analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

EasyAntiCheat.zip

Full analysis: https://app.any.run/tasks/da780154-5f9b-48c1-9017-4042c1ebe8a1
Verdict: No threats detected
Analysis date: April 18, 2018, 12:32:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

35919775675B3CA730C06D47D1D890B9

SHA1:

60E2A2AF0853239191D4A826EFFBC0B871998445

SHA256:

CB6E06E8DE32CE1C8D3BCBFFE195884A009AA4D1B7F05C8EE213A779846FCAEB

SSDEEP:

24576:eQgzyXY4hz+TcrcSdHjIn6Lpk4wajkSbAB:eQEyXYWzNDCOk4XjLk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • EasyAntiCheat.exe (PID: 2688)
      • EasyAntiCheat.exe (PID: 3884)

  • SUSPICIOUS

    • Creates files in the program directory

      • EasyAntiCheat.exe (PID: 3884)

  • INFO

    • Dropped object may contain URL's

      • EasyAntiCheat.exe (PID: 3884)
      • 7zFM.exe (PID: 1476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: EasyAntiCheat/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2018:04:18 13:29:21
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start 7zfm.exe easyanticheat.exe no specs easyanticheat.exe

Process information

PID
CMD
Path
Indicators
Parent process
1476"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\admin\AppData\Local\Temp\EasyAntiCheat.zip"C:\Program Files\7-Zip\7zFM.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Version:
16.04
Modules
Images
c:\program files\7-zip\7zfm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2688"C:\Users\admin\AppData\Local\Temp\7zO4C5498E2\EasyAntiCheat.exe" C:\Users\admin\AppData\Local\Temp\7zO4C5498E2\EasyAntiCheat.exe—7zFM.exe
User:
admin
Company:
EasyAntiCheat Ltd
Integrity Level:
MEDIUM
Description:
EasyAntiCheat Service
Exit code:
3221226540
Version:
4, 0, 0, 0
Modules
Images
c:\users\admin\appdata\local\temp\7zo4c5498e2\easyanticheat.exe
c:\systemroot\system32\ntdll.dll
3884"C:\Users\admin\AppData\Local\Temp\7zO4C5498E2\EasyAntiCheat.exe" C:\Users\admin\AppData\Local\Temp\7zO4C5498E2\EasyAntiCheat.exe
7zFM.exe
User:
admin
Company:
EasyAntiCheat Ltd
Integrity Level:
HIGH
Description:
EasyAntiCheat Service
Exit code:
0
Version:
4, 0, 0, 0
Modules
Images
c:\users\admin\appdata\local\temp\7zo4c5498e2\easyanticheat.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
364
Read events
359
Write events
5
Delete events
0

Modification events

(PID) Process:(1476) 7zFM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1476) 7zFM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3884) EasyAntiCheat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\EasyAntiCheat
Operation:writeName:GamesInstalled
Value:
217;
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
14767zFM.exeC:\Users\admin\AppData\Local\Temp\7zO4C5498E2\EasyAntiCheat.exeexecutable
MD5:5B08D98CCDECE597D686C9A85A334FFC
SHA256:A428C0613072FCA56A4DFA32709355E265FAA148D1AE15B5A063094703EF1A8C
3884EasyAntiCheat.exeC:\Program Files\EasyAntiCheat\EasyAntiCheat.exeexecutable
MD5:5B08D98CCDECE597D686C9A85A334FFC
SHA256:A428C0613072FCA56A4DFA32709355E265FAA148D1AE15B5A063094703EF1A8C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup.title" not found in locale config.
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup.btn_install" not found in locale config.
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup.btn_uninstall" not found in locale config.
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup.btn_repair" not found in locale config.
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup.eac_link" not found in locale config.
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup.faq_link" not found in locale config.
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup.privacy_link" not found in locale config.
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup.licenses_link" not found in locale config.
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup_error.error_not_installed" not found in locale config.
EasyAntiCheat.exe
[EAC Setup] [Localization Error] Required string "setup.btn_install" not found in locale config.
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
EasyAntiCheat.zip