File name: | SCP_087_B_setup.exe |
Full analysis: | https://app.any.run/tasks/b0cb6edf-8ef6-4056-ba01-d50964684763 |
Verdict: | Malicious activity |
Analysis date: | February 18, 2019, 17:46:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | D1F37704EBA9452C4A4732D42D30222D |
SHA1: | B26C3B1A43F27DD4F86D123EAA23DD282E019F1B |
SHA256: | B2312FBB61551C5B57F5F2C7E690749BE9D8C26C0EBF2FEA37DA7ED82448A759 |
SSDEEP: | 49152:DsFlsws9pQLqUKdpsbA+yQnkhNtkKJV4t0jasESIPr+K8MxsU3joxtzS5:usb/Q43unaDhjaK0SK8XRS5 |
.exe | | | NSIS - Nullsoft Scriptable Install System (94.8) |
---|---|---|
.exe | | | Win32 Executable MS Visual C++ (generic) (3.4) |
.dll | | | Win32 Dynamic Link Library (generic) (0.7) |
.exe | | | Win32 Executable (generic) (0.5) |
.exe | | | Generic Win/DOS Executable (0.2) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 4 |
ImageVersion: | 6.1 |
OSVersion: | 4 |
EntryPoint: | 0x30cb |
UninitializedDataSize: | 1024 |
InitializedDataSize: | 119808 |
CodeSize: | 23040 |
LinkerVersion: | 6 |
PEType: | PE32 |
TimeStamp: | 2009:06:06 23:41:48+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 06-Jun-2009 21:41:48 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000D8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 06-Jun-2009 21:41:48 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000058D2 | 0x00005A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.4331 |
.rdata | 0x00007000 | 0x00001190 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.17976 |
.data | 0x00009000 | 0x0001AF78 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.6178 |
.ndata | 0x00024000 | 0x00012000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00036000 | 0x00004950 | 0x00004A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.97443 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.10609 | 533 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 0 | 3752 | UNKNOWN | English - United States | RT_ICON |
3 | 0 | 2216 | UNKNOWN | English - United States | RT_ICON |
4 | 0 | 1384 | UNKNOWN | English - United States | RT_ICON |
5 | 0 | 1128 | UNKNOWN | English - United States | RT_ICON |
6 | 0 | 744 | UNKNOWN | English - United States | RT_ICON |
7 | 0 | 296 | UNKNOWN | English - United States | RT_ICON |
103 | 3.02435 | 104 | UNKNOWN | English - United States | RT_GROUP_ICON |
104 | 2.70992 | 344 | UNKNOWN | English - United States | RT_DIALOG |
105 | 2.73893 | 514 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3168 | "C:\Users\admin\AppData\Local\Temp\SCP_087_B_setup.exe" | C:\Users\admin\AppData\Local\Temp\SCP_087_B_setup.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
3692 | "C:\Users\admin\AppData\Local\Temp\SCP_087_B_setup.exe" | C:\Users\admin\AppData\Local\Temp\SCP_087_B_setup.exe | explorer.exe | |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
2292 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3796 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2292 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
4052 | "C:\Games\SCP-087-B\SCP-087-B.exe" | C:\Games\SCP-087-B\SCP-087-B.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2392 | "C:\Games\SCP-087-B\SCP-087-B.exe" | C:\Games\SCP-087-B\SCP-087-B.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\behind.ogg | ogg | |
MD5:47B9CDFE0CF65C17A174D86F674408E8 | SHA256:A323BCCBBE7458A195077B93B12FBE5DA7EA6ADEDADF932643D9E6B8382411A6 | |||
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\door.jpg | image | |
MD5:A3BB3009FCEC5782A4215DA8A5A606EF | SHA256:6931A094C19DB18DFAE30EA9B567EB0A7340616082E40E2C5C823181FDBF4D1A | |||
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\ambient2.ogg | ogg | |
MD5:D9DCE25645152F61A3E2B1EFAEC40C39 | SHA256:4E9377C946B721CF6726D3313F2A3776DB5E24133CCA14A9E30C57264F5C3306 | |||
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\ambient1.ogg | ogg | |
MD5:BB4518CF3254891D12BA25C7393D5062 | SHA256:3F25C7123188CB547CAAB3EF672CB374BA68D26EC980C0FE505F910DA7A033D3 | |||
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\ambient4.ogg | ogg | |
MD5:967578D451B755CB635975B05152BE7C | SHA256:E55342782209374EAB4B872E4EAF34A099300A75B244BB8A8F2E737CA2EA5F0A | |||
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\609.ogg | ogg | |
MD5:712193F4F1FCC730EED99A31AA07AEBF | SHA256:AFF525DD6C7D51216BB6519D920F64F2BF6410776A0EFA0F7958570B2D1D4495 | |||
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\dontlook.ogg | ogg | |
MD5:65E0F290462180A62D3C4BB17A2E39F5 | SHA256:4F140E750E4FC9122D0551494DC7ACD86CF4CBBD227E5C76FB1A620B5B713AA1 | |||
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\horror2.ogg | ogg | |
MD5:E3AB3F5ABFA0DE6255F5F3D33324371D | SHA256:1ECD039496A106DE55594BFA7B8E0D6E678E590C2AFB87601F79C706E0041D0C | |||
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\death.ogg | ogg | |
MD5:1841FF3E5E6A9D9FA9B684C5E54ECA1D | SHA256:8F6B96B78EE79D28E2F7A00C1CC804C3594C95A3D2512A6BCAD5654DC2273B40 | |||
3692 | SCP_087_B_setup.exe | C:\Games\SCP-087-B\173.jpg | image | |
MD5:A93F722C7064675B7FBAA1B5D5D38FFB | SHA256:5EEA8BE929AE53E860FEB9B93B9A34E9A47FACADFCCF36A2D9D4A294FC0185AD |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3796 | iexplore.exe | GET | 301 | 62.112.9.123:80 | http://small-games.info/ | NL | html | 233 b | whitelisted |
2292 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2292 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3796 | iexplore.exe | 62.112.9.123:80 | small-games.info | WorldStream B.V. | NL | unknown |
3796 | iexplore.exe | 93.158.134.119:443 | mc.yandex.ru | YANDEX LLC | RU | whitelisted |
3796 | iexplore.exe | 216.58.207.54:443 | i.ytimg.com | Google Inc. | US | whitelisted |
3796 | iexplore.exe | 172.217.18.170:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
3796 | iexplore.exe | 62.112.9.123:443 | small-games.info | WorldStream B.V. | NL | unknown |
3796 | iexplore.exe | 185.172.149.132:443 | cdn4.iconfinder.com | proinity GmbH | DE | suspicious |
3796 | iexplore.exe | 172.217.22.46:443 | apis.google.com | Google Inc. | US | whitelisted |
3796 | iexplore.exe | 172.217.16.131:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
3796 | iexplore.exe | 88.212.201.207:443 | counter.yadro.ru | United Network LLC | RU | unknown |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
small-games.info |
| whitelisted |
ajax.googleapis.com |
| whitelisted |
cdn4.iconfinder.com |
| whitelisted |
i.ytimg.com |
| whitelisted |
mc.yandex.ru |
| whitelisted |
apis.google.com |
| whitelisted |
counter.yadro.ru |
| whitelisted |
ssl.google-analytics.com |
| whitelisted |
accounts.google.com |
| shared |