analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

AdobeCCCleaner430.exe

Full analysis: https://app.any.run/tasks/85a4868f-1f70-4182-af8d-d21c8baf3e47
Verdict: Malicious activity
Analysis date: June 27, 2022, 07:36:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

68D038DF2865499974066838880275C6

SHA1:

5D4725DE50F9CC7942917719DDF8B618F8AC37A2

SHA256:

CD8D565D1032452A3B443DB03222C07DB757D0F632B3D29E403EB486983B92D8

SSDEEP:

196608:NW3c9jL5ajf9w6WIMA9t9uQRJsxuG5DMHIbL9tnbSfsHi:43OjL+f9w6DMAhbG5HbL9tnbnC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops executable file immediately after starts

      • AdobeCCCleaner430.exe (PID: 2760)
      • ACToolMain.exe (PID: 2688)
    • Loads dropped or rewritten executable

      • ACToolMain.exe (PID: 3008)
    • Application was dropped or rewritten from another process

      • ACToolMain.exe (PID: 2688)
      • ACToolMain.exe (PID: 3008)
    • Tries to delete the host file

      • ACToolMain.exe (PID: 3008)
    • Writes to the hosts file

      • ACToolMain.exe (PID: 3008)
  • SUSPICIOUS

    • Checks supported languages

      • AdobeCCCleaner430.exe (PID: 2760)
      • ACToolMain.exe (PID: 2688)
      • cmd.exe (PID: 3428)
      • ACToolMain.exe (PID: 3008)
      • cmd.exe (PID: 1488)
      • cmd.exe (PID: 2020)
    • Reads the computer name

      • AdobeCCCleaner430.exe (PID: 2760)
      • ACToolMain.exe (PID: 3008)
    • Creates a directory in Program Files

      • AdobeCCCleaner430.exe (PID: 2760)
    • Executable content was dropped or overwritten

      • AdobeCCCleaner430.exe (PID: 2760)
      • ACToolMain.exe (PID: 2688)
    • Creates files in the program directory

      • AdobeCCCleaner430.exe (PID: 2760)
    • Drops a file with a compile date too recent

      • AdobeCCCleaner430.exe (PID: 2760)
      • ACToolMain.exe (PID: 2688)
    • Loads Python modules

      • ACToolMain.exe (PID: 3008)
    • Application launched itself

      • ACToolMain.exe (PID: 2688)
    • Starts CMD.EXE for commands execution

      • ACToolMain.exe (PID: 3008)
    • Creates files in the driver directory

      • ACToolMain.exe (PID: 3008)
    • Removes files from Windows directory

      • ACToolMain.exe (PID: 3008)
    • Creates files in the Windows directory

      • ACToolMain.exe (PID: 3008)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • AdobeCCCleaner430.exe (PID: 2760)
    • Reads the hosts file

      • ACToolMain.exe (PID: 3008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:05:11 15:43:35+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 107008
InitializedDataSize: 8168960
UninitializedDataSize: -
EntryPoint: 0xb3f6
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 4.3.0.95
ProductVersionNumber: 4.3.0.95
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Adobe System Incorporated.
FileDescription: Adobe Creative Cloud Cleaner Tool
FileVersion: 4.3.0.95
InternalName: PackageI.exe
LegalCopyright: © 2013-2017 Adobe Systems Incorporated and its licensors. All rights reserved.
OriginalFileName: PackageI.exe
ProductName: Adobe Creative Cloud Cleaner Tool
ProductVersion: 4.3.0.95

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 11-May-2020 13:43:35
Detected languages:
  • English - United States
Debug artifacts:
  • C:\builds\CleanerTool\CC18\source\WinUtils\PackageInstaller\Release\PackageInstaller.pdb
CompanyName: Adobe System Incorporated.
FileDescription: Adobe Creative Cloud Cleaner Tool
FileVersion: 4.3.0.95
InternalName: PackageI.exe
LegalCopyright: © 2013-2017 Adobe Systems Incorporated and its licensors. All rights reserved.
OriginalFilename: PackageI.exe
ProductName: Adobe Creative Cloud Cleaner Tool
ProductVersion: 4.3.0.95

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 11-May-2020 13:43:35
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001A039
0x0001A200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.59288
.rdata
0x0001C000
0x00009AEC
0x00009C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.75867
.data
0x00026000
0x0000155C
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.32224
.gfids
0x00028000
0x00000124
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.28389
.rsrc
0x00029000
0x007BDB80
0x007BDC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.99902
.reloc
0x007E7000
0x00001584
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.55447

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89623
392
UNKNOWN
English - United States
RT_MANIFEST
2
4.84949
9640
UNKNOWN
English - United States
RT_ICON
3
5.22542
4264
UNKNOWN
English - United States
RT_ICON
4
5.27518
1128
UNKNOWN
English - United States
RT_ICON
7
1.56933
56
UNKNOWN
English - United States
RT_STRING
13
2.8824
172
UNKNOWN
English - United States
RT_STRING
101
7.99902
8081972
UNKNOWN
English - United States
BINARY
104
2.44608
62
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start adobecccleaner430.exe no specs adobecccleaner430.exe actoolmain.exe actoolmain.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3264"C:\Users\admin\AppData\Local\Temp\AdobeCCCleaner430.exe" C:\Users\admin\AppData\Local\Temp\AdobeCCCleaner430.exeExplorer.EXE
User:
admin
Company:
Adobe System Incorporated.
Integrity Level:
MEDIUM
Description:
Adobe Creative Cloud Cleaner Tool
Exit code:
3221226540
Version:
4.3.0.95
2760"C:\Users\admin\AppData\Local\Temp\AdobeCCCleaner430.exe" C:\Users\admin\AppData\Local\Temp\AdobeCCCleaner430.exe
Explorer.EXE
User:
admin
Company:
Adobe System Incorporated.
Integrity Level:
HIGH
Description:
Adobe Creative Cloud Cleaner Tool
Exit code:
0
Version:
4.3.0.95
2688"C:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\ACToolMain.exe"C:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\ACToolMain.exe
AdobeCCCleaner430.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe Creative Cloud Cleaner Tool
Exit code:
0
Version:
4.3.0.95
3008"C:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\ACToolMain.exe"C:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\ACToolMain.exeACToolMain.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe Creative Cloud Cleaner Tool
Exit code:
0
Version:
4.3.0.95
3428C:\Windows\system32\cmd.exe /c clsC:\Windows\system32\cmd.exeACToolMain.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2020C:\Windows\system32\cmd.exe /c clsC:\Windows\system32\cmd.exeACToolMain.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1488C:\Windows\system32\cmd.exe /c clsC:\Windows\system32\cmd.exeACToolMain.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
318
Read events
318
Write events
0
Delete events
0

Modification events

No data
Executable files
31
Suspicious files
0
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
2760AdobeCCCleaner430.exeC:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\ProdInstallList.xml
MD5:
SHA256:
2760AdobeCCCleaner430.exeC:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\ACToolMain.exeexecutable
MD5:E5759A4734B5FDF4915E68981E74CDCA
SHA256:8636C7AF8B0FCB637FB6A1111E56D9FD5A27B36758DE8411561318F21126EF26
2760AdobeCCCleaner430.exeC:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\HFCLib.dllexecutable
MD5:87D1685D2B3FDE0EBED9F7637884FF3E
SHA256:F943319D4E846CC936FB947E5BCE726A0FC595FCF9C3DCBBE6BD410E0A191C95
2760AdobeCCCleaner430.exeC:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\ja_JP.txttext
MD5:CA810B6A8DD576BA9EC650215F12EEB8
SHA256:9C1C2DE2045E53CF703456EC4ACF9B70DBC0B9A1D808F17ADDEE3018BA538D8E
2760AdobeCCCleaner430.exeC:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\CleanUpRMDIR.exeexecutable
MD5:2B79635ECC4BAD95C38BAFACC5D3C303
SHA256:39634B1763C12BA8DB7AB97785726F931F2C0FB8F92D507B01F5E8D188A90CA2
2760AdobeCCCleaner430.exeC:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\adbcl.exeexecutable
MD5:1782A6D0E1769946DCF1EB0A1E6A4F42
SHA256:6794BF25CF9469E911CDF67D94F81466CEA83F1CCEDDA2B691AF470FF2BF469A
2760AdobeCCCleaner430.exeC:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\PIMDBWrapper.dllexecutable
MD5:DF048258264DDF8427215A1C0C7A5118
SHA256:85F8D1C2426A6E1FA50A7308841617A9F7B883A200E623506C5DE3577FFC1EB5
2760AdobeCCCleaner430.exeC:\Program Files\Common Files\Adobe\AdobeCreativeCloudCleanerTool\en_US.txttext
MD5:4ED6AA7443AF0AEE52974C6C69549B80
SHA256:654804E9C78CEA2D5644F47E516B4820BCDD56D017D69ECF0023612BF6887754
2688ACToolMain.exeC:\Users\admin\AppData\Local\Temp\_MEI26882\kernel32.dllexecutable
MD5:9667C2E00B7C9D353C17E806B7D01A04
SHA256:BABEC687EEF277642CC5B84FDAEA21D063DA371F98CBF084A61DC0AA75DC3A70
2688ACToolMain.exeC:\Users\admin\AppData\Local\Temp\_MEI26882\select.pydexecutable
MD5:038E5677095C0B9116743D2B3C4B7EB0
SHA256:ED1D6693403529C096414C9CBD31B0A83AEF16AFC0EA24A577BA26AF3353D221
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info