File name:

affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9

Full analysis: https://app.any.run/tasks/5cfd373b-dfc9-4214-a156-e8c19115f5b7
Verdict: No threats detected
Analysis date: May 27, 2020, 16:07:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

30A4550534AD7A323DF72D6C7FDDA7A9

SHA1:

BA974593639A9EF65FCB20DE97865F6620DF86CE

SHA256:

AFFB0FAE00F361262726A72B3C26FD18BAAFEC03D0C091DE4DE0430345B390C9

SSDEEP:

24576:Q9Awk12zeY2BPg7/qal6qepY4cJkxIVC27PJN:QVkgeY2duSTtK0Kd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads internet explorer settings

      • affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exe (PID: 3628)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:08:31 17:37:06+02:00
PEType: PE32
LinkerVersion: 8
CodeSize: 283648
InitializedDataSize: 6656
UninitializedDataSize: -
EntryPoint: 0x2ae000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.5.3
ProductVersionNumber: 1.0.5.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Alabama Board of Nursing ID-E Transfer Utility
CompanyName: Ravensware, LLC
FileDescription: ABN
FileVersion: 1.0.5.3
InternalName: ABN.exe
LegalCopyright: Copyright © 2010, 2011 Ravensware LLC. Warning, This computer program is protected by copyright law and international treaties. Unauthorized reproduction or distribution of this program, or any portion of it, may result in severe civil and criminal penalties, and will be prosecuted to the maximum extend possible under law. All Rights Reserved.
LegalTrademarks: GuardScan™, Ravensware TM
OriginalFileName: ABN.exe
ProductName: ABN
ProductVersion: 1.0.5.3
AssemblyVersion: 1.0.5.3

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 31-Aug-2011 15:37:06
Comments: Alabama Board of Nursing ID-E Transfer Utility
CompanyName: Ravensware, LLC
FileDescription: ABN
FileVersion: 1.0.5.3
InternalName: ABN.exe
LegalCopyright: Copyright © 2010, 2011 Ravensware LLC. Warning, This computer program is protected by copyright law and international treaties. Unauthorized reproduction or distribution of this program, or any portion of it, may result in severe civil and criminal penalties, and will be prosecuted to the maximum extend possible under law. All Rights Reserved.
LegalTrademarks: GuardScan™, Ravensware TM
OriginalFilename: ABN.exe
ProductName: ABN
ProductVersion: 1.0.5.3
Assembly Version: 1.0.5.3

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x867A
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 31-Aug-2011 15:37:06
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
0x00002000
0x00048000
0x0001D400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.98005
.rsrc
0x0004A000
0x000014F0
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.85297
.idata
0x0004C000
0x00002000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.2888
0x0004E000
0x00150000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.240445
vzlgaogk
0x0019E000
0x00110000
0x0010F800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.91043
iikhvcfa
0x002AE000
0x00002000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.18597

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.9028
1235
UNKNOWN
UNKNOWN
RT_MANIFEST
2
3.89896
2216
UNKNOWN
UNKNOWN
RT_ICON
32512
1.9815
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

comctl32.dll
kernel32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exe

Process information

PID
CMD
Path
Indicators
Parent process
3628"C:\Users\admin\AppData\Local\Temp\affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exe" C:\Users\admin\AppData\Local\Temp\affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exe
explorer.exe
User:
admin
Company:
Ravensware, LLC
Integrity Level:
MEDIUM
Description:
ABN
Exit code:
0
Version:
1.0.5.3
Modules
Images
c:\users\admin\appdata\local\temp\affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
100
Read events
93
Write events
7
Delete events
0

Modification events

(PID) Process:(3628) affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3628) affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3628) affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3628) affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3628) affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3628affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exeC:\Users\admin\AppData\Local\Temp\ABN.Logtext
MD5:—
SHA256:—
3628affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exeC:\Users\admin\AppData\Local\Temp\ABNLicenseAgreement.htmhtml
MD5:40D73E379388F4DB2149AABFAA901004
SHA256:A6D0F118EF1A35A3F1280A65DB9CDCA742CCA230A88DD23431BB444CEB47993B
3628affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exeC:\Users\admin\AppData\Local\Temp\ABN.CFGtext
MD5:47BE308E4431C970AD3CC3D40DB006FE
SHA256:003571CCF8F19B741AECEB691AD06F8930289C85833904EB45A79DAF2A15829C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9.exe
%s------------------------------------------------ --- WinLicense Professional --- --- (c)2010 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
affb0fae00f361262726a72b3c26fd18baafec03d0c091de4de0430345b390c9