File name:

IDM Full Toolkit 3.9.exe

Full analysis: https://app.any.run/tasks/1e4a9c93-6c52-4819-8ef6-355575131e4e
Verdict: Malicious activity
Analysis date: May 19, 2019, 13:21:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

75853C8FA82F5544FAD9E384E71363A5

SHA1:

9A831ED1238F217A11BB159EF9EE24F047180E92

SHA256:

B6221FCA4503661FFCB81E0A744A2D2699670AC1506156CAC72A67577EE0CCE6

SSDEEP:

24576:A4GHnhIzOaaOZayrjHIpo05a2HgJ2A8+3d8UMbn1Z5a2HgJ2A8+3dklMJx0:nshdaaOZGjAv3q1TAv3ilMJi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • IDM Full Toolkit 3.9.exe (PID: 3388)

    • Loads dropped or rewritten executable

      • IDM Full Toolkit 3.9.exe (PID: 3388)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • IDM Full Toolkit 3.9.exe (PID: 3388)

    • Adds / modifies Windows certificates

      • IDM Full Toolkit 3.9.exe (PID: 3388)

    • Creates files in the user directory

      • rundll32.exe (PID: 1868)
      • IDM Full Toolkit 3.9.exe (PID: 3388)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 1892)
      • rundll32.exe (PID: 1868)

    • Executable content was dropped or overwritten

      • IDM Full Toolkit 3.9.exe (PID: 3388)

  • INFO

    • Reads settings of System Certificates

      • IDM Full Toolkit 3.9.exe (PID: 3388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (28.6)
.exe | UPX compressed Win32 Executable (28)
.exe | Win32 EXE Yoda's Crypter (27.5)
.dll | Win32 Dynamic Link Library (generic) (6.8)
.exe | Win32 Executable (generic) (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:19 12:30:42+01:00
PEType: PE32
LinkerVersion: 12
CodeSize: 352256
InitializedDataSize: 1163264
UninitializedDataSize: 1691648
EntryPoint: 0x1f3b60
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 3.9.0.0
ProductVersionNumber: 3.9.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
FileVersion: 3.9.0.0
Comments: IDM Full Toolkit is a free tool
FileDescription: IDM Full Toolkit
ProductVersion: 3.9.0.0
LegalCopyright: ptk911@2017-2019
CompanyName: ptk911

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Mar-2019 11:30:42
Detected languages:
  • English - United Kingdom
FileVersion: 3.9.0.0
Comments: IDM Full Toolkit is a free tool
FileDescription: IDM Full Toolkit
ProductVersion: 3.9.0.0
LegalCopyright: ptk911@2017-2019
CompanyName: ptk911

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 19-Mar-2019 11:30:42
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x0019D000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x0019E000
0x00056000
0x00055E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93652
.rsrc
0x001F4000
0x0011C000
0x0011B600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99764

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.39264
1018
Latin 1 / Western European
English - United Kingdom
RT_MANIFEST
2
2.05883
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
3
2.25499
296
Latin 1 / Western European
English - United Kingdom
RT_ICON
4
4.55764
4264
Latin 1 / Western European
English - United Kingdom
RT_ICON
7
7.88354
1428
Latin 1 / Western European
English - United Kingdom
RT_STRING
8
7.87317
1674
Latin 1 / Western European
English - United Kingdom
RT_STRING
9
7.85324
1168
Latin 1 / Western European
English - United Kingdom
RT_STRING
10
7.88766
1532
Latin 1 / Western European
English - United Kingdom
RT_STRING
11
7.87185
1628
Latin 1 / Western European
English - United Kingdom
RT_STRING
12
7.84712
1126
Latin 1 / Western European
English - United Kingdom
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.DLL
MPR.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start idm full toolkit 3.9.exe rundll32.exe no specs rundll32.exe no specs idm full toolkit 3.9.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1868"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—IDM Full Toolkit 3.9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1892"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—IDM Full Toolkit 3.9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2604"C:\Users\admin\Desktop\IDM Full Toolkit 3.9.exe" C:\Users\admin\Desktop\IDM Full Toolkit 3.9.exe—explorer.exe
User:
admin
Company:
ptk911
Integrity Level:
MEDIUM
Description:
IDM Full Toolkit
Exit code:
3221226540
Version:
3.9.0.0
Modules
Images
c:\users\admin\desktop\idm full toolkit 3.9.exe
c:\systemroot\system32\ntdll.dll
3388"C:\Users\admin\Desktop\IDM Full Toolkit 3.9.exe" C:\Users\admin\Desktop\IDM Full Toolkit 3.9.exe
explorer.exe
User:
admin
Company:
ptk911
Integrity Level:
HIGH
Description:
IDM Full Toolkit
Exit code:
0
Version:
3.9.0.0
Modules
Images
c:\users\admin\desktop\idm full toolkit 3.9.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
138
Read events
101
Write events
37
Delete events
0

Modification events

(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_CURRENT_USER\Software\DownloadManager
Operation:writeName:toolkit
Value:
Vi
(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_CURRENT_USER\Software\DownloadManager
Operation:writeName:toolkitchkup
Value:
1
(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IDM Full Toolkit 3_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IDM Full Toolkit 3_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IDM Full Toolkit 3_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IDM Full Toolkit 3_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IDM Full Toolkit 3_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IDM Full Toolkit 3_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3388) IDM Full Toolkit 3.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IDM Full Toolkit 3_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
9
Unknown types
3

Dropped files

PID
Process
Filename
Type
3388IDM Full Toolkit 3.9.exeC:\Users\admin\AppData\Local\Temp\arrow.ico —
MD5:—
SHA256:—
3388IDM Full Toolkit 3.9.exeC:\Users\admin\AppData\Local\Temp\youtube.ico —
MD5:—
SHA256:—
3388IDM Full Toolkit 3.9.exeC:\Users\admin\AppData\Local\Temp\idm.ico —
MD5:—
SHA256:—
3388IDM Full Toolkit 3.9.exeC:\Users\admin\AppData\Local\Temp\tool.jpg —
MD5:—
SHA256:—
3388IDM Full Toolkit 3.9.exeC:\Users\admin\AppData\Local\Temp\FlipedImage.bmp —
MD5:—
SHA256:—
3388IDM Full Toolkit 3.9.exeC:\Users\admin\AppData\Local\Temp\en.jpg —
MD5:—
SHA256:—
3388IDM Full Toolkit 3.9.exeC:\Users\admin\AppData\Local\Temp\vi.jpg —
MD5:—
SHA256:—
1868rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1868rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RD3GLH1W\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1868rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A9MWCNLD\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3388
IDM Full Toolkit 3.9.exe
GET
200
169.55.40.5:80
http://internetdownloadmanager.com/
US
html
15.9 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3388
IDM Full Toolkit 3.9.exe
169.55.40.5:80
internetdownloadmanager.com
SoftLayer Technologies Inc.
US
suspicious
3388
IDM Full Toolkit 3.9.exe
151.101.36.133:443
gist.githubusercontent.com
Fastly
US
suspicious

DNS requests

Domain
IP
Reputation
gist.githubusercontent.com
  • 151.101.36.133
shared
internetdownloadmanager.com
  • 169.55.40.5
suspicious

Threats

PID
Process
Class
Message
3388
IDM Full Toolkit 3.9.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
IDM Full Toolkit 3.9.exe