File name:

NDP452-KB2901954-Web.exe

Full analysis: https://app.any.run/tasks/38c7f58b-9c8c-4155-9490-a66083bdef50
Verdict: Malicious activity
Analysis date: June 14, 2021, 10:56:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CA41DBA55A727F01104871B160CD5B1D

SHA1:

5B71B20A455F6EEAB79DD1EDCAB0BA66AD0D2208

SHA256:

BD173D14A371E6786C4AE90BE1F2C560458D672BA4CBEB3CF55BEBFEF2E2778A

SSDEEP:

24576:Jz9m04PLdUcyezFSjaggwdRTw28Z4Qn+dwVY0YbxYRyUwuGqq:59m04DGexmLTQn+dwZYMyXd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • NDP452-KB2901954-Web.exe (PID: 2320)

    • Loads dropped or rewritten executable

      • Setup.exe (PID: 2592)

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 2592)

    • Actions looks like stealing of personal data

      • NDP452-KB2901954-Web.exe (PID: 2320)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • NDP452-KB2901954-Web.exe (PID: 2320)

    • Drops a file that was compiled in debug mode

      • NDP452-KB2901954-Web.exe (PID: 2320)

    • Executable content was dropped or overwritten

      • NDP452-KB2901954-Web.exe (PID: 2320)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

ProductVersion: 4.5.51209.34209
ProductName: Microsoft .NET Framework 4.5.2
OriginalFileName: NDP452-KB2901954-Web.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
InternalName: NDP452-KB2901954-Web.exe
FileVersion: 4.5.51209.34209
FileDescription: Microsoft .NET Framework 4.5.2 Setup
CompanyName: Microsoft Corporation
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 4.5.51209.34209
FileVersionNumber: 4.5.51209.34209
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: 10
OSVersion: 5.1
EntryPoint: 0x18976
UninitializedDataSize: -
InitializedDataSize: 29696
CodeSize: 157696
LinkerVersion: 10
PEType: PE32
TimeStamp: 2013:12:26 01:13:26+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 26-Dec-2013 00:13:26
Detected languages:
  • English - United States
Debug artifacts:
  • E:\452RTMGDR\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb
CompanyName: Microsoft Corporation
FileDescription: Box Stub
FileVersion: 12.0.52552.34107 built by: FX452RTMGDR(MGHAZNAWKS-MGHAZNA)
InternalName: BoxStub.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: BoxStub.exe
ProductName: Microsoft® .NET Framework
ProductVersion: 12.0.52552.34107

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 26-Dec-2013 00:13:26
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0002670A
0x00026800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.56437
.data
0x00028000
0x00003700
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.4157
.idata
0x0002C000
0x0000122A
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.18948
.boxld01\xb6
0x0002E000
0x000000B6
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.66081
.rsrc
0x0002F000
0x00001EE8
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.27514
.reloc
0x00031000
0x0000286A
0x00002A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.91342

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.18631
1338
Latin 1 / Western European
English - United States
RT_MANIFEST
2
2.65184
180
Latin 1 / Western European
English - United States
RT_STRING
32
1.85835
64
Latin 1 / Western European
English - United States
RT_STRING
107
2.37086
34
Latin 1 / Western European
English - United States
RT_GROUP_ICON
129
3.13202
268
Latin 1 / Western European
English - United States
RT_DIALOG
130
3.33978
368
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
Cabinet.dll
KERNEL32.dll
OLEAUT32.dll
RPCRT4.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll

Exports

Title
Ordinal
Address
?dwPlaceholder@@3PAEA
1
0x0002E000
_DecodePointerInternal@4
2
0x0000B60E
_EncodePointerInternal@4
3
0x0000B5F3
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start ndp452-kb2901954-web.exe setup.exe no specs ndp452-kb2901954-web.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1708"C:\Users\admin\AppData\Local\Temp\NDP452-KB2901954-Web.exe" C:\Users\admin\AppData\Local\Temp\NDP452-KB2901954-Web.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.5.2 Setup
Exit code:
3221226540
Version:
4.5.51209.34209
Modules
Images
c:\users\admin\appdata\local\temp\ndp452-kb2901954-web.exe
2320"C:\Users\admin\AppData\Local\Temp\NDP452-KB2901954-Web.exe" C:\Users\admin\AppData\Local\Temp\NDP452-KB2901954-Web.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.5.2 Setup
Exit code:
0
Version:
4.5.51209.34209
Modules
Images
c:\users\admin\appdata\local\temp\ndp452-kb2901954-web.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2592C:\2844a04f0ccf818cda\\Setup.exe /x86 /x64 /webC:\2844a04f0ccf818cda\Setup.exe—NDP452-KB2901954-Web.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
0
Version:
12.0.51209.34209 built by: FX452RTMGDR
Modules
Images
c:\2844a04f0ccf818cda\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\2844a04f0ccf818cda\setupengine.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
Total events
9
Read events
9
Write events
0
Delete events
0

Modification events

No data
Executable files
29
Suspicious files
0
Text files
76
Unknown types
0

Dropped files

PID
Process
Filename
Type
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\Graphics\Rotate1.icoimage
MD5:26A00597735C5F504CF8B3E7E9A7A4C1
SHA256:37026C4EA2182D7908B3CF0CEF8A6F72BDDCA5F1CFBC702F35B569AD689CF0AF
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\Graphics\Print.icoimage
MD5:7E55DDC6D611176E697D01C90A1212CF
SHA256:FF542E32330B123486797B410621E19EAFB39DF3997E14701AFA4C22096520ED
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\SplashScreen.bmpimage
MD5:0966FCD5A4AB0DDF71F46C01EFF3CDD5
SHA256:31C13ECFC0EB27F34036FB65CC0E735CD444EEC75376EEA2642F926AC162DCB3
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\watermark.bmpimage
MD5:B0075CEE80173D764C0237E840BA5879
SHA256:AB18374B3AAB10E5979E080D0410579F9771DB888BA1B80A5D81BA8896E2D33A
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\header.bmpimage
MD5:514BFCD8DA66722A9639EB41ED3988B7
SHA256:6B8201ED10CE18FFADE072B77C6D1FCACCF1D29ACB47D86F553D9BEEBD991290
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\Graphics\Rotate6.icoimage
MD5:70006BF18A39D258012875AEFB92A3D1
SHA256:19ABCEDF93D790E19FB3379CB3B46371D3CBFF48FE7E63F4FDCC2AC23A9943E4
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\Graphics\Rotate4.icoimage
MD5:BB55B5086A9DA3097FB216C065D15709
SHA256:8D82FF7970C9A67DA8134686560FE3A6C986A160CED9D1CC1392F2BA75C698AB
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\Graphics\Rotate8.icoimage
MD5:D1C53003264DCE4EFFAF462C807E2D96
SHA256:5FB03593071A99C7B3803FE8424520B8B548B031D02F2A86E8F5412AC519723C
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\Graphics\SysReqMet.icoimage
MD5:661CBD315E9B23BA1CA19EDAB978F478
SHA256:8BFC77C6D0F27F3D0625A884E0714698ACC0094A92ADCB6DE46990735AE8F14D
2320NDP452-KB2901954-Web.exeC:\2844a04f0ccf818cda\Graphics\Rotate3.icoimage
MD5:924FD539523541D42DAD43290E6C0DB5
SHA256:02A7FE932029C6FA24D1C7CC06D08A27E84F43A0CBC47B7C43CAC59424B3D1F6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
NDP452-KB2901954-Web.exe