File name: | NulleHash_KX99.rar |
Full analysis: | https://app.any.run/tasks/93d9728c-0101-490d-8e20-f722f6cc0eed |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 21:49:19 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 7A99CE0A526A871A8415A89C34119D24 |
SHA1: | E02A33A5F7D90AB8038E60B24901FC819EC3855B |
SHA256: | C99544625A5D9DCBA99C51FC8ED1163FC01E62559E001B33B34B406EE742BA62 |
SSDEEP: | 3072:tpBo+1p3d85gxPFxvLM9MRka4xx1aeBBaDbpGJNE8Y4Pnj0uAWqnVoA7fBdGk+Z:tLoWpW5g9vQ9zZxaeB2pINlYCPAjyA70 |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1592 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NulleHash_KX99.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3624 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
2244 | "C:\Users\admin\Desktop\NulleHash KX99\NulleHash Decryptor.exe" | C:\Users\admin\Desktop\NulleHash KX99\NulleHash Decryptor.exe | explorer.exe | |
User: admin Company: Nulled.To Integrity Level: MEDIUM Description: NulleHash Decrypter Exit code: 3762504530 Version: 1.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1592 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1592.2184\NulleHash KX99\NulleHash Decryptor.exe | executable | |
MD5:3C2DED7B946A2309D84A2B0684C09B13 | SHA256:F90DEF8E90CD085E49D3A94752DEBE9301E3FA16B13CFE6E2E2071EA611E285E | |||
1592 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1592.2184\NulleHash KX99\xNet.dll | executable | |
MD5:AC1DCEDDBC66A1AB7915AC9931F0CFEC | SHA256:CC949931EF9533ADCED83F3D58862E9732E5DB7AD17B5FD4CB9D209A99EDB592 | |||
1592 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1592.2184\NulleHash KX99\Colorful.Console.dll | executable | |
MD5:5F3D2CFBC21591B8FEEF1EFA3E59A4D0 | SHA256:F31D4FD7E729FC6CF4ECAB972B6B1EE897918A325B1CA572030966F831E768FB |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2244 | NulleHash Decryptor.exe | 104.27.55.95:443 | www.nulled.to | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
www.nulled.to |
| unknown |