File name: | MaddStress.zip |
Full analysis: | https://app.any.run/tasks/fbe72fe4-b0b3-4514-ba86-44b9603609cb |
Verdict: | Malicious activity |
Analysis date: | September 30, 2020, 08:54:29 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | 25B9B6DEFD7F056B407958ACAA5057C1 |
SHA1: | BA90E6F0199674C3BB1652ED9B5FC865F5BCFB37 |
SHA256: | CBBFE50ABD4D77C9656A680F48130E6AD8864B23B467F43ADF9649EF83A6134A |
SSDEEP: | 49152:44NDbvX5+eNznr4G+hrDniEggLUi/XScBKr2G6jtYQh:44xXTNznrL+dvgQUivScBA2GFQh |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Installation/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2020:08:17 19:36:18 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 10 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1920 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MaddStress.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3172 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.42231\MaddStress.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.42231\MaddStress.exe | — | WinRAR.exe |
User: admin Company: DrWeabo Inc. Integrity Level: MEDIUM Description: MaddStress Exit code: 3221226540 Version: 0.0.3.0 | ||||
568 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.42231\MaddStress.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.42231\MaddStress.exe | WinRAR.exe | |
User: admin Company: DrWeabo Inc. Integrity Level: HIGH Description: MaddStress Exit code: 3489660927 Version: 0.0.3.0 | ||||
916 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.43889\MaddStress.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.43889\MaddStress.exe | — | WinRAR.exe |
User: admin Company: DrWeabo Inc. Integrity Level: MEDIUM Description: MaddStress Exit code: 3221226540 Version: 0.0.3.0 | ||||
3148 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.43889\MaddStress.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.43889\MaddStress.exe | WinRAR.exe | |
User: admin Company: DrWeabo Inc. Integrity Level: HIGH Description: MaddStress Exit code: 0 Version: 0.0.3.0 | ||||
3000 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.47173\MaddStress.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.47173\MaddStress.exe | — | WinRAR.exe |
User: admin Company: DrWeabo Inc. Integrity Level: MEDIUM Description: MaddStress Exit code: 3221226540 Version: 0.0.3.0 | ||||
2104 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.47173\MaddStress.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.47173\MaddStress.exe | WinRAR.exe | |
User: admin Company: DrWeabo Inc. Integrity Level: HIGH Description: MaddStress Version: 0.0.3.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
568 | MaddStress.exe | C:\Users\admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_StrongName_4kb5iypsijzzwpl5btaigbsziqp1cdgf\0.0.3.0\rs3ikpot.newcfg | — | |
MD5:— | SHA256:— | |||
568 | MaddStress.exe | C:\Users\admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_StrongName_4kb5iypsijzzwpl5btaigbsziqp1cdgf\0.0.3.0\rbrzvqv3.newcfg | — | |
MD5:— | SHA256:— | |||
568 | MaddStress.exe | C:\Users\admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_StrongName_4kb5iypsijzzwpl5btaigbsziqp1cdgf\0.0.3.0\ppnzpe1z.newcfg | — | |
MD5:— | SHA256:— | |||
3148 | MaddStress.exe | C:\Users\admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_StrongName_4kb5iypsijzzwpl5btaigbsziqp1cdgf\0.0.3.0\1l5m14p4.newcfg | — | |
MD5:— | SHA256:— | |||
3148 | MaddStress.exe | C:\Users\admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_StrongName_4kb5iypsijzzwpl5btaigbsziqp1cdgf\0.0.3.0\fswi3eoy.newcfg | — | |
MD5:— | SHA256:— | |||
3148 | MaddStress.exe | C:\Users\admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_StrongName_4kb5iypsijzzwpl5btaigbsziqp1cdgf\0.0.3.0\jpygrnki.newcfg | — | |
MD5:— | SHA256:— | |||
3148 | MaddStress.exe | C:\Users\admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_StrongName_4kb5iypsijzzwpl5btaigbsziqp1cdgf\0.0.3.0\oa2tz4jq.newcfg | — | |
MD5:— | SHA256:— | |||
3148 | MaddStress.exe | C:\Users\admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_StrongName_4kb5iypsijzzwpl5btaigbsziqp1cdgf\0.0.3.0\ua5aqddh.newcfg | — | |
MD5:— | SHA256:— | |||
3148 | MaddStress.exe | C:\Users\admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_StrongName_4kb5iypsijzzwpl5btaigbsziqp1cdgf\0.0.3.0\nmloroqz.newcfg | — | |
MD5:— | SHA256:— | |||
1920 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1920.42231\MaddStress.exe | executable | |
MD5:52C1265FD35131344319751559BF464F | SHA256:923315AE29FD603342611F4E9E1E18D691C917DF609C16302AC41D1CD76E6AD7 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3148 | MaddStress.exe | 216.58.210.14:443 | google.com | Google Inc. | US | whitelisted |
568 | MaddStress.exe | 172.217.23.132:443 | www.google.com | Google Inc. | US | whitelisted |
568 | MaddStress.exe | 216.58.210.14:443 | google.com | Google Inc. | US | whitelisted |
3148 | MaddStress.exe | 172.217.23.132:443 | www.google.com | Google Inc. | US | whitelisted |
3148 | MaddStress.exe | 77.111.240.106:443 | tools.feron.it | One.com A/S | DK | suspicious |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
www.google.com |
| whitelisted |
tools.feron.it |
| suspicious |