File name:

flashplayer32pp_en_install.exe

Full analysis: https://app.any.run/tasks/a135ccd8-fe92-4e3f-ac61-4e6dc51deba6
Verdict: Malicious activity
Analysis date: December 05, 2022, 17:54:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5:

00D0E4CA05766C1087C0DF448410BBB7

SHA1:

0566FB563B7572C441D87C7C7D9F838589BAB338

SHA256:

ACC5E0EDEBC37AF8A334F7ED3F942D55F7FF9F855D1649239A358E0D5225C17C

SSDEEP:

24576:r/yNTHZRz6TjVI2UHMyCPm0dYosTOEHNAB1vdCibBh+ZN3vZC5JV31qGB4SgHPat:0yFIFsNddYogtA9dCiFytEDlqQgHPaCk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads Microsoft Outlook installation path

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads security settings of Internet Explorer

      • flashplayer32pp_en_install.exe (PID: 1124)
      • flashplayer32pp_en_install.exe (PID: 2328)

    • Application launched itself

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Checks Windows Trust Settings

      • flashplayer32pp_en_install.exe (PID: 2328)

    • Reads settings of System Certificates

      • flashplayer32pp_en_install.exe (PID: 2328)
      • flashplayer32pp_en_install.exe (PID: 1124)

    • Detected use of alternative data streams (AltDS)

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads Internet Explorer settings

      • flashplayer32pp_en_install.exe (PID: 1124)

  • INFO

    • Checks proxy server information

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Creates a file in a temporary directory

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Reads the computer name

      • flashplayer32pp_en_install.exe (PID: 1124)
      • flashplayer32pp_en_install.exe (PID: 2328)

    • Checks supported languages

      • flashplayer32pp_en_install.exe (PID: 1124)
      • flashplayer32pp_en_install.exe (PID: 2328)

    • Starts Internet Explorer

      • flashplayer32pp_en_install.exe (PID: 1124)

    • Application launched itself

      • iexplore.exe (PID: 892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (v2.x) (54.1)
.exe | Win32 EXE PECompact compressed (generic) (38)
.exe | Win32 Executable (generic) (4.1)
.exe | Generic Win/DOS Executable (1.8)
.exe | DOS Executable Generic (1.8)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-May-06 13:09:35
Detected languages:
  • English - United States
CompanyName: Adobe Inc
FileDescription: Adobe Download Manager
FileVersion: 2.0.0.589s
InternalName: Adobe Download Manager
LegalCopyright: Copyright 2019 Adobe Inc. All rights reserved.
OriginalFilename: Adobe Download Manager
ProductName: Adobe Download Manager
ProductVersion: 2.0.0.589s

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: 0
e_cparhdr: 4
e_minalloc: 0
e_maxalloc: 65535
e_ss: 0
e_sp: 184
e_csum: 0
e_ip: 0
e_cs: 0
e_ovno: 0
e_oemid: 0
e_oeminfo: 0
e_lfanew: 296

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2021-May-06 13:09:35
PointerToSymbolTable: 0
NumberOfSymbols: 0
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
4767744
1193984
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99983
.rsrc
4771840
49152
47616
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.84495
.reloc
4820992
512
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.216207

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.55395
3752
Latin 1 / Western European
English - United States
RT_ICON
2
3.09028
2216
Latin 1 / Western European
English - United States
RT_ICON
3
2.05167
1384
Latin 1 / Western European
English - United States
RT_ICON
4
7.89204
10847
Latin 1 / Western European
English - United States
RT_ICON
5
3.43985
9640
Latin 1 / Western European
English - United States
RT_ICON
6
3.58326
4264
Latin 1 / Western European
English - United States
RT_ICON
7
4.01266
1128
Latin 1 / Western European
English - United States
RT_ICON
8
0
308
Latin 1 / Western European
English - United States
RT_CURSOR
9
0
180
Latin 1 / Western European
English - United States
RT_CURSOR
10
0
308
Latin 1 / Western European
English - United States
RT_CURSOR

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
gdiplus.dll
kernel32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start flashplayer32pp_en_install.exe flashplayer32pp_en_install.exe iexplore.exe explorer.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1124"C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe" C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe
Explorer.EXE
User:
admin
Company:
Adobe Inc
Integrity Level:
MEDIUM
Description:
Adobe Download Manager
Exit code:
0
Version:
2.0.0.589s
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\flashplayer32pp_en_install.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2328"C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe" --pipename={C4E7A31B-937F-4F48-BA46-05B6B61CC159} --pid=1124C:\Users\admin\AppData\Local\Temp\flashplayer32pp_en_install.exe
flashplayer32pp_en_install.exe
User:
admin
Company:
Adobe Inc
Integrity Level:
HIGH
Description:
Adobe Download Manager
Exit code:
0
Version:
2.0.0.589s
Modules
Images
c:\users\admin\appdata\local\temp\flashplayer32pp_en_install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
892"C:\Program Files\Internet Explorer\iexplore.exe" https://get.adobe.com/flashplayer/C:\Program Files\Internet Explorer\iexplore.exe
flashplayer32pp_en_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
968"C:\Windows\explorer.exe"C:\Windows\explorer.exe—flashplayer32pp_en_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
2392"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:892 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
19 962
Read events
19 808
Write events
154
Delete events
0

Modification events

(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2328) flashplayer32pp_en_install.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1124) flashplayer32pp_en_install.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(892) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
Executable files
0
Suspicious files
16
Text files
105
Unknown types
17

Dropped files

PID
Process
Filename
Type
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_check_100.pngimage
MD5:74172250EC6AA49412189DBC0C1ED6E2
SHA256:B7771AC44AB547A772787C6DB58AFCAB0E603E8F9127F3A486A7792EE3E04A90
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_caution_200.pngimage
MD5:3683A511B9DBA974CD9F36A6B023E423
SHA256:210F1B214ECCDE9E148072A10FC0E263FE6A443341BE4DC9630C47BC84796101
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Temp\Adobe_ADMLogs\Adobe_ADM.logtext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_x_200.pngimage
MD5:8E680B8EF37CFFCE4A9CD767D343A175
SHA256:6B9CAE182EC085BD8CC7D52DE0FD175CE7CB0186119C8E6E85230FCF9D10E318
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_check_200.pngimage
MD5:1B00A6BCC425DBD0ACB92E3664488B0D
SHA256:48BEE3671DED91AEE651F5CAC0CBEFD83D760F02EFD376F77364C238F1B14389
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_caution_125.pngimage
MD5:4A2BF8C96F910B1B2AE63A9F4A0D4B8F
SHA256:0CB2F4EE1C451A8825EB8EDB45858B28345F73423C7A7AEF4168C46F7E3638BF
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_caution_150.pngimage
MD5:CA3872EAE64C5BFD8D41198990B11950
SHA256:3438623C461F8F141976A931D3C00F6877D07CF4A8B534AF1EF9FDFE8B0C6174
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_x_150.pngimage
MD5:5CC222F110ED5839F910FBBA15F35368
SHA256:EEE6E710161A3AA8488FB4C1F118B43FA5C377ECDEDFFAAE78A81865F16CF288
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_x_100.pngimage
MD5:BD94C635B00CC2EA4872591AE3DAC517
SHA256:AACA1B27A5186DF31E60AB0BCFE35D411E03FD7CD069FAFB92314947FD92F256
1124flashplayer32pp_en_install.exeC:\Users\admin\AppData\Local\Adobe\20112625-0B3C-45B0-A9C9-7294B120583B\status_icon_x_125.pngimage
MD5:B33C312C95B36E4A3B0F4984B9FE09F2
SHA256:BA0D355243271CB79F5E3EAA3BCAA8BF9169C2E5B0B8E98C6E8418CF6F15AB9D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
53
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2392
iexplore.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e8e760c5bb646f60
US
compressed
4.70 Kb
whitelisted
2392
iexplore.exe
GET
200
8.253.204.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?26e7cf4e3ecd803e
US
compressed
4.70 Kb
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEA95Ok0GmrFdC8AJhrPYb3E%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAgc6MqDgv0wV8eDxz8g8WU%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAluWvAdxhD7DNM77mH2T5w%3D
US
der
471 b
whitelisted
892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2392
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
1124
flashplayer32pp_en_install.exe
2.18.233.74:443
dlmping2.adobe.com
AKAMAI-AS
DE
whitelisted
2392
iexplore.exe
8.253.204.120:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
1124
flashplayer32pp_en_install.exe
23.36.163.233:443
get.adobe.com
Akamai International B.V.
DE
suspicious
2392
iexplore.exe
23.36.163.233:443
get.adobe.com
Akamai International B.V.
DE
suspicious
2392
iexplore.exe
23.48.23.178:443
www.adobe.com
Akamai International B.V.
DE
unknown
2392
iexplore.exe
2.18.232.23:443
assets.adobedtm.com
AKAMAI-AS
DE
whitelisted
2392
iexplore.exe
108.156.60.4:443
auth.services.adobe.com
AMAZON-02
US
unknown
2392
iexplore.exe
184.24.77.156:443
use.typekit.net
Akamai International B.V.
DE
suspicious
2392
iexplore.exe
104.111.214.229:443
s.go-mpulse.net
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
get.adobe.com
  • 23.36.163.233
  • 23.36.163.225
whitelisted
dlmping2.adobe.com
  • 2.18.233.74
whitelisted
ctldl.windowsupdate.com
  • 8.253.204.120
  • 8.241.121.254
  • 8.248.145.254
  • 8.241.121.126
  • 8.248.133.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.adobe.com
  • 23.48.23.178
  • 23.48.23.151
whitelisted
use.typekit.net
  • 184.24.77.156
  • 184.24.77.144
whitelisted
auth.services.adobe.com
  • 108.156.60.4
  • 108.156.60.120
  • 108.156.60.12
  • 108.156.60.63
whitelisted
assets.adobedtm.com
  • 2.18.232.23
whitelisted
dpm.demdex.net
  • 52.16.234.218
  • 52.30.252.118
  • 34.247.60.250
  • 54.217.130.182
  • 34.243.172.78
  • 34.248.89.83
  • 54.228.74.230
  • 54.170.10.162
whitelisted
s.go-mpulse.net
  • 104.111.214.229
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2023 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
flashplayer32pp_en_install.exe