download: | bdcamsetup.exe |
Full analysis: | https://app.any.run/tasks/c43bd7d1-f95a-4838-882d-0a1c685fed51 |
Verdict: | Malicious activity |
Analysis date: | February 21, 2020, 20:19:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | DC27BFE7D7CCE351FA95EA11E3603319 |
SHA1: | 1CC2FFF1D12A68A738F9CC5D6A5D78E64E284026 |
SHA256: | C228A8B9DB1B2E368D2900F12AE7CA842920C9932225F3E29356C249B604297C |
SSDEEP: | 393216:ftmg+LSxRbEKpBktGw5qg1eJmJB4k920w2alwbYwjahPuXHvtWNfznm4h4vp:VmgjhEKpByqeekjZjw5lwbYwja0PYNrg |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
ProductName: | Bandicam |
---|---|
LegalCopyright: | Copyright(C) 2009-2020 Bandicam.com, All rights reserved. |
FileVersion: | 4.5.6.1647 |
FileDescription: | Bandicam Setup File |
CompanyName: | Bandicam Company |
Comments: | Bandicam Setup File (2020-02-20 오전 12:52:41) |
CharacterSet: | Windows, Arabic |
LanguageCode: | Arabic |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0000 |
ProductVersionNumber: | 4.5.6.1647 |
FileVersionNumber: | 4.5.6.1647 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | 6 |
OSVersion: | 4 |
EntryPoint: | 0x32fe |
UninitializedDataSize: | 2048 |
InitializedDataSize: | 141824 |
CodeSize: | 25088 |
LinkerVersion: | 6 |
PEType: | PE32 |
TimeStamp: | 2016:12:11 22:50:41+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 11-Dec-2016 21:50:41 |
Detected languages: |
|
Comments: | Bandicam Setup File (2020-02-20 오전 12:52:41) |
CompanyName: | Bandicam Company |
FileDescription: | Bandicam Setup File |
FileVersion: | 4.5.6.1647 |
LegalCopyright: | Copyright(C) 2009-2020 Bandicam.com, All rights reserved. |
ProductName: | Bandicam |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000C8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 11-Dec-2016 21:50:41 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0000608D | 0x00006200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.4239 |
.rdata | 0x00008000 | 0x000013A4 | 0x00001400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.16231 |
.data | 0x0000A000 | 0x000202F8 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.89813 |
.ndata | 0x0002B000 | 0x00017000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00042000 | 0x00019AD8 | 0x00019C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.81214 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.28813 | 1070 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 4.67767 | 9640 | UNKNOWN | English - United States | RT_ICON |
3 | 5.31734 | 4264 | UNKNOWN | English - United States | RT_ICON |
4 | 5.28764 | 3752 | UNKNOWN | English - United States | RT_ICON |
5 | 5.66571 | 2216 | UNKNOWN | English - United States | RT_ICON |
6 | 5.26475 | 1384 | UNKNOWN | English - United States | RT_ICON |
7 | 5.82212 | 1128 | UNKNOWN | English - United States | RT_ICON |
102 | 2.72924 | 180 | UNKNOWN | English - United States | RT_DIALOG |
103 | 2.71858 | 104 | UNKNOWN | English - United States | RT_GROUP_ICON |
104 | 2.6693 | 280 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3596 | "C:\Users\admin\Desktop\bdcamsetup.exe" | C:\Users\admin\Desktop\bdcamsetup.exe | — | explorer.exe |
User: admin Company: Bandicam Company Integrity Level: MEDIUM Description: Bandicam Setup File Exit code: 3221226540 Version: 4.5.6.1647 | ||||
3296 | "C:\Users\admin\Desktop\bdcamsetup.exe" | C:\Users\admin\Desktop\bdcamsetup.exe | explorer.exe | |
User: admin Company: Bandicam Company Integrity Level: HIGH Description: Bandicam Setup File Exit code: 0 Version: 4.5.6.1647 | ||||
2976 | "C:\Users\admin\AppData\Local\Temp\BDMPEG1SETUP.EXE" /S | C:\Users\admin\AppData\Local\Temp\BDMPEG1SETUP.EXE | bdcamsetup.exe | |
User: admin Company: Bandicam Company Integrity Level: HIGH Description: Bandicam MPEG-1 Decoder Setup File Exit code: 0 Version: V1.0.5.17 | ||||
2812 | "regsvr32" /s "C:\Program Files\BandiMPEG1\bdfilters64.dll" | C:\Windows\system32\regsvr32.exe | — | BDMPEG1SETUP.EXE |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3352 | "C:\Program Files\Bandicam\bdcam.exe" /install | C:\Program Files\Bandicam\bdcam.exe | — | bdcamsetup.exe |
User: admin Company: Bandicam Company Integrity Level: HIGH Description: Bandicam - bdcam.exe Exit code: 0 Version: 4.5.6.1647 | ||||
1740 | "C:\Windows\system32\rundll32.exe" "C:\Program Files\Bandicam\bdcamvk32.dll",RegDll | C:\Windows\system32\rundll32.exe | — | bdcam.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3308 | "C:\Program Files\Bandicam\bdcam.exe" | C:\Program Files\Bandicam\bdcam.exe | bdcamsetup.exe | |
User: admin Company: Bandicam Company Integrity Level: HIGH Description: Bandicam - bdcam.exe Version: 4.5.6.1647 | ||||
2736 | "C:\Program Files\Bandicam\bdcam.exe" /install | C:\Program Files\Bandicam\bdcam.exe | — | bdcamsetup.exe |
User: admin Company: Bandicam Company Integrity Level: HIGH Description: Bandicam - bdcam.exe Exit code: 0 Version: 4.5.6.1647 | ||||
1944 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.bandicam.com/f.php?id=eng_app_complete_install&v=2&lang=en | C:\Program Files\Internet Explorer\iexplore.exe | — | bdcamsetup.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
3828 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1944 CREDAT:275457 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2976 | BDMPEG1SETUP.EXE | C:\Users\admin\AppData\Local\Temp\nsiB466.tmp\System.dll | — | |
MD5:— | SHA256:— | |||
2976 | BDMPEG1SETUP.EXE | C:\Users\admin\AppData\Local\Temp\nsbB138.tmp | — | |
MD5:— | SHA256:— | |||
3296 | bdcamsetup.exe | C:\Users\admin\AppData\Local\Temp\nsb8B22.tmp\ioSpecial.ini | text | |
MD5:F9340677EFE66D4BF993D26F20C8FBD8 | SHA256:0120B35F8D259CCF66676AA50ED3D504CA9714007DEE05CFA9FF8B62970C3590 | |||
3296 | bdcamsetup.exe | C:\Users\admin\AppData\Local\Temp\nsb8B22.tmp\System.dll | executable | |
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD | SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB | |||
2976 | BDMPEG1SETUP.EXE | C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 | log | |
MD5:760ECE7358DB10DD8B241705FDFB9B14 | SHA256:3C118C13EC92AF1333F1E6B87834026CB127EB5BD72CA885EFA5BE591E20E262 | |||
2976 | BDMPEG1SETUP.EXE | C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat | hiv | |
MD5:C552EED51E7C7E752867AAC028ECD385 | SHA256:05ED2F5D7FB954C74200523434FBA5F32B1684E0B0593707DC9F5C28E68CB9DF | |||
3296 | bdcamsetup.exe | C:\Users\admin\AppData\Local\Temp\nsb8B22.tmp\UserInfo.dll | executable | |
MD5:1B446B36F5B4022D50FFDC0CF567B24A | SHA256:2862C7BC7F11715CEBDEA003564A0D70BF42B73451E2B672110E1392EC392922 | |||
2976 | BDMPEG1SETUP.EXE | C:\Users\Administrator\NTUSER.DAT.LOG1 | log | |
MD5:133D8F7EBCC3A901AACA41489DEF8F87 | SHA256:ED0DD83DBA500E52151B0CFBC41E769E2BC6CD992B2A18BAF3D6BD9AC627851A | |||
3296 | bdcamsetup.exe | C:\Program Files\Bandicam\bdcam.exe | executable | |
MD5:A566D379397AA3EAE0E148AEF654299E | SHA256:5EECCE5B7D213CDA99645776A4E43E7350914B52AD8BD0ADD333168C384A66C1 | |||
2976 | BDMPEG1SETUP.EXE | C:\Users\Administrator\NTUSER.DAT | hiv | |
MD5:8E59F8E0A7D9586B09DF5C0D436F4BC8 | SHA256:0F4FD9B9AC25AE6CDBDB636612A0EAECEF05D033E46CC112E32217C728F9C2B8 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3308 | bdcam.exe | GET | 200 | 151.101.2.133:80 | http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80 | US | der | 1.49 Kb | whitelisted |
3308 | bdcam.exe | GET | 200 | 172.217.16.195:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCgdZM8AVzzKAgAAAAALnDU | US | der | 472 b | whitelisted |
3308 | bdcam.exe | GET | 200 | 172.217.16.195:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
3188 | vlc.exe | GET | 206 | 88.191.250.2:80 | http://update.videolan.org/vlc/status-win-x86 | FR | text | 287 b | malicious |
3308 | bdcam.exe | GET | 200 | 151.101.2.133:80 | http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80 | US | der | 1.49 Kb | whitelisted |
3188 | vlc.exe | GET | 206 | 88.191.250.2:80 | http://update.videolan.org/vlc/status-win-x86.asc | FR | asc | 195 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3308 | bdcam.exe | 151.101.2.133:80 | ocsp.globalsign.com | Fastly | US | malicious |
3308 | bdcam.exe | 172.217.16.195:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
3308 | bdcam.exe | 151.101.2.217:443 | www.bandicam.com | Fastly | US | suspicious |
3308 | bdcam.exe | 172.217.22.46:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
3188 | vlc.exe | 88.191.250.2:80 | update.videolan.org | Free SAS | FR | malicious |
3828 | iexplore.exe | 151.101.2.217:443 | www.bandicam.com | Fastly | US | suspicious |
Domain | IP | Reputation |
---|---|---|
www.bandicam.com |
| whitelisted |
ocsp.globalsign.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
update.videolan.org |
| unknown |
Process | Message |
---|---|
vlc.exe | core libvlc: one instance mode ENABLED
|
vlc.exe | core libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
|
vlc.exe | direct3d vout display error: Could not read adapter capabilities. (hr=0x8876086A)
|
vlc.exe | direct3d vout display error: Direct3D could not be initialized
|
vlc.exe | core libvlc: one instance mode ENABLED
|
vlc.exe | core libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
|
vlc.exe | core libvlc: Status file authenticated
|
vlc.exe | direct3d vout display error: Could not read adapter capabilities. (hr=0x8876086A)
|
vlc.exe | direct3d vout display error: Direct3D could not be initialized
|