File name:

Mdac_typ.exe

Full analysis: https://app.any.run/tasks/b898db12-4e18-445d-9c9e-c7283a60c1a3
Verdict: Malicious activity
Analysis date: January 23, 2025, 22:43:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MS CAB-Installer self-extracting archive, 3 sections
MD5:

8556EDFCCE76C1BEC39599F301DF4237

SHA1:

C1E07FA16307DDA56CF12328501ED2B3074DD530

SHA256:

B4893E0FBAE52C19E0DA0CD699FCF6CE066C91B7C1C12E36095709A32E3AF6C0

SSDEEP:

196608:e/1b1yPsiKS6RlAjalFRZRVdkclZjamvU9YQsKt0k8x:gZdnS6cjaDjTKcvj1U9Jsq0jx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Mdac_typ.exe (PID: 6428)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Mdac_typ.exe (PID: 6428)

    • Starts a Microsoft application from unusual location

      • Mdac_typ.exe (PID: 6428)

    • Executable content was dropped or overwritten

      • Mdac_typ.exe (PID: 6428)

  • INFO

    • Checks supported languages

      • Mdac_typ.exe (PID: 6428)

    • The sample compiled with english language support

      • Mdac_typ.exe (PID: 6428)

    • Reads the computer name

      • Mdac_typ.exe (PID: 6428)

    • Create files in a temporary directory

      • Mdac_typ.exe (PID: 6428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 MS Cabinet Self-Extractor (WExtract stub) (81.3)
.exe | Win32 Executable MS Visual C++ (generic) (8.3)
.exe | Win64 Executable (generic) (7.4)
.exe | Win32 Executable (generic) (1.2)
.exe | Win16/32 Executable Delphi generic (0.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1998:03:11 01:39:29+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 36864
InitializedDataSize: 7807488
UninitializedDataSize: -
EntryPoint: 0x2749
OSVersion: 5
ImageVersion: 5
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 25.0.4403.12
ProductVersionNumber: 25.0.4403.12
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 2.50.4403.12
InternalName: Wextract
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1997
LegalTrademarks: -
OriginalFileName: WEXTRACT.EXE
PrivateBuild: -
ProductName: Microsoft(R) Windows NT(R) Operating System
ProductVersion: 2.50.4403.12
SpecialBuild: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mdac_typ.exe dasetup.exe no specs dasetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
6428"C:\Users\admin\AppData\Local\Temp\Mdac_typ.exe" C:\Users\admin\AppData\Local\Temp\Mdac_typ.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
2.50.4403.12
Modules
Images
c:\users\admin\appdata\local\temp\mdac_typ.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6472C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exe—Mdac_typ.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\dasetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6656C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exe
Mdac_typ.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\dasetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
46
Read events
44
Write events
1
Delete events
1

Modification events

(PID) Process:(6428) Mdac_typ.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:wextract_cleanup0
Value:
rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\"
(PID) Process:(6428) Mdac_typ.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:wextract_cleanup0
Value:
Executable files
9
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\mdacone.cab —
MD5:—
SHA256:—
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\cfgmgr32.dllexecutable
MD5:954E9D34AA3CECAD72ECE6F85DB280AC
SHA256:186C804BC1260AEFACB951EF394BB5E8E748A5B5AA5CC9608F6748827D979217
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\cabinet.dllexecutable
MD5:A14FA4AB41FB4825651682FC797D9223
SHA256:0CC35F915A58B16587D4EDAA9F7F852D760895FF1DD3D6A8E321BF70DB646BAD
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\mdactwo.cabcompressed
MD5:A280428B1B3EE3CD1DD7DE5C11A71431
SHA256:5319928B9FF307E54A36C9916D62AB4B4E3102BE121F303A9C9C44C8753B622A
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\w95inf16.dllexecutable
MD5:7210D5407A2D2F52E851604666403024
SHA256:337D2FB5252FC532B7BF67476B5979D158CA2AC589E49C6810E2E1AFEBE296AF
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\mdaceula.txttext
MD5:F58FED4B0A2FD63314675310815A9BD2
SHA256:B292D22BA74D01CC8B5D9D416B9D58AD612FD6DBE3DBC87BAC1AD2DC272A01E3
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\mtxfiles.cabcompressed
MD5:900DB52B82EC4C8EFDEE8DCFB0DCECB9
SHA256:89538F02A22595B5DCDCF0569643FC1BF5C232A30DB02BFEA4F08603BB883222
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\advpack.dllexecutable
MD5:B19CC5CDCBA6FD7254BF00E71C7BE0FA
SHA256:C2CF3936ABC24480F2E813C76FBA4B59B0B4F0F24274154D700523D7C33FE9A7
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\msvcrt.cabcompressed
MD5:C82AC0D57A93E68CBC1DFB9FD98BC677
SHA256:278DED81C335072D95A8D67C57DEAE8350D4171A855ADFBDE6E5004E71002527
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetupr.dllexecutable
MD5:D17ED4A2A8B968F535A498A0B5D11843
SHA256:E298A70310D2256C6EA2251E33055A8813E07C91ADD24EBB65E51E404DD54919
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5916
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5916
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6908
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3560
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3560
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.144
  • 104.126.37.146
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.185
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.179
whitelisted
google.com
  • 172.217.18.14
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.74
  • 40.126.32.68
  • 40.126.32.134
  • 40.126.32.72
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mdac_typ.exe