File name:

XSpammer - Linkvertise Downloader.zip

Full analysis: https://app.any.run/tasks/3134b239-fc71-4491-8e7a-2bd1d443274a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 10, 2022, 14:29:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

BABBC18EE3983D747EED56E7E5C4C068

SHA1:

156F514C641226CB06F864575F157248AA7B6D49

SHA256:

B85F5350CF486F52B994292E4DAACC062192F964A8ACF7A459786A6E364DA209

SSDEEP:

49152:kwt/MYULhNCLvKOFICf+k9f8L6iAvyUSOEr:tt/MvhN2vFx+uf82l5SZr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • XSpammer - Linkvertise Downloader_dMeR-o1.exe (PID: 1728)
      • XSpammer - Linkvertise Downloader_dMeR-o1.exe (PID: 2484)
      • saBSI.exe (PID: 1232)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 1876)
      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)
      • sbr.exe (PID: 2308)

    • Drops executable file immediately after starts

      • XSpammer - Linkvertise Downloader_dMeR-o1.exe (PID: 2484)
      • XSpammer - Linkvertise Downloader_dMeR-o1.exe (PID: 1728)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 1876)
      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • instup.exe (PID: 4068)

    • Changes settings of System certificates

      • saBSI.exe (PID: 1232)

    • Loads dropped or rewritten executable

      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Changes the autorun value in the registry

      • instup.exe (PID: 4068)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3060)
      • XSpammer - Linkvertise Downloader_dMeR-o1.exe (PID: 2484)
      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1392)
      • XSpammer - Linkvertise Downloader_dMeR-o1.exe (PID: 1728)
      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)
      • saBSI.exe (PID: 1232)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 1876)
      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)
      • sbr.exe (PID: 2308)

    • Executable content was dropped or overwritten

      • XSpammer - Linkvertise Downloader_dMeR-o1.exe (PID: 2484)
      • WinRAR.exe (PID: 3060)
      • XSpammer - Linkvertise Downloader_dMeR-o1.exe (PID: 1728)
      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 1876)
      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Reads the computer name

      • WinRAR.exe (PID: 3060)
      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1392)
      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)
      • saBSI.exe (PID: 1232)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 1876)
      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Drops a file with too old compile date

      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)

    • Drops a file that was compiled in debug mode

      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 1876)
      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Reads Windows owner or organization settings

      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)

    • Reads the Windows organization settings

      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)

    • Creates files in the program directory

      • saBSI.exe (PID: 1232)
      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Creates files in the Windows directory

      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 1876)
      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Starts Internet Explorer

      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)

    • Adds / modifies Windows certificates

      • saBSI.exe (PID: 1232)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2544)

    • Drops a file with a compile date too recent

      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 1876)
      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Creates or modifies windows services

      • instup.exe (PID: 3004)

    • Reads Environment values

      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Reads CPU info

      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Starts itself from another location

      • instup.exe (PID: 3004)

    • Removes files from Windows directory

      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Creates a directory in Program Files

      • instup.exe (PID: 4068)

  • INFO

    • Application was dropped or rewritten from another process

      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)
      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1392)

    • Reads settings of System Certificates

      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)
      • saBSI.exe (PID: 1232)
      • iexplore.exe (PID: 2544)
      • avast_free_antivirus_setup_online.exe (PID: 3724)
      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)

    • Loads dropped or rewritten executable

      • XSpammer - Linkvertise Downloader_dMeR-o1.tmp (PID: 1724)

    • Reads the computer name

      • iexplore.exe (PID: 2544)
      • iexplore.exe (PID: 2276)

    • Checks Windows Trust Settings

      • saBSI.exe (PID: 1232)
      • iexplore.exe (PID: 2544)

    • Checks supported languages

      • iexplore.exe (PID: 2276)
      • iexplore.exe (PID: 2544)

    • Changes internet zones settings

      • iexplore.exe (PID: 2276)

    • Application launched itself

      • iexplore.exe (PID: 2276)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2276)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2276)

    • Reads the hosts file

      • instup.exe (PID: 3004)
      • instup.exe (PID: 4068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: .. /
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2022:03:23 16:41:23
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
13
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe xspammer - linkvertise downloader_dmer-o1.exe xspammer - linkvertise downloader_dmer-o1.tmp no specs xspammer - linkvertise downloader_dmer-o1.exe xspammer - linkvertise downloader_dmer-o1.tmp sabsi.exe cookie_mmm_irs_ppi_005_888_a.exe iexplore.exe no specs iexplore.exe avast_free_antivirus_setup_online.exe instup.exe instup.exe sbr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3060"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\XSpammer - Linkvertise Downloader.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
2484"C:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\XSpammer - Linkvertise Downloader_dMeR-o1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\XSpammer - Linkvertise Downloader_dMeR-o1.exe
WinRAR.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Linkvertise GmbH & Co. KG
Exit code:
0
Version:
2.0.0.13
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3060.15115\xspammer - linkvertise downloader_dmer-o1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1392"C:\Users\admin\AppData\Local\Temp\is-53DE5.tmp\XSpammer - Linkvertise Downloader_dMeR-o1.tmp" /SL5="$3016E,1785071,899584,C:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\XSpammer - Linkvertise Downloader_dMeR-o1.exe" C:\Users\admin\AppData\Local\Temp\is-53DE5.tmp\XSpammer - Linkvertise Downloader_dMeR-o1.tmp—XSpammer - Linkvertise Downloader_dMeR-o1.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-53de5.tmp\xspammer - linkvertise downloader_dmer-o1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1728"C:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\XSpammer - Linkvertise Downloader_dMeR-o1.exe" /SPAWNWND=$2017C /NOTIFYWND=$3016E C:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\XSpammer - Linkvertise Downloader_dMeR-o1.exe
XSpammer - Linkvertise Downloader_dMeR-o1.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Linkvertise GmbH & Co. KG
Exit code:
0
Version:
2.0.0.13
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\rar$exa3060.15115\xspammer - linkvertise downloader_dmer-o1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1724"C:\Users\admin\AppData\Local\Temp\is-5R6OL.tmp\XSpammer - Linkvertise Downloader_dMeR-o1.tmp" /SL5="$3017A,1785071,899584,C:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\XSpammer - Linkvertise Downloader_dMeR-o1.exe" /SPAWNWND=$2017C /NOTIFYWND=$3016E C:\Users\admin\AppData\Local\Temp\is-5R6OL.tmp\XSpammer - Linkvertise Downloader_dMeR-o1.tmp
XSpammer - Linkvertise Downloader_dMeR-o1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\is-5r6ol.tmp\xspammer - linkvertise downloader_dmer-o1.tmp
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
1232"C:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true C:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod0_extract\saBSI.exe
XSpammer - Linkvertise Downloader_dMeR-o1.tmp
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
4294967295
Version:
4,1,1,663
Modules
Images
c:\users\admin\appdata\local\temp\is-5bt3h.tmp\prod0_extract\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1876"C:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod1_extract\cookie_mmm_irs_ppi_005_888_a.exe" /silent /ws /psh:2bJ1khOMmNoMCCKD0HnWHiP6r0PwFE08U523ayvGj479lk2LvtNNxTJpwYqMtKcIlqxD1oDcEvZQiC:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod1_extract\cookie_mmm_irs_ppi_005_888_a.exe
XSpammer - Linkvertise Downloader_dMeR-o1.tmp
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Version:
2.1.1286.0
Modules
Images
c:\users\admin\appdata\local\temp\is-5bt3h.tmp\prod1_extract\cookie_mmm_irs_ppi_005_888_a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2276"C:\Program Files\Internet Explorer\iexplore.exe" https://universalcheats.com/download/XSpammer_5E914.rarC:\Program Files\Internet Explorer\iexplore.exe—XSpammer - Linkvertise Downloader_dMeR-o1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2544"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2276 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3724"C:\Windows\Temp\asw.f71e2975f859f264\avast_free_antivirus_setup_online.exe" /silent /ws /psh:2bJ1khOMmNoMCCKD0HnWHiP6r0PwFE08U523ayvGj479lk2LvtNNxTJpwYqMtKcIlqxD1oDcEvZQi /cookie:mmm_irs_ppi_005_888_a /ga_clientid:29bbcd2e-2372-4c65-ad78-6db69f8f60a2 /edat_dir:C:\Windows\Temp\asw.f71e2975f859f264C:\Windows\Temp\asw.f71e2975f859f264\avast_free_antivirus_setup_online.exe
cookie_mmm_irs_ppi_005_888_a.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus
Version:
22.3.7108.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\temp\asw.f71e2975f859f264\avast_free_antivirus_setup_online.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
Total events
25 891
Read events
24 485
Write events
1 401
Delete events
5

Modification events

(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3060) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\XSpammer - Linkvertise Downloader.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
27
Suspicious files
34
Text files
48
Unknown types
1

Dropped files

PID
Process
Filename
Type
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\XSpammer - Linkvertise Downloader_dMeR-o1.exeexecutable
MD5:D7D7D745A0C5C431228EADA2DC7D3E18
SHA256:9A912577ED5BA7DD072268C93AF3447EC8C6722E50A0881AF4C84C3E81C9D828
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\run_es.battext
MD5:BF13D224B72FDA6E81ECECE36F5700D4
SHA256:EFA3A7FD6626966A61E6FDD9D50FBC43A9C9F7842C149FC7D21681C9434CAE61
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\run_gb.battext
MD5:0F99A1400A1C269E7C5130E8092CA378
SHA256:E74D310DE606AAA382A81D428C7805C41C0D33013B1C2C071B2A6CD9424388E6
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\run_ca.battext
MD5:0D09B103BFDD942902418C76D12878DF
SHA256:5715E37891D2381B6DFC08EFC663417637F6A46E07AE9D0E310DE6B57B0E4E81
1724XSpammer - Linkvertise Downloader_dMeR-o1.tmpC:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\is-4OUQ0.tmpimage
MD5:096FF7DBB7F5DFB71CF40FCD37A59FD6
SHA256:6197D9AD63A37760E88B7EE53077FAF94D0DEEB9D8740428D2DC76A7242D7843
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\run_pt.battext
MD5:D354B2B7D5ECD8A7275CDD0B0A83697A
SHA256:359B5DCB2554CF2142218CA8AF29B74F7483ADE931E588985B5B540292A2F137
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\run_it.battext
MD5:DEB79115D2848C37FE08E37711797775
SHA256:863961B7321822F488F4CB4D220DFA45115B72C041711518DD38039181F0D552
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\run_ru.battext
MD5:1363340D6BFB7BE813D7C1B02E4FBF65
SHA256:3408A768DE5FCA57E495CF7B31B1CEBAF1141AACD1439B217C14442BFB26511D
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\run_de.battext
MD5:2343C924740361598B5E719DA474F967
SHA256:7722E8138DFCF53CA24D4246AC8271E237AF186F4EC5848DF6E87D422F8279BC
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3060.15115\run_en.battext
MD5:BB4C5C5379610F8F99B400F67852F21B
SHA256:9F688A0B17E7A0CF48F23B5BAE9F71610E037CBD5CFE3E9C8A6AE7835C03F9A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
49
DNS requests
64
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1876
cookie_mmm_irs_ppi_005_888_a.exe
GET
200
23.48.23.6:80
http://iavs9x.u.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
US
executable
8.24 Mb
whitelisted
1876
cookie_mmm_irs_ppi_005_888_a.exe
POST
204
5.62.40.214:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
3004
instup.exe
GET
200
23.72.252.58:80
http://h4444966.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
US
binary
572 b
whitelisted
3004
instup.exe
GET
200
23.72.252.64:80
http://h4444966.iavs9x.u.avast.com/iavs9x/servers.def.vpx
US
binary
2.40 Kb
whitelisted
1876
cookie_mmm_irs_ppi_005_888_a.exe
POST
204
5.62.40.214:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
3004
instup.exe
GET
200
23.72.252.58:80
http://h4444966.iavs9x.u.avast.com/iavs9x/avbugreport_ais-9d1.vpx
US
binary
1.18 Mb
whitelisted
4068
instup.exe
GET
200
23.72.252.58:80
http://j0294597.vps18tiny.u.avcdn.net/vps18tiny/part-vps_windows-22040903.vpx
US
binary
6.92 Kb
suspicious
2544
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
4068
instup.exe
GET
200
23.72.252.58:80
http://j0294597.vps18tiny.u.avcdn.net/vps18tiny/prod-vps.vpx
US
binary
338 b
suspicious
2544
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3ce09203126376ab
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1876
cookie_mmm_irs_ppi_005_888_a.exe
5.62.40.214:80
v7event.stats.avast.com
AVAST Software s.r.o.
DE
unknown
1876
cookie_mmm_irs_ppi_005_888_a.exe
142.250.186.110:80
www.google-analytics.com
Google Inc.
US
whitelisted
1232
saBSI.exe
23.35.236.229:443
sadownload.mcafee.com
Zayo Bandwidth Inc
US
suspicious
1724
XSpammer - Linkvertise Downloader_dMeR-o1.tmp
18.66.107.143:443
d17kz3i6hbr7d3.cloudfront.net
Massachusetts Institute of Technology
US
suspicious
2544
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
—
—
23.35.236.229:443
sadownload.mcafee.com
Zayo Bandwidth Inc
US
suspicious
—
—
142.250.186.110:80
www.google-analytics.com
Google Inc.
US
whitelisted
1876
cookie_mmm_irs_ppi_005_888_a.exe
23.48.23.6:80
iavs9x.u.avast.com
TRUE INTERNET Co.,Ltd.
US
suspicious
1232
saBSI.exe
44.228.179.17:443
apis.mosaic.analytics.awscommon.mcafee.com
University of California, San Diego
US
unknown
—
—
23.216.77.69:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious

DNS requests

Domain
IP
Reputation
d17kz3i6hbr7d3.cloudfront.net
  • 18.66.107.143
  • 18.66.107.75
  • 18.66.107.151
  • 18.66.107.23
whitelisted
cu1pehnswad01.servicebus.windows.net
  • 104.208.16.0
whitelisted
www.google-analytics.com
  • 142.250.186.110
whitelisted
iavs9x.u.avast.com
  • 23.48.23.6
  • 23.48.23.20
whitelisted
v7event.stats.avast.com
  • 5.62.40.214
  • 5.62.40.203
  • 5.62.40.211
whitelisted
apis.mosaic.analytics.awscommon.mcafee.com
  • 44.228.179.17
  • 35.155.62.198
unknown
sadownload.mcafee.com
  • 23.35.236.229
whitelisted
universalcheats.com
  • 188.114.96.7
  • 188.114.97.7
malicious
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
shepherd.ff.avast.com
  • 77.234.44.103
  • 77.234.46.22
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-5BT3H.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
XSpammer - Linkvertise Downloader.zip