File name:

gimp-2.10.32-setup-x64.exe

Full analysis: https://app.any.run/tasks/e4656a78-81df-4302-9a9b-c6bfea1c3175
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 19, 2022, 10:01:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
trojan
stealer
vidar
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

389DE8DA4460E34C8D38E66FECC76B2F

SHA1:

42A064DA9BEA02B8939AEB0F33F581E27C4F3516

SHA256:

B47BF25DF7853A395D1D98680B19C9CFCA78EC7F58E3D577DB100E08701404AE

SSDEEP:

6144:VOdNnpCJdQC4cQBl5UAp98wuJrkpN2tMcUKmK2kfWeSN37Wp5SiaNQsuC6Yu2Jk6:VINn4cp98rjy0m6EWpMiaLubN2eb+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Steals credentials

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • VIDAR was detected

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Loads dropped or rewritten executable

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Steals credentials from Web Browsers

      • gimp-2.10.32-setup-x64.exe (PID: 124)

  • SUSPICIOUS

    • Reads the Internet Settings

      • gimp-2.10.32-setup-x64.exe (PID: 124)
      • DllHost.exe (PID: 1708)

    • Reads settings of System Certificates

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Connects to the server without a host name

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Reads security settings of Internet Explorer

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Checks Windows Trust Settings

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Executable content was dropped or overwritten

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Searches for installed software

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Starts CMD.EXE for commands execution

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 860)

    • Reads browser cookies

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Actions looks like stealing of personal data

      • gimp-2.10.32-setup-x64.exe (PID: 124)

  • INFO

    • Checks supported languages

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Reads the computer name

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Reads the machine GUID from the registry

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Checks proxy server information

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Creates files in the user directory

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Drops a file that was compiled in debug mode

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Creates files in the program directory

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Reads product name

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Reads the CPU's name

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Reads CPU info

      • gimp-2.10.32-setup-x64.exe (PID: 124)

    • Reads Environment values

      • gimp-2.10.32-setup-x64.exe (PID: 124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Dec-13 01:19:24
Detected languages:
  • English - United States
CompanyName: Microsoft Corporation
FileDescription: Visual Studio Installer
FileVersion: 17.2.32602.215
InternalName: vs_community.exe
OriginalFilename: vs_community.exe
ProductName: Microsoft Visual Studio Community
ProductVersion: Visual Studio 2022
LegalCopyright: © Microsoft Corporation. All rights reserved.

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 264

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 7
TimeDateStamp: 2022-Dec-13 01:19:24
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
47063
47104
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62894
.rdata
53248
22216
22528
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.8538
.data
77824
4592
2048
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.03715
.gfids
86016
172
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.42347
.rsrc
90112
1437
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.95138
.reloc
94208
3600
4096
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.17294
pGh3asS
98304
352256
349696
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.9992

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.44225
896
UNKNOWN
English - United States
RT_VERSION
1 (#2)
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST

Imports

KERNEL32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #VIDAR gimp-2.10.32-setup-x64.exe DllHost.exe no specs cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Users\admin\AppData\Local\Temp\gimp-2.10.32-setup-x64.exe" C:\Users\admin\AppData\Local\Temp\gimp-2.10.32-setup-x64.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Studio Installer
Exit code:
0
Version:
17.2.32602.215
Modules
Images
c:\users\admin\appdata\local\temp\gimp-2.10.32-setup-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
580timeout /t 6 C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
860"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "?" & exitC:\Windows\SysWOW64\cmd.exe—gimp-2.10.32-setup-x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1708C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 976
Read events
2 940
Write events
36
Delete events
0

Modification events

(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000008A000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(124) gimp-2.10.32-setup-x64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
12
Suspicious files
6
Text files
2
Unknown types
14

Dropped files

PID
Process
Filename
Type
1708DllHost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat —
MD5:—
SHA256:—
124gimp-2.10.32-setup-x64.exeC:\ProgramData\99360821509855131083979505 —
MD5:—
SHA256:—
124gimp-2.10.32-setup-x64.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\UYCWOHFI.txttext
MD5:—
SHA256:—
124gimp-2.10.32-setup-x64.exeC:\ProgramData\74897619466318457956167582-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1708DllHost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\V01.logbinary
MD5:3A3885632EA32D83AFBFC5E6DA977B48
SHA256:3473B52BAFA2240FDD5418FBCAE80681899305BAF96B1209CD92A5EE1B00018E
124gimp-2.10.32-setup-x64.exeC:\ProgramData\mozglue.dllexecutable
MD5:8F73C08A9660691143661BF7332C3C27
SHA256:3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
124gimp-2.10.32-setup-x64.exeC:\ProgramData\99360821509855131083979505-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
124gimp-2.10.32-setup-x64.exeC:\ProgramData\74897619466318457956167582sqlite
MD5:FF3819BA79CA33058AB110FEC5CD0955
SHA256:C5140A31EA483E1E6AFE2A2750B853FA46FA3C5B0A04C973094E23E6C8AD533E
124gimp-2.10.32-setup-x64.exeC:\ProgramData\99665786627014501646264873sqlite
MD5:8E7D9BEBB7841316E6FA57C462772955
SHA256:6D6A4E43498C970C7E6DA9D6322B7C5D507A53E934C050A4CE8DC82E36A6484A
124gimp-2.10.32-setup-x64.exeC:\ProgramData\85483275558165775068441355sqlite
MD5:C72DB02959D2F97D090B0051EE963AD7
SHA256:6D8285E102CD46A9379778B223651ECEE043321E436DD15C2354EC59F5EB22A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
2
DNS requests
1
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
124
gimp-2.10.32-setup-x64.exe
GET
200
95.216.207.27:80
http://95.216.207.27/update.zip
FI
compressed
3.47 Mb
malicious
124
gimp-2.10.32-setup-x64.exe
GET
200
95.216.207.27:80
http://95.216.207.27/1819
FI
text
221 b
malicious
124
gimp-2.10.32-setup-x64.exe
POST
200
95.216.207.27:80
http://95.216.207.27/
FI
text
2 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
124
gimp-2.10.32-setup-x64.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
malicious
124
gimp-2.10.32-setup-x64.exe
95.216.207.27:80
—
Hetzner Online GmbH
FI
malicious

DNS requests

Domain
IP
Reputation
t.me
  • 149.154.167.99
whitelisted

Threats

PID
Process
Class
Message
124
gimp-2.10.32-setup-x64.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host ZIP Request
124
gimp-2.10.32-setup-x64.exe
A Network Trojan was detected
ET TROJAN Arkei/Vidar/Mars Stealer Variant
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
gimp-2.10.32-setup-x64.exe