File name:

ZoomInfoContactContributor.exe

Full analysis: https://app.any.run/tasks/d72c8393-7281-44b3-9f3b-70310b74c6cd
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 19, 2023, 16:49:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

1C0674970E55FF28E3D6D4B9FC435F39

SHA1:

E33DF0CD1EAD927FB3AD769FF311E5598C533DA2

SHA256:

BE790B55B11F6502BE0C8CF14F2AB4F9E97DEBE7E07EFDE26CF24F3927D791DB

SSDEEP:

3072:6gXdZt9P6D3XJazx7Op5KmEOm9Ek1ydrZeDAf1OnV8AHzsFypc9U:6e348t7uUmq9EnvAH4F8uU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ADWARE was detected

      • ZoomInfoContactContributor.exe (PID: 3556)

    • Loads dropped or rewritten executable

      • ZoomInfoContactContributor.exe (PID: 3556)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • ZoomInfoContactContributor.exe (PID: 3556)

    • Reads the Internet Settings

      • ZoomInfoContactContributor.exe (PID: 3556)

  • INFO

    • Checks proxy server information

      • ZoomInfoContactContributor.exe (PID: 3556)

    • Reads the computer name

      • ZoomInfoContactContributor.exe (PID: 3556)

    • Checks supported languages

      • ZoomInfoContactContributor.exe (PID: 3556)

    • Reads Microsoft Office registry keys

      • ZoomInfoContactContributor.exe (PID: 3556)

    • Create files in a temporary directory

      • ZoomInfoContactContributor.exe (PID: 3556)

    • Creates files or folders in the user directory

      • ZoomInfoContactContributor.exe (PID: 3556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

ProductVersion: 62
ProductName: ZoomInfo Contact Contributor
LegalCopyright: (c) Zoom Information, Inc.
FileVersion: 62
FileDescription: -
CharacterSet: ASCII
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 2.0.0.62
FileVersionNumber: 2.0.0.62
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x30fa
UninitializedDataSize: 1024
InitializedDataSize: 164864
CodeSize: 24064
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2009:12:05 22:50:52+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ADWARE zoominfocontactcontributor.exe

Process information

PID
CMD
Path
Indicators
Parent process
3556"C:\Users\admin\AppData\Local\Temp\ZoomInfoContactContributor.exe" C:\Users\admin\AppData\Local\Temp\ZoomInfoContactContributor.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
62
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
c:\windows\system32\advapi32.dll
Total events
1 053
Read events
1 053
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3556ZoomInfoContactContributor.exeC:\Users\admin\AppData\Local\Temp\nsq7B23.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
3556ZoomInfoContactContributor.exeC:\Users\admin\AppData\Local\Temp\nsq7B23.tmp\NSISdl.dllexecutable
MD5:A5F8399A743AB7F9C88C645C35B1EBB5
SHA256:DACC88A12D3BA438FDAE3535DC7A5A1D389BCE13ADC993706424874A782E51C9
3556ZoomInfoContactContributor.exeC:\Users\admin\AppData\Local\Temp\nsq7B23.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
3556ZoomInfoContactContributor.exeC:\Users\admin\AppData\Local\Temp\nsq7B23.tmp\FindProcDLL.dllexecutable
MD5:83CD62EAB980E3D64C131799608C8371
SHA256:A6122E80F1C51DC72770B4F56C7C482F7A9571143FBF83B19C4D141D0CB19294
3556ZoomInfoContactContributor.exeC:\Users\admin\AppData\Local\Temp\nsq7B23.tmp\GetVersion.dllexecutable
MD5:2E2412281A205ED8D53AAFB3EF770A2D
SHA256:DB09ADB6E17B6A0B31823802431FF5209018EE8C77A193AC8077E42E5F15FB00
3556ZoomInfoContactContributor.exeC:\Users\admin\AppData\Local\Temp\nsq7B23.tmp\nsDialogs.dllexecutable
MD5:C10E04DD4AD4277D5ADC951BB331C777
SHA256:E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
3556ZoomInfoContactContributor.exeC:\Users\admin\AppData\Local\Temp\fccoordinator.tmptext
MD5:4DAFB14DF5706C09D9003426EE11ECE1
SHA256:FC7D8CB16AFF9A07F5D13F33A418A8468E5455592194D3FC91B3626B7405CB6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
6
DNS requests
1
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3556
ZoomInfoContactContributor.exe
GET
200
172.217.23.115:80
http://cswapper.freshcontacts.com/client/installopen?client_id={9833F3B6-0A92-4F14-980C-4897F984AD4F}
unknown
—
—
unknown
3556
ZoomInfoContactContributor.exe
GET
—
172.217.23.115:80
http://cswapper.freshcontacts.com/client/download2?client_version=62&client_id={9833F3B6-0A92-4F14-980C-4897F984AD4F}&outlook_bitness=32&reachout=true&appid=4
unknown
—
—
unknown
3556
ZoomInfoContactContributor.exe
GET
—
172.217.23.115:80
http://cswapper.freshcontacts.com/client/download2?client_version=62&client_id={9833F3B6-0A92-4F14-980C-4897F984AD4F}&outlook_bitness=32&reachout=true&appid=4
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3556
ZoomInfoContactContributor.exe
172.217.23.115:80
cswapper.freshcontacts.com
GOOGLE
US
unknown
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
cswapper.freshcontacts.com
  • 172.217.23.115
whitelisted

Threats

PID
Process
Class
Message
3556
ZoomInfoContactContributor.exe
Malware Command and Control Activity Detected
ET ADWARE_PUP ZoomInfo Contact Contributor Install
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZoomInfoContactContributor.exe