File name: | v6051_LinkManager_9.7.622134021.exe |
Full analysis: | https://app.any.run/tasks/3c65fec7-35b7-4d64-adb2-4809be5a0a71 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2022, 00:41:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 4733EECB733ED5AACF90D4541A6E6DDC |
SHA1: | 3670C4C9021EF70299700F4109FBF3EBBD1C753D |
SHA256: | CE9A51606F56A5136CEC7BFDB7AFDD2136F527FD1525DB5A73B42E5FDB04F331 |
SSDEEP: | 24576:DrLUomRzRsiNJVvtLakCAkaB3A/7NLFYK1RwTV87R9ih2/iouO7tUUKY/ZO:zTmJR71dabCkFFRwSokiouOxPKY |
.exe | | | Win32 Executable Borland Delphi 6 (93.8) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (2.3) |
.exe | | | Win32 Executable (generic) (1.6) |
.exe | | | Win16/32 Executable Delphi generic (0.7) |
.exe | | | Generic Win/DOS Executable (0.7) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 1992-Jun-19 22:22:17 |
Detected languages: |
|
e_magic: | MZ |
---|---|
e_cblp: | 80 |
e_cp: | 2 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | 15 |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | 26 |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 256 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 8 |
TimeDateStamp: | 1992-Jun-19 22:22:17 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
CODE | 4096 | 29228 | 29696 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.51167 |
DATA | 36864 | 536 | 1024 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.1517 |
BSS | 40960 | 43161 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.idata | 86016 | 2148 | 2560 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.17386 |
.tls | 90112 | 8 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.rdata | 94208 | 24 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 0.20692 |
.reloc | 98304 | 1484 | 1536 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 6.44309 |
.rsrc | 102400 | 5120 | 5120 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 3.73967 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.03563 | 4264 | UNKNOWN | Russian - Russia | RT_ICON |
DVCLAL | 4 | 16 | UNKNOWN | UNKNOWN | RT_RCDATA |
PACKAGEINFO | 6.90278 | 172 | UNKNOWN | UNKNOWN | RT_RCDATA |
MAINICON | 1.7815 | 20 | UNKNOWN | Russian - Russia | RT_GROUP_ICON |
advapi32.dll |
advapi32.dll (#2) |
gdi32.dll |
kernel32.dll |
kernel32.dll (#2) |
kernel32.dll (#3) |
oleaut32.dll |
shell32.dll |
user32.dll |
user32.dll (#2) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1592 | "C:\Users\admin\AppData\Local\Temp\v6051_LinkManager_9.7.622134021.exe" | C:\Users\admin\AppData\Local\Temp\v6051_LinkManager_9.7.622134021.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
3100 | "C:\Users\admin\AppData\Local\Temp\3582-490\v6051_LinkManager_9.7.622134021.exe" | C:\Users\admin\AppData\Local\Temp\3582-490\v6051_LinkManager_9.7.622134021.exe | — | v6051_LinkManager_9.7.622134021.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: LinkManager Setup Exit code: 3221226540 Version: 9.7.622134021 Modules
| |||||||||||||||
2472 | "C:\Users\admin\AppData\Local\Temp\3582-490\v6051_LinkManager_9.7.622134021.exe" | C:\Users\admin\AppData\Local\Temp\3582-490\v6051_LinkManager_9.7.622134021.exe | v6051_LinkManager_9.7.622134021.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: LinkManager Setup Exit code: 0 Version: 9.7.622134021 Modules
| |||||||||||||||
3364 | .\LinkManager-x86-setup.exe | C:\Program Files\LinkManager-x86-setup.exe | v6051_LinkManager_9.7.622134021.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: LinkManager Setup Exit code: 0 Version: 9.7.622134021 Modules
| |||||||||||||||
1412 | "C:\Users\admin\AppData\Local\Temp\nsi39C.tmp\ns3ABB.tmp" cscript winfw.js add "Secomea LinkManagerTray" "C:\Program Files\Secomea\LinkManager\LinkManagerTray.exe" | C:\Users\admin\AppData\Local\Temp\nsi39C.tmp\ns3ABB.tmp | — | LinkManager-x86-setup.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
2700 | cscript winfw.js add "Secomea LinkManagerTray" "C:\Program Files\Secomea\LinkManager\LinkManagerTray.exe" | C:\Windows\system32\cscript.exe | — | ns3ABB.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
1640 | "C:\Users\admin\AppData\Local\Temp\nsi39C.tmp\ns3BA6.tmp" cmd /c start /w "" "C:\Program Files\Secomea\LinkManager\LinkManagerSvc.exe" -install | C:\Users\admin\AppData\Local\Temp\nsi39C.tmp\ns3BA6.tmp | — | LinkManager-x86-setup.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
824 | cmd /c start /w "" "C:\Program Files\Secomea\LinkManager\LinkManagerSvc.exe" -install | C:\Windows\system32\cmd.exe | — | ns3BA6.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1820 | "C:\Program Files\Secomea\LinkManager\LinkManagerSvc.exe" -install | C:\Program Files\Secomea\LinkManager\LinkManagerSVC.exe | — | cmd.exe | |||||||||||
User: admin Company: Secomea Integrity Level: HIGH Description: LinkManager Service Exit code: 0 Version: 9.7.622134021 Modules
| |||||||||||||||
404 | "C:\Users\admin\AppData\Local\Temp\nsi39C.tmp\ns3C14.tmp" net start LinkManagerSvc | C:\Users\admin\AppData\Local\Temp\nsi39C.tmp\ns3C14.tmp | — | LinkManager-x86-setup.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
|
(PID) Process: | (1592) v6051_LinkManager_9.7.622134021.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1592) v6051_LinkManager_9.7.622134021.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (1592) v6051_LinkManager_9.7.622134021.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (1592) v6051_LinkManager_9.7.622134021.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (3364) LinkManager-x86-setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CDC7DCFD-42EE-4A59-A6F5-161155BAF7CB} |
Operation: | write | Name: | DisplayName |
Value: Secomea LinkManager | |||
(PID) Process: | (3364) LinkManager-x86-setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CDC7DCFD-42EE-4A59-A6F5-161155BAF7CB} |
Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\Secomea\LinkManager\LinkManagerTray.exe | |||
(PID) Process: | (3364) LinkManager-x86-setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CDC7DCFD-42EE-4A59-A6F5-161155BAF7CB} |
Operation: | write | Name: | DisplayVersion |
Value: 9.7.622134021 | |||
(PID) Process: | (3364) LinkManager-x86-setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CDC7DCFD-42EE-4A59-A6F5-161155BAF7CB} |
Operation: | write | Name: | Publisher |
Value: Secomea A/S | |||
(PID) Process: | (3364) LinkManager-x86-setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CDC7DCFD-42EE-4A59-A6F5-161155BAF7CB} |
Operation: | write | Name: | UninstallString |
Value: "C:\Program Files\Secomea\LinkManager\uninstall8.exe" | |||
(PID) Process: | (3364) LinkManager-x86-setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CDC7DCFD-42EE-4A59-A6F5-161155BAF7CB} |
Operation: | write | Name: | NoModify |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1592 | v6051_LinkManager_9.7.622134021.exe | C:\Users\admin\AppData\Local\Temp\3582-490\v6051_LinkManager_9.7.622134021.exe | executable | |
MD5:6D84C0F3F63BAA04B718B54858D371CE | SHA256:F1EB2B7A41EAD01A2AC4D5316A43A43BD87A149933336FEFE54DD914444939C5 | |||
2472 | v6051_LinkManager_9.7.622134021.exe | C:\Program Files\LinkManager-x86-setup.exe | executable | |
MD5:D4A8BC2595ABCEC60B9F749E072F087B | SHA256:73A2DBF9AEE90D5C15FC785875B7C8E7049F30DC83986040393138FD3B981930 | |||
1592 | v6051_LinkManager_9.7.622134021.exe | C:\MSOCache\All Users\{90140000-006E-0416-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:02EE6A3424782531461FB2F10713D3C1 | SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC | |||
1592 | v6051_LinkManager_9.7.622134021.exe | C:\MSOCache\All Users\{90140000-006E-0412-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:02EE6A3424782531461FB2F10713D3C1 | SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC | |||
1592 | v6051_LinkManager_9.7.622134021.exe | C:\MSOCache\All Users\{90140000-006E-0419-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:02EE6A3424782531461FB2F10713D3C1 | SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC | |||
2472 | v6051_LinkManager_9.7.622134021.exe | C:\Users\admin\AppData\Local\Temp\nsx2C1.tmp\System.dll | executable | |
MD5:FBE295E5A1ACFBD0A6271898F885FE6A | SHA256:A1390A78533C47E55CC364E97AF431117126D04A7FAED49390210EA3E89DD0E1 | |||
1592 | v6051_LinkManager_9.7.622134021.exe | C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\setup.exe | executable | |
MD5:566ED4F62FDC96F175AFEDD811FA0370 | SHA256:E17CD94C08FC0E001A49F43A0801CEA4625FB9AEE211B6DFEBEBEC446C21F460 | |||
1592 | v6051_LinkManager_9.7.622134021.exe | C:\MSOCache\All Users\{90140000-006E-0407-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:02EE6A3424782531461FB2F10713D3C1 | SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC | |||
1592 | v6051_LinkManager_9.7.622134021.exe | C:\MSOCache\All Users\{90140000-006E-0411-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:02EE6A3424782531461FB2F10713D3C1 | SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC | |||
1592 | v6051_LinkManager_9.7.622134021.exe | C:\MSOCache\All Users\{90140000-006E-0410-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:02EE6A3424782531461FB2F10713D3C1 | SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC |