analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Ref[G81987993157] Customer Ref[20130819T001T]_pdf.zip

Full analysis: https://app.any.run/tasks/37759c03-b10f-4f4a-847f-7670e5a38783
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Malware Trends Tracker     >>>
Analysis date: November 15, 2018, 16:21:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
hawkeye
keylogger
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

8EF8C1D845F491C586F72B9241030DD7

SHA1:

C017C7C0FC77432CBCFDB35E8C5E9AB2244EE7DE

SHA256:

B51923AA89C9631FACCA48B106458C3D5E66A8A2BDAB9B1F305913AE4D89A6ED

SSDEEP:

12288:ZzkdwAqn/O9TMFoc++A/XBrA6O/jQNk3/tziNBZM9e05RhnigC:Jk90KMFoJ+kxA/jrzwwVxi9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3132)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3616)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)
      • Windows Update.exe (PID: 2632)
      • Windows Update.exe (PID: 3984)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3444)
      • Windows Update.exe (PID: 1452)

    • Detected Hawkeye Keylogger

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Changes settings of System certificates

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 3044)

  • SUSPICIOUS

    • Application launched itself

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3132)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3444)
      • Windows Update.exe (PID: 2632)

    • Executable content was dropped or overwritten

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3616)

    • Creates files in the user directory

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3616)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Starts itself from another location

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3616)

    • Connects to SMTP port

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Checks for external IP

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Adds / modifies Windows certificates

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Executes scripts

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

  • INFO

    • Application was crashed

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Reads settings of System Certificates

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2018:11:15 03:54:12
ZipCRC: 0x1229c9b0
ZipCompressedSize: 553709
ZipUncompressedSize: 571392
ZipFileName: Ref[G81987993157] Customer Ref[20130819T001T].exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
10
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs ref[g81987993157] customer ref[20130819t001t].exe no specs ref[g81987993157] customer ref[20130819t001t].exe windows update.exe no specs windows update.exe ref[g81987993157] customer ref[20130819t001t].exe no specs #HAWKEYE ref[g81987993157] customer ref[20130819t001t].exe windows update.exe dw20.exe no specs vbc.exe

Process information

PID
CMD
Path
Indicators
Parent process
3216"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Ref[G81987993157] Customer Ref[20130819T001T]_pdf.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3132"C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe" C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3616"C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe" C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe
Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3984"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe—Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
2632"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3444"C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe" C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
4092"C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe" C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe
Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Integrity Level:
MEDIUM
1452"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
Windows Update.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2092dw20.exe -x -s 1652C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe—Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Error Reporting Shim
Version:
2.0.50727.4927 (NetFXspW7.050727-4900)
3044C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Version:
8.0.50727.5420
Total events
936
Read events
887
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3216WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3216.42569\Ref[G81987993157] Customer Ref[20130819T001T].exe —
MD5:—
SHA256:—
3616Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Local\Temp\SysInfo.txttext
MD5:06775771590A265B40A92714550E5326
SHA256:831598358C9F4B3D9E9B515B6924BEAB5005D57715AD5489BDA0BB2DB690DBA8
4092Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Local\Temp\SysInfo.txttext
MD5:06775771590A265B40A92714550E5326
SHA256:831598358C9F4B3D9E9B515B6924BEAB5005D57715AD5489BDA0BB2DB690DBA8
3616Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Roaming\Windows Update.exeexecutable
MD5:858EC82F00999C43B940EE9EE040F3B2
SHA256:8A4A097E8B6F9667756A38657B59B1B631F6C42EC9A006D1D325689A14BE9CF8
4092Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Roaming\pidloc.txttext
MD5:06775771590A265B40A92714550E5326
SHA256:831598358C9F4B3D9E9B515B6924BEAB5005D57715AD5489BDA0BB2DB690DBA8
4092Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Roaming\pid.txttext
MD5:77340C2E00E9E6AD1B2784DAD06291EA
SHA256:BE87FCC57797F6239F88630A7817111D7750B36F662B95B7D094A3B98692CDAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
GET
403
104.16.20.96:80
http://whatismyipaddress.com/
US
text
100 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
104.16.20.96:80
whatismyipaddress.com
Cloudflare Inc
US
shared
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
213.180.193.38:587
smtp.yandex.com
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
whatismyipaddress.com
  • 104.16.20.96
  • 104.16.16.96
  • 104.16.17.96
  • 104.16.18.96
  • 104.16.19.96
shared
smtp.yandex.com
  • 213.180.193.38
  • 213.180.204.38
  • 87.250.250.38
  • 93.158.134.38
  • 77.88.21.38
shared

Threats

PID
Process
Class
Message
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
A Network Trojan was detected
MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck)
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Ref[G81987993157] Customer Ref[20130819T001T]_pdf.zip