File name: | b50d83820a5704522fee59164d7bc69bea5c834ebd9be7fd8ad35b040910807f |
Full analysis: | https://app.any.run/tasks/bc37caf7-5cb2-4fd2-82c3-41fdc4d7d6de |
Verdict: | Malicious activity |
Analysis date: | February 28, 2020, 02:02:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows |
MD5: | AB95209E7CF8EB2079E50B503C296E8B |
SHA1: | 8F93F250CDF406C1E1D93809754E369C9AB139CA |
SHA256: | B50D83820A5704522FEE59164D7BC69BEA5C834EBD9BE7FD8AD35B040910807F |
SSDEEP: | 6144:YrDmCDfEXR6x6RAntistIlz+gyhAOpJLY+ozz1noZVWZuRmh:YWCDfEXY6RAntlNgYLR2n96mh |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 6 |
ImageVersion: | - |
OSVersion: | 6 |
EntryPoint: | 0xdb51 |
UninitializedDataSize: | - |
InitializedDataSize: | 162304 |
CodeSize: | 174080 |
LinkerVersion: | 14.16 |
PEType: | PE32 |
TimeStamp: | 2018:12:11 10:05:40+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 11-Dec-2018 09:05:40 |
Detected languages: |
|
Debug artifacts: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 11-Dec-2018 09:05:40 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0002A7D6 | 0x0002A800 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.68326 |
.rdata | 0x0002C000 | 0x00011AFC | 0x00011C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.6178 |
.data | 0x0003E000 | 0x00013478 | 0x00012600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.66057 |
.rsrc | 0x00052000 | 0x000001E0 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.71141 |
.reloc | 0x00053000 | 0x00002554 | 0x00002600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.52343 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
2 | 4.91161 | 381 | UNKNOWN | English - United States | RT_MANIFEST |
KERNEL32.dll |
Title | Ordinal | Address |
---|---|---|
displayAsciiArt | 1 | 0x00009010 |
displayChunkNames | 2 | 0x00008D00 |
displayFilterTypes | 3 | 0x00009280 |
displayPNGInfo | 4 | 0x00008720 |
get_shellcode | 5 | 0x00009800 |
main | 6 | 0x00009830 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3240 | "C:\Windows\System32\rundll32.exe" "C:\Users\admin\b50d83820a5704522fee59164d7bc69bea5c834ebd9be7fd8ad35b040910807f.exe", displayAsciiArt | C:\Windows\System32\rundll32.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3284 | C:\Windows\system32\WerFault.exe -u -p 3240 -s 168 | C:\Windows\system32\WerFault.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2628 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
372 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | — |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
860 | C:\Windows\system32\svchost.exe -k netsvcs | C:\Windows\System32\svchost.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3692 | "cmd.exe" /s /k pushd "C:\Users\admin" | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3168 | rundll32 b50d83820a5704522fee59164d7bc69bea5c834ebd9be7fd8ad35b040910807f.exe main | C:\Windows\system32\rundll32.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
860 | svchost.exe | C:\Windows\SoftwareDistribution\DataStore\DataStore.edb | — | |
MD5:— | SHA256:— | |||
3284 | WerFault.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_b50_8f2642348cb645f92bb0c8ed71e63c8f5585f_0c729553\Report.wer | binary | |
MD5:C1615B1542C2EA3287A1D67C13648B1E | SHA256:2ABF540C03CC7CDE3D444A076D1B3336BDCA8407E42924E068AFBE9A36B65319 | |||
860 | svchost.exe | C:\Windows\appcompat\programs\RecentFileCache.bcf | txt | |
MD5:9D8FC6D7D4BE05ECA3CFDA3A4290AD3D | SHA256:A3000F6B5ECDEA78C06CA08B65791B1DFD94A6F41A0A734F9817DAE59D098D69 | |||
860 | svchost.exe | C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk | binary | |
MD5:6FC533E381AC94B57745C8E0C8B491A2 | SHA256:510EE421D3561EB9E527BAD5919B0FB56F3558FA6BBB0DC42D6B1E63BA9B0333 | |||
3284 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\rundll32.exe.3240.dmp | dmp | |
MD5:D0A52DB3FD1C7558A9012673847C1E96 | SHA256:5AD0561AB89D708CACA408B1F2C2B2F590A4CA80123825ECFA92B1F82AE26D3B | |||
860 | svchost.exe | C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log | binary | |
MD5:B456D6448FD711D9A31880B71BCE1696 | SHA256:FF2877E93BC3D8AA054A94F57085469551FFB751064C21AE7FE64E047A902B1D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3168 | rundll32.exe | POST | — | 193.228.52.57:80 | http://193.228.52.57/ | AT | — | — | unknown |
3168 | rundll32.exe | POST | — | 193.228.52.57:80 | http://193.228.52.57/ | AT | — | — | unknown |
3168 | rundll32.exe | POST | — | 45.67.231.169:80 | http://45.67.231.169/ | unknown | — | — | unknown |
3168 | rundll32.exe | POST | — | 45.67.231.169:80 | http://45.67.231.169/ | unknown | — | — | unknown |
3168 | rundll32.exe | POST | — | 193.228.52.57:80 | http://193.228.52.57/ | AT | — | — | unknown |
3168 | rundll32.exe | POST | — | 45.67.231.169:80 | http://45.67.231.169/ | unknown | — | — | unknown |
3168 | rundll32.exe | POST | — | 45.67.231.169:80 | http://45.67.231.169/ | unknown | — | — | unknown |
3168 | rundll32.exe | POST | — | 193.228.52.57:80 | http://193.228.52.57/ | AT | — | — | unknown |
3168 | rundll32.exe | POST | — | 193.228.52.57:80 | http://193.228.52.57/ | AT | — | — | unknown |
3168 | rundll32.exe | POST | — | 45.67.231.169:80 | http://45.67.231.169/ | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3168 | rundll32.exe | 45.67.231.169:80 | — | — | — | unknown |
3168 | rundll32.exe | 193.228.52.57:80 | — | — | AT | unknown |