT_ICON
6
3.58326
4264
Latin 1 / Western European
English - United States
RT_ICON
7
4.01266
1128
Latin 1 / Western European
English - United States
RT_ICON
8
0
308
Latin 1 / Western European
English - United States
RT_CURSOR
9
0
180
Latin 1 / Western European
English - United States
RT_CURSOR
10
0
308
Latin 1 / Western European
English - United States
RT_CURSOR

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
gdiplus.dll
kernel32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start flashplayer32pp_en_install.exe flashplayer32pp_en_install.exe iexplore.exe explorer.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1124"C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe" C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe
Explorer.EXE
User:
admin
Company:
Adobe Inc
Integrity Level:
MEDIUM
Description:
Adobe Download Manager
Exit code:
0
Version:
2.0.0.589s
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\flashplayer32pp_en_install.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2328"C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe" --pipename={C4E7A31B-937F-4F48-BA46-05B6B61CC159} --pid=1124C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe
flashplayer32pp_en_install.exe
User:
admin
Company:
Adobe Inc
Integrity Level:
HIGH
Description:
Adobe Download Manager
Exit code:
0
Version:
2.0.0.589s
Modules
Images
c:\users\admin\appdata\local\temp\flashplayer32pp_en_install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
892"C:\Program Files\Internet Explorer\iexplore.exe" https://get.adobe.com/flashplayer/C:\Program Files\Internet Explorer\iexplore.exe
flashplayer32pp_en_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
968"C:\Windows\explorer.exe"C:\Windows\explorer.exe—flashplayer32pp_en_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
2392"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:892 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
19 962
Read events
19 808
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
16
Text files
105
Unknown types
17

Dropped files

PID
Process
Filename
Type
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\progressbar_darkgray_base_200.pngimage
MD5:CD614F26DD67507EF8C17E5A3133A45E
SHA256:30558D6E8D8F862D10D1DF81DBB6C54503F3ADE7DD134DC2CE1E3F0AC9C4D0BC
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_x_200.pngimage
MD5:8E680B8EF37CFFCE4A9CD767D343A175
SHA256:6B9CAE182EC085BD8CC7D52DE0FD175CE7CB0186119C8E6E85230FCF9D10E318
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_caution_125.pngimage
MD5:4A2BF8C96F910B1B2AE63A9F4A0D4B8F
SHA256:0CB2F4EE1C451A8825EB8EDB45858B28345F73423C7A7AEF4168C46F7E3638BF
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\progressbar_blue_active_200.pngimage
MD5:0F78C8C46DAD3F68D060B406AA0BBF1F
SHA256:C08F7720960B2E21B1F8F106D80BCB1AF7C11433E3B35D7AE2994254A2A2583C
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\progressbar_blue_active_100.pngimage
MD5:BB94A177F10BF764D11F94D24A5DB5AA
SHA256:CAAFEA31074BA909EC57C9DCDD1B1C0256E5626939CC768B8A041FE42762E230
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_x_100.pngimage
MD5:BD94C635B00CC2EA4872591AE3DAC517
SHA256:AACA1B27A5186DF31E60AB0BCFE35D411E03FD7CD069FAFB92314947FD92F256
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\warning_icon_200.pngimage
MD5:7395444416AB7A3D5A196E2F46269AFF
SHA256:59BC5272A4A2940EF7AAD07C960200135DD9909B3150C3322F0E62C1E40709B6
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_caution_200.pngimage
MD5:3683A511B9DBA974CD9F36A6B023E423
SHA256:210F1B214ECCDE9E148072A10FC0E263FE6A443341BE4DC9630C47BC84796101
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_check_200.pngimage
MD5:1B00A6BCC425DBD0ACB92E3664488B0D
SHA256:48BEE3671DED91AEE651F5CAC0CBEFD83D760F02EFD376F77364C238F1B14389
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\progressbar_blue_active_125.pngimage
MD5:5E3F8861E897F1D865A1DCA095AFB15A
SHA256:A2C424618DE66C97F91833FE2EDB4BB05E03561E60AC40405771D2DEBB8CCB41
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
53
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAluWvAdxhD7DNM77mH2T5w%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAgc6MqDgv0wV8eDxz8g8WU%3D
US
der
471 b
whitelisted
892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEA95Ok0GmrFdC8AJhrPYb3E%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?26e7cf4e3ecd803e
US
compressed
4.70 Kb
whitelisted
2392
iexplore.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e8e760c5bb646f60
US
compressed
4.70 Kb
whitelisted
892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2392
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2392
iexplore.exe
8.253.204.120:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
1124
flashplayer32pp_en_install.exe
23.36.163.233:443
get.adobe.com
Akamai International B.V.
DE
suspicious
2392
iexplore.exe
2.18.232.23:443
assets.adobedtm.com
AKAMAI-AS
DE
whitelisted
1124
flashplayer32pp_en_install.exe
2.18.233.74:443
dlmping2.adobe.com
AKAMAI-AS
DE
whitelisted
2392
iexplore.exe
184.24.77.156:443
use.typekit.net
Akamai International B.V.
DE
suspicious
2392
iexplore.exe
23.48.23.178:443
www.adobe.com
Akamai International B.V.
DE
unknown
2392
iexplore.exe
108.156.60.4:443
auth.services.adobe.com
AMAZON-02
US
unknown
2392
iexplore.exe
23.36.163.233:443
get.adobe.com
Akamai International B.V.
DE
suspicious
892
iexplore.exe
23.48.23.178:443
www.adobe.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
get.adobe.com
  • 23.36.163.233
  • 23.36.163.225
whitelisted
dlmping2.adobe.com
  • 2.18.233.74
whitelisted
ctldl.windowsupdate.com
  • 8.253.204.120
  • 8.241.121.254
  • 8.248.145.254
  • 8.241.121.126
  • 8.248.133.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.adobe.com
  • 23.48.23.178
  • 23.48.23.151
whitelisted
use.typekit.net
  • 184.24.77.156
  • 184.24.77.144
whitelisted
auth.services.adobe.com
  • 108.156.60.4
  • 108.156.60.120
  • 108.156.60.12
  • 108.156.60.63
whitelisted
assets.adobedtm.com
  • 2.18.232.23
whitelisted
dpm.demdex.net
  • 52.16.234.218
  • 52.30.252.118
  • 34.247.60.250
  • 54.217.130.182
  • 34.243.172.78
  • 34.248.89.83
  • 54.228.74.230
  • 54.170.10.162
whitelisted
s.go-mpulse.net
  • 104.111.214.229
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
flashplayer32pp_en_install.exe