download: | DatairPDF5019.exe |
Full analysis: | https://app.any.run/tasks/f5367428-dd08-4b6e-b6e7-05a0127dd918 |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 19:53:44 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 97283EB481B0757C193A140D089B9A80 |
SHA1: | FF2427C01E6E582A11436869ECA379DD2445D1E2 |
SHA256: | CDA7A7F6CDE61F1B019DF39DA89FA0E39B230F6C1172858B689EECA2428F5CBD |
SSDEEP: | 196608:8RgZcdq+DY6uLV5gTr+5XD2zXSvB+ZQc2sGTFxr97+O7ToQmBTzBVcTfEAVo9ExN:8hq+DYDXire/sGz57UQuzBVr9E9l |
.exe | | | Wise Installer executable (91.7) |
---|---|---|
.exe | | | Win64 Executable (generic) (5.3) |
.dll | | | Win32 Dynamic Link Library (generic) (1.2) |
.exe | | | Win32 Executable (generic) (0.8) |
.exe | | | Generic Win/DOS Executable (0.3) |
LegalCopyright: | (c) 1995-2006 DATAIR |
---|---|
FileVersion: | 1.2 |
FileDescription: | DATAIR Pension Reporter |
CompanyName: | DATAIR Employee Benefit Systems, Inc. |
CharacterSet: | Windows, Latin1 |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Windows 16-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.20.0.0 |
FileVersionNumber: | 1.20.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | 4 |
OSVersion: | 4 |
EntryPoint: | 0x21af |
UninitializedDataSize: | - |
InitializedDataSize: | 5632 |
CodeSize: | 8704 |
LinkerVersion: | 6 |
PEType: | PE32 |
TimeStamp: | 2001:08:13 19:13:38+02:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
776 | "C:\Users\admin\AppData\Local\Temp\DatairPDF5019.exe" | C:\Users\admin\AppData\Local\Temp\DatairPDF5019.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
3036 | "C:\Users\admin\AppData\Local\Temp\DatairPDF5019.exe" | C:\Users\admin\AppData\Local\Temp\DatairPDF5019.exe | explorer.exe | |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
2260 | "C:\Users\admin\AppData\Local\Temp\pdf\Install.exe" /S | C:\Users\admin\AppData\Local\Temp\pdf\Install.exe | DatairPDF5019.exe | |
User: admin Company: Amyuni Technologies Integrity Level: HIGH Description: Amyuni PDF Converter Installer Exit code: 0 Version: 1.0.0.1 | ||||
840 | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | C:\Windows\System32\svchost.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2432 | DrvInst.exe "4" "8" "C:\Users\admin\AppData\Local\Temp\{729b2705-18c8-5023-cbc4-5202cc45a34c}\amyuni.inf" "0" "6a49fb0a3" "000003E4" "WinSta0\Default" "000005A4" "208" "c:\users\admin\appdata\local\temp\pdf" | C:\Windows\system32\DrvInst.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1204 | C:\Windows\System32\spoolsv.exe | C:\Windows\System32\spoolsv.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Spooler SubSystem App Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0000.TMP | — | |
MD5:— | SHA256:— | |||
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0001.TMP | — | |
MD5:— | SHA256:— | |||
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0002.TMP | — | |
MD5:— | SHA256:— | |||
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0003.TMP | — | |
MD5:— | SHA256:— | |||
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0004.TMP | — | |
MD5:— | SHA256:— | |||
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0005.TMP | — | |
MD5:— | SHA256:— | |||
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0006.TMP | — | |
MD5:— | SHA256:— | |||
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0007.TMP | — | |
MD5:— | SHA256:— | |||
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0008.TMP | — | |
MD5:— | SHA256:— | |||
3036 | DatairPDF5019.exe | C:\Users\admin\AppData\Local\Temp\pdf\~GLH0009.TMP | — | |
MD5:— | SHA256:— |