File name: | WinClient.exe |
Full analysis: | https://app.any.run/tasks/1cb1b890-f3b5-4f65-8416-cf6c00861f1a |
Verdict: | Malicious activity |
Analysis date: | October 20, 2020, 10:17:37 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 1F94352767F3885EBFDEFA6E5863D478 |
SHA1: | 46771BA31DC99B8F30E925188849C25972FAAA62 |
SHA256: | CD53EA3362C08660C329003254DFCC52933FBF5D5E7B15FAB53176C77C0B44B5 |
SSDEEP: | 49152:0Rf1adhkqK8i68rxuwkrW6uR200xp9l8Lige:WfwuqKlRUrW6uR299T |
.ax | | | DirectShow filter (46.3) |
---|---|---|
.exe | | | InstallShield setup (9.8) |
.exe | | | Win32 Executable MS Visual C++ (generic) (7.1) |
.exe | | | Win64 Executable (generic) (6.3) |
SpecialBuild: | - |
---|---|
ProductVersion: | 1, 0, 0, 1 |
ProductName: | WinClient Application |
PrivateBuild: | - |
OriginalFileName: | WinClient.EXE |
LegalTrademarks: | - |
LegalCopyright: | Copyright (C) 2008 |
InternalName: | WinClient |
FileVersion: | 1, 0, 0, 1 |
FileDescription: | WinClient MFC Application |
CompanyName: | - |
Comments: | - |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.0.0.1 |
FileVersionNumber: | 1.0.0.1 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x5d9f |
UninitializedDataSize: | - |
InitializedDataSize: | 2953538 |
CodeSize: | 24576 |
LinkerVersion: | 6 |
PEType: | PE32 |
TimeStamp: | 2016:02:26 01:59:38+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 26-Feb-2016 00:59:38 |
Detected languages: |
|
Comments: | - |
CompanyName: | - |
FileDescription: | WinClient MFC Application |
FileVersion: | 1, 0, 0, 1 |
InternalName: | WinClient |
LegalCopyright: | Copyright (C) 2008 |
LegalTrademarks: | - |
OriginalFilename: | WinClient.EXE |
PrivateBuild: | - |
ProductName: | WinClient Application |
ProductVersion: | 1, 0, 0, 1 |
SpecialBuild: | - |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000F8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 4 |
Time date stamp: | 26-Feb-2016 00:59:38 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00005344 | 0x00006000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.3802 |
.rdata | 0x00007000 | 0x0000199E | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.19784 |
.data | 0x00009000 | 0x000005B8 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.02197 |
.rsrc | 0x0000A000 | 0x00001458 | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.85971 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.34256 | 860 | UNKNOWN | English - United States | RT_VERSION |
7 | 1.94432 | 70 | UNKNOWN | English - United States | RT_STRING |
100 | 3.37387 | 274 | UNKNOWN | English - United States | RT_DIALOG |
102 | 3.05807 | 292 | UNKNOWN | English - United States | RT_DIALOG |
143 | 1.91924 | 20 | UNKNOWN | English - Canada | RT_GROUP_ICON |
ADVAPI32.dll |
KERNEL32.dll |
MFC42.DLL |
MSVCRT.dll |
USER32.dll |
VERSION.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2664 | "C:\Users\admin\Desktop\WinClient.exe" | C:\Users\admin\Desktop\WinClient.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: WinClient MFC Application Version: 1, 0, 0, 1 | ||||
1940 | Regsvr32 /s WinClient31.ocx | C:\Windows\system32\Regsvr32.exe | — | WinClient.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2664) WinClient.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Akvm\Viewer8601 |
Operation: | write | Name: | Filename |
Value: C:\Users\admin\Desktop\WinClient.exe | |||
(PID) Process: | (2664) WinClient.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\DirectInput\WINCLIENT.EXE56CFA37A002D8142 |
Operation: | write | Name: | Name |
Value: WINCLIENT.EXE | |||
(PID) Process: | (2664) WinClient.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\DirectInput\WINCLIENT.EXE56CFA37A002D8142 |
Operation: | write | Name: | UsesMapper |
Value: 00000000 | |||
(PID) Process: | (2664) WinClient.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication |
Operation: | write | Name: | Name |
Value: WINCLIENT.EXE | |||
(PID) Process: | (2664) WinClient.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication |
Operation: | write | Name: | Id |
Value: WINCLIENT.EXE56CFA37A002D8142 | |||
(PID) Process: | (2664) WinClient.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication |
Operation: | write | Name: | Version |
Value: 00080000 | |||
(PID) Process: | (2664) WinClient.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication |
Operation: | write | Name: | MostRecentStart |
Value: 4623E346CAA6D601 | |||
(PID) Process: | (2664) WinClient.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication |
Operation: | write | Name: | MostRecentStart |
Value: 7EAE1C54CAA6D601 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2664 | WinClient.exe | C:\Users\admin\AppData\Local\Temp\virtualkey_amd64.sys | executable | |
MD5:C3C0D165A3D28951CF04B66B28BED0E8 | SHA256:105D5B2EE896615466B6B993D3CE84810541051378FCCEC66C261A914D8E531D | |||
2664 | WinClient.exe | C:\Users\admin\AppData\Local\Temp\testinstall.exe | executable | |
MD5:1385552E2DA7FA090750E667114301DA | SHA256:DC249FC95D8B4007C8203990CA56F30E0210FEF53FF88F96987CD51D2D799047 | |||
2664 | WinClient.exe | C:\Users\admin\AppData\Local\Temp\virtualkey.sys | executable | |
MD5:55FE14D5FAC006D0F602C77D7F2A6FFF | SHA256:456C70E5EDE99232F3E92D58846003096BD7C59E29359D726304846A04796FB0 | |||
2664 | WinClient.exe | C:\Users\admin\AppData\Local\Temp\testinstall64.exe | executable | |
MD5:C2F27D9E8ED8D6D5D5F2E0BDE1B15534 | SHA256:4D7AB0A6B22F463B0873645A7FB76D7842A7540C1F4519122E64C8CB25DC1616 | |||
2664 | WinClient.exe | C:\USERS\ADMIN\TEMP\DEFAULT.INI | text | |
MD5:EBFE60484FC228D1C0AEC0EDCB7F04F4 | SHA256:4A0EF0FA91AD616F5C3566A9F878660FA88E40E8B10CA2BD3F93881CB021E463 | |||
2664 | WinClient.exe | C:\Users\admin\TEMP\WinClient31.ocx | executable | |
MD5:D37AC3EDD933C6BE9A262A8D9309E191 | SHA256:0D6F41EFAF935728BCFDE7351B92805499C6F77A33DFC952F7A1DB45E9F89BC5 |
Process | Message |
---|---|
WinClient.exe | Connect *** GetFromCmdLine tick = 2967171
|
WinClient.exe | Connect *** init1 tick = 2967203
|
WinClient.exe | Connect *** init1 before kvmdc tick = 2967375
|
WinClient.exe | Connect *** init2 before kvmdc tick = 2967375
|
WinClient.exe | Connect *** init3 before kvmdc tick = 2967421
|
WinClient.exe | Connect *** init4 before kvmdc tick = 2967437
|
WinClient.exe | Connect *** init7 before kvmdc tick = 2967562
|
WinClient.exe | Connect *** init8 before kvmdc tick = 2967562
|
WinClient.exe | Connect *** init9 before kvmdc tick = 2967562
|
WinClient.exe | Connect *** init1 after tick = 2967562
|