analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

dq.exe

Full analysis: https://app.any.run/tasks/22501ffb-33eb-4a60-9a10-f6271234f635
Verdict: Malicious activity
Analysis date: August 12, 2022, 19:08:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

6FB99953C19C6ECE7FA10C134D60DF08

SHA1:

6BED7C4E779AA9D05D3FCF14B83F9A79D88C6407

SHA256:

CA7967AB5082CB6D54E4AD03F6E2C7813A8634D296C2B01B3A261A1A98ACEBE5

SSDEEP:

24576:9+p+BIIpLwHHDhFfPTUV0qd9Csu6G2hMKP/NJAfV3:A+BDG8KuFG2KKP/N+fV3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Modifies files in Chrome extension folder

      • dq.exe (PID: 3128)

  • SUSPICIOUS

    • Checks supported languages

      • dq.exe (PID: 3128)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

Subsystem: Windows command line
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x966ca
UninitializedDataSize: -
InitializedDataSize: 380416
CodeSize: 723968
LinkerVersion: 14.29
PEType: PE32
TimeStamp: 2022:08:12 21:08:18+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 12-Aug-2022 19:08:18
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000108

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 12-Aug-2022 19:08:18
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000B0B34
0x000B0C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.6154
.rdata
0x000B2000
0x0004AD74
0x0004AE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.20402
.data
0x000FD000
0x00007E34
0x00005200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.88548
.rsrc
0x00105000
0x000001E0
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.7123
.reloc
0x00106000
0x00009C60
0x00009E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.58979

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
CRYPT32.dll
KERNEL32.dll
USER32.dll
WS2_32.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dq.exe

Process information

PID
CMD
Path
Indicators
Parent process
3128"C:\Users\admin\Desktop\dq.exe" C:\Users\admin\Desktop\dq.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Total events
133
Read events
133
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
5
Text files
36
Unknown types
1

Dropped files

PID
Process
Filename
Type
3128dq.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\7a328c54d8b72db620ea38e0521ee98416703213854d3bd22bc13a57a352eb52.sth.protectedtext
MD5:27948F5EAB09C828EB489DF04FC41145
SHA256:C7EC0D7C0DAE91F1E91A28D8D602EA42FD26CC463E51008840BAFD3927E835EF
3128dq.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\warning_icon_200.png.protectedtext
MD5:C2F7FFC4B6DF312B36B587AB7E57DE68
SHA256:2B4D48550FEA03F803F91084C085DD7E39FE94813406E6DA886434DE374F930E
3128dq.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\status_icon_caution_100.png.protectedtext
MD5:69AF0778B731476286B388C57887C683
SHA256:908DD2BA8048010CEFC803BEF3CC02C445899202BF9D56D2D2A4BBAD31D8F23D
3128dq.exeC:\Users\admin\Desktop\telephonemartin.png.protectedtext
MD5:C1D23DD94BF59BFF6A30662ADD920535
SHA256:1AA8D6734D4C0F09A62B846B535ADA963DEBDE17066D495C99442A3BF73F9470
3128dq.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\yellow_button_mini_150.png.protectedtext
MD5:2E02C27D98FB252B141508A557311A31
SHA256:FB027ADB8BDF8C0AF360F04A8AA3BC69CE67545277004AB6337E0CF25101B511
3128dq.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\c652a0ec48ceb3fcab170992c43a87413309e80065a26252401ba3362a17c565.sth.protectedtext
MD5:00C18CB6B7F567E6B7ED9473DDD41817
SHA256:6FD10A360EAA918EBDD143F222CBE4D820769932DE9EEACE3DD660C9276E2E06
3128dq.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation\6143\LICENSE.protectedtext
MD5:75FEF4F83D51F374512133B7969863A1
SHA256:297453549E1EC1F0F70D0C53FD2BE7980722F24DFFCC5D6BA966CE4C5ED87A59
3128dq.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\35cf191bbfb16c57bf0fad4c6d42cbbbb627202651ea3fe12aefa803c33bd64c.sth.protectedtext
MD5:45B7A91DBDA3DCF5D5736113E8883696
SHA256:46CC11ED8C070457562760B88A37B4176365D81A507A5E60D7B16393AFCE3530
3128dq.exeC:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url.protectedtext
MD5:66A8DE1A355C30D12EC92C0B1F3BB1EF
SHA256:645C260D027B30E72C464307490FC27EABC5FDA9B6FEB5F6FCE76AC28E4D2813
3128dq.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\yellow_button_short_200.png.protectedtext
MD5:CFFAB8C39B9E1E2D0CE439AEC520FB0D
SHA256:74DA1F6EB7C46D627313D2357660990A6D06BC9FFBC9D4BACC9F99F39AE613EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
dq.exe