File name: | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586 |
Full analysis: | https://app.any.run/tasks/6d1cc9a4-aca4-4159-b01f-c08ba9ce4798 |
Verdict: | Malicious activity |
Analysis date: | May 24, 2019, 06:47:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 55A0867E691D550D944B5FBAD27ECD56 |
SHA1: | 90AC7124AD9F3E43BB8048760308F73581546C52 |
SHA256: | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586 |
SSDEEP: | 98304:tDD8CEoc9pFK19rLyke55p8tGBLyB+TIY+:ZoLFKHrLyky5p8E0+cY+ |
.exe | | | Inno Setup installer (81.5) |
---|---|---|
.exe | | | Win32 Executable Delphi generic (10.5) |
.exe | | | Win32 Executable (generic) (3.3) |
.exe | | | Win16/32 Executable Delphi generic (1.5) |
.exe | | | Generic Win/DOS Executable (1.4) |
ProductVersion: | 1.0.648.15384 |
---|---|
ProductName: | WinZip Driver Updater |
LegalCopyright: | © WinZip Computing, S.L. (WinZip Computing) |
FileVersion: | WinZip Driver Update |
FileDescription: | WinZip Driver Updater |
CompanyName: | WinZip Computing, S.L. (WinZip Computing) |
Comments: | This installation was built with Inno Setup. |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.0.648.15384 |
FileVersionNumber: | 1.0.648.15384 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5 |
ImageVersion: | 6 |
OSVersion: | 5 |
EntryPoint: | 0x16478 |
UninitializedDataSize: | - |
InitializedDataSize: | 81408 |
CodeSize: | 86016 |
LinkerVersion: | 2.25 |
PEType: | PE32 |
TimeStamp: | 2012:07:09 15:41:29+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 09-Jul-2012 13:41:29 |
Detected languages: |
|
Comments: | This installation was built with Inno Setup. |
CompanyName: | WinZip Computing, S.L. (WinZip Computing) |
FileDescription: | WinZip Driver Updater |
FileVersion: | WinZip Driver Update |
LegalCopyright: | © WinZip Computing, S.L. (WinZip Computing) |
ProductName: | WinZip Driver Updater |
ProductVersion: | 1.0.648.15384 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 8 |
Time date stamp: | 09-Jul-2012 13:41:29 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000143F8 | 0x00014400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.48222 |
.itext | 0x00016000 | 0x00000BE8 | 0x00000C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.0058 |
.data | 0x00017000 | 0x00000D9C | 0x00000E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.66929 |
.bss | 0x00018000 | 0x0000574C | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x0001E000 | 0x00000F9E | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.96778 |
.tls | 0x0001F000 | 0x00000008 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x00020000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.190489 |
.rsrc | 0x00021000 | 0x00011C98 | 0x00011E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.1308 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.05007 | 1376 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 5.67535 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 5.88157 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 5.45655 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
4091 | 3.13038 | 196 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4092 | 3.36196 | 204 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4093 | 3.34841 | 372 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4094 | 3.29351 | 924 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4095 | 3.34579 | 844 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4096 | 3.28057 | 660 | Latin 1 / Western European | UNKNOWN | RT_STRING |
advapi32.dll |
comctl32.dll |
kernel32.dll |
oleaut32.dll |
user32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3208 | "C:\Users\admin\AppData\Local\Temp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.exe" | C:\Users\admin\AppData\Local\Temp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.exe | explorer.exe | |
User: admin Company: WinZip Computing, S.L. (WinZip Computing) Integrity Level: MEDIUM Description: WinZip Driver Updater Exit code: 0 Version: WinZip Driver Update | ||||
4092 | "C:\Users\admin\AppData\Local\Temp\is-JDQ42.tmp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp" /SL5="$7011E,2989767,168448,C:\Users\admin\AppData\Local\Temp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.exe" | C:\Users\admin\AppData\Local\Temp\is-JDQ42.tmp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | — | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.exe |
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 | ||||
3396 | "C:\Users\admin\AppData\Local\Temp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.exe" /SPAWNWND=$601F8 /NOTIFYWND=$7011E | C:\Users\admin\AppData\Local\Temp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.exe | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | |
User: admin Company: WinZip Computing, S.L. (WinZip Computing) Integrity Level: HIGH Description: WinZip Driver Updater Exit code: 0 Version: WinZip Driver Update | ||||
3768 | "C:\Users\admin\AppData\Local\Temp\is-CD47G.tmp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp" /SL5="$90118,2989767,168448,C:\Users\admin\AppData\Local\Temp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.exe" /SPAWNWND=$601F8 /NOTIFYWND=$7011E | C:\Users\admin\AppData\Local\Temp\is-CD47G.tmp\C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.exe | |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 | ||||
2776 | "C:\Windows\system32\taskkill.exe" /f /im winzipdu.exe | C:\Windows\system32\taskkill.exe | — | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3180 | "C:\Windows\system32\taskkill.exe" /f /im DriverUpdateHelper64.exe | C:\Windows\system32\taskkill.exe | — | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2952 | "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\jscript.dll" | C:\Windows\system32\regsvr32.exe | — | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2756 | "C:\Windows\System32\schtasks.exe" /delete /tn "WINZIPDU-WINZIPDUDriverUpdater" /f | C:\Windows\System32\schtasks.exe | — | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3048 | "C:\Windows\System32\schtasks.exe" /delete /tn "WinZipDriverUpdater" /f | C:\Windows\System32\schtasks.exe | — | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3296 | "C:\Windows\System32\schtasks.exe" /delete /tn "WinZipDriverUpdaterRunAtStartup" /f | C:\Windows\System32\schtasks.exe | — | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\is-S2SPJ.tmp | — | |
MD5:— | SHA256:— | |||
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\is-J5KDM.tmp | — | |
MD5:— | SHA256:— | |||
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\is-GLOHC.tmp | — | |
MD5:— | SHA256:— | |||
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\is-NPR00.tmp | — | |
MD5:— | SHA256:— | |||
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\is-BJKMD.tmp | — | |
MD5:— | SHA256:— | |||
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\is-E508L.tmp | — | |
MD5:— | SHA256:— | |||
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\is-9NPF5.tmp | — | |
MD5:— | SHA256:— | |||
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\updater\amd64Helper\is-SKS80.tmp | — | |
MD5:— | SHA256:— | |||
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\updater\amd64Helper\is-929TC.tmp | — | |
MD5:— | SHA256:— | |||
3768 | C1E536477BC1612DC8BF9FAC39C09B63BE2A38A8BBFD40ECA504046CB3AB8586.tmp | C:\Program Files\WinZip Driver Updater\updater\amd64Helper\is-PIL6K.tmp | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2568 | iexplore.exe | GET | — | 2.18.232.154:80 | http://www.winzip.com/instcmplt.cgi?pid=WZDU&lang=EN&utm_source=winzip&utm_campaign=default&utm_medium=newbuild&LangID=en | unknown | — | — | whitelisted |
2568 | iexplore.exe | GET | 301 | 3.210.80.150:80 | http://www.winzipsystemtools.com/du/thank-you-for-installing.html | US | html | 274 b | whitelisted |
2568 | iexplore.exe | GET | 200 | 205.185.216.10:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 56.1 Kb | whitelisted |
2096 | winzipdu.exe | HEAD | 200 | 108.59.10.2:80 | http://updateservice4.systweak.com/KeymanagerWinZipDu/dbver.txt | US | — | — | malicious |
2096 | winzipdu.exe | GET | 200 | 108.59.10.2:80 | http://updateservice4.systweak.com/KeymanagerWinZipDu/dbver.txt | US | text | 206 b | malicious |
2568 | iexplore.exe | GET | 200 | 52.222.168.85:80 | http://x.ss2.us/x.cer | US | der | 1.27 Kb | whitelisted |
3896 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2096 | winzipdu.exe | POST | 200 | 108.59.10.2:80 | http://updateservice1.systweak.com/driverupdateservice8/updateservice.asmx | US | xml | 6.39 Kb | malicious |
2568 | iexplore.exe | GET | 200 | 209.15.36.91:80 | http://clickserv.sitescout.com/conv/5ab153e6d585b8d7 | US | image | 43 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2568 | iexplore.exe | 3.210.80.150:443 | www.winzipsystemtools.com | — | US | unknown |
2568 | iexplore.exe | 172.217.18.2:443 | www.googleadservices.com | Google Inc. | US | whitelisted |
2568 | iexplore.exe | 205.185.216.10:80 | www.download.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
2568 | iexplore.exe | 2.18.232.154:80 | www.winzip.com | Akamai International B.V. | — | whitelisted |
3896 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2568 | iexplore.exe | 3.210.80.150:80 | www.winzipsystemtools.com | — | US | unknown |
2568 | iexplore.exe | 52.222.168.85:80 | x.ss2.us | Amazon.com, Inc. | US | suspicious |
2568 | iexplore.exe | 172.217.21.232:443 | www.googletagmanager.com | Google Inc. | US | whitelisted |
2568 | iexplore.exe | 172.217.21.194:443 | adservice.google.com | Google Inc. | US | whitelisted |
2568 | iexplore.exe | 216.58.206.14:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.winzip.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.winzipsystemtools.com |
| whitelisted |
x.ss2.us |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |
www.googleadservices.com |
| whitelisted |
flex.atdmt.com |
| unknown |
dev.visualwebsiteoptimizer.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2096 | winzipdu.exe | A Network Trojan was detected | ET MALWARE Common Adware Library ISX User Agent Detected |
2096 | winzipdu.exe | A Network Trojan was detected | ET MALWARE Common Adware Library ISX User Agent Detected |