| File name: | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe |
| Full analysis: | https://app.any.run/tasks/4711c277-78f4-458c-b707-d046d56829b9 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | March 07, 2019, 22:33:19 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive |
| MD5: | 465EE99C593EF411B2B96E67A8DC7653 |
| SHA1: | 49AD649E65393996EE54E4AAF8F252E84AE1B325 |
| SHA256: | CF17EB5E648907FFEBF6DD6F07F215759B9FE5A62E4D11FFDD1828AB5169B6A4 |
| SSDEEP: | 24576:pHVasqIT4Av8WcBylo51yFVMlPNGuYKX/tLkCq8dUnnRk6jpw:vaaTYOFGlEF8/t4Y |
| .exe | | | Win32 Executable MS Visual C++ (generic) (41) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (36.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.6) |
| .exe | | | Win32 Executable (generic) (5.9) |
| .exe | | | Win16/32 Executable Delphi generic (2.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2016:09:04 00:28:04+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 2.5 |
| CodeSize: | 201728 |
| InitializedDataSize: | 259072 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1000 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 03-Sep-2016 22:28:04 |
| Detected languages: |
|
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 03-Sep-2016 22:28:04 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.code | 0x00001000 | 0x00008C0B | 0x00008E00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.48422 |
.text | 0x0000A000 | 0x0002842C | 0x00028600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.55935 |
.rdata | 0x00033000 | 0x000054AC | 0x00005600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.67857 |
.data | 0x00039000 | 0x00033384 | 0x00032000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.97815 |
.rsrc | 0x0006D000 | 0x00006840 | 0x00006A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.84101 |
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.8674 | 874 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 4.30941 | 744 | UNKNOWN | English - United States | RT_ICON |
3 | 4.03304 | 296 | UNKNOWN | English - United States | RT_ICON |
4 | 6.4265 | 3752 | UNKNOWN | English - United States | RT_ICON |
5 | 6.64193 | 2216 | UNKNOWN | English - United States | RT_ICON |
6 | 5.61672 | 1384 | UNKNOWN | English - United States | RT_ICON |
7 | 5.11499 | 9640 | UNKNOWN | English - United States | RT_ICON |
8 | 5.62416 | 4264 | UNKNOWN | English - United States | RT_ICON |
9 | 6.05238 | 1128 | UNKNOWN | English - United States | RT_ICON |
ADVAPI32.DLL |
COMCTL32.DLL |
GDI32.DLL |
IMAGEHLP.DLL |
KERNEL32.dll |
MSVCRT.dll |
OLE32.DLL |
SETUPAPI.DLL |
SHELL32.DLL |
USER32.DLL |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3124 | "C:\Users\admin\AppData\Local\Temp\Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe" | C:\Users\admin\AppData\Local\Temp\Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 3576 | "C:\Users\admin\AppData\Local\Temp\Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe" | C:\Users\admin\AppData\Local\Temp\Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3764 | "C:\Program Files\Proxy Shark 2018 v1.4 (Vip Pro Edition)\Proxy Shark 2018 v1.4 (Vip Pro Edition).exe" run | C:\Program Files\Proxy Shark 2018 v1.4 (Vip Pro Edition)\Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | ||||||||||||
User: admin Company: Pooria Sharaffodin www.ProxyShark.net - www.Babatools.com Integrity Level: HIGH Description: Proxy Shark 2018 v1.4 (Vip Pro Edition) Exit code: 0 Version: 1.4.0.0 Modules
| |||||||||||||||
| (PID) Process: | (3576) Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\DirectSound\Speaker Configuration |
| Operation: | write | Name: | Speaker Configuration |
Value: 4 | |||
| (PID) Process: | (3576) Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Proxy Shark 2018 v1.4 (Vip Pro Edition) |
| Operation: | write | Name: | DisplayName |
Value: Proxy Shark 2018 v1.4 (Vip Pro Edition) | |||
| (PID) Process: | (3576) Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Proxy Shark 2018 v1.4 (Vip Pro Edition) |
| Operation: | write | Name: | DisplayVersion |
Value: 1.4 | |||
| (PID) Process: | (3576) Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Proxy Shark 2018 v1.4 (Vip Pro Edition) |
| Operation: | write | Name: | HelpLink |
Value: http://www.BabaTools.com | |||
| (PID) Process: | (3576) Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Proxy Shark 2018 v1.4 (Vip Pro Edition) |
| Operation: | write | Name: | Publisher |
Value: | |||
| (PID) Process: | (3576) Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Proxy Shark 2018 v1.4 (Vip Pro Edition) |
| Operation: | write | Name: | UninstallString |
Value: C:\Program Files\Proxy Shark 2018 v1.4 (Vip Pro Edition)\Uninstall - Tool.exe | |||
| (PID) Process: | (3576) Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Proxy Shark 2018 v1.4 (Vip Pro Edition) |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\Proxy Shark 2018 v1.4 (Vip Pro Edition)\Uninstall - Tool.exe | |||
| (PID) Process: | (3764) Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3764) Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3764) Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Proxy Shark 2018 v1_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\Startmenu.dat | text | |
MD5:9E0EAD8D16CA77C2830F2283E794259C | SHA256:464C6BC3AA29F67A3FE4BC783A05F5BC73B05CC21F58687735DAE5FB4A7CD07F | |||
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\Desktop.dat | text | |
MD5:9E0EAD8D16CA77C2830F2283E794259C | SHA256:464C6BC3AA29F67A3FE4BC783A05F5BC73B05CC21F58687735DAE5FB4A7CD07F | |||
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\Deutsch.ifl | text | |
MD5:26FB2F9DD637EE8BBF6E2017D244D1E1 | SHA256:D500431E5E8CCCA575DDD52AB4FC599882061B34B03FC1527BBD44E0D6E23F0A | |||
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\OS.dat | text | |
MD5:34C275EE1F7992EA61B44D72C8ED6DB5 | SHA256:8819195120405611C3FCFF1FB1DB3AB0BA10370A5CAD6DA249158327B1A457D3 | |||
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\Chinese (Simplified).ifl | text | |
MD5:995B8A242A8D5C033652155CC0BD14E5 | SHA256:EE80E2A44C322E8C1DC921F13C1E5B6EDDC8D89754C43FA1B442191DBCB44188 | |||
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\Setup.cab | compressed | |
MD5:D5668D45DFF076F8E1E50F53F97EDEB9 | SHA256:CAC194A9A03841CCBB68FF89FD8315AEFA9352B0488247CFFC125F148D94A507 | |||
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\SC.dat | text | |
MD5:766161D8CBC61E273FC9FAA0275071CA | SHA256:0F24649DB67C7970573167827E43400A7EDE0E8AA62B2A4372ED82ACB1436FA8 | |||
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\languages.dat | text | |
MD5:C43AA1E1D8DDF4ED9356181C0DCA77FE | SHA256:66F20D470473391CF75333C509A66DDE447743FB1B4901623563C64DA62F353E | |||
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\English.ifl | text | |
MD5:DC51022CF78C9B519F2058983A773119 | SHA256:93E28A5125B4864773F53D1C5F87C1756EFA0C2D60D5C3FD6B34AA920080F568 | |||
| 3576 | Proxy Shark 2018 v1.4 (Vip Pro Edition) @XploitHackers.exe | C:\Users\admin\AppData\Local\Temp\IF{39E3DC9E-D736-48F9-8FEA-77C7F1B0DC9A}\Español.ifl | text | |
MD5:EE85CDA83E5AB141B738B702FCBB9198 | SHA256:0725FE459E577294BDB3CED7E4C6C5847A6E996488C09F75122B508C39F2A4E7 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 200 | 85.214.115.35:80 | http://proxydb.net/?offset=20 | DE | — | — | unknown |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 200 | 173.254.28.147:80 | http://www.babatools.com/ads2.html | US | html | 225 b | malicious |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 200 | 173.254.28.147:80 | http://www.babatools.com/ads1.html | US | html | 228 b | malicious |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 200 | 173.254.28.147:80 | http://www.babatools.com/ads3.html | US | html | 155 b | malicious |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 200 | 173.254.28.147:80 | http://www.babatools.com/streamviewers.png | US | image | 68.8 Kb | malicious |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 200 | 213.174.129.16:80 | http://proxy-list.org/german/index.php?p=1 | US | html | 173 Kb | unknown |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 200 | 173.254.28.147:80 | http://www.babatools.com/proxyshark.png | US | image | 26.4 Kb | malicious |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 302 | 172.217.16.193:80 | http://proxyserverlist-24.blogspot.de/ | US | html | 221 b | whitelisted |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 301 | 148.251.132.250:80 | http://www.cool-proxy.net/proxies/http_proxy_list/sort:score/direction:desc/page:1 | DE | html | 375 b | unknown |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | GET | 200 | 173.254.28.147:80 | http://www.babatools.com/the-proxie.jpg | US | image | 118 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 173.254.28.147:80 | www.babatools.com | Unified Layer | US | malicious |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 104.24.14.114:443 | hidemy.name | Cloudflare Inc | US | shared |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 172.217.16.193:80 | newfreshproxies24.blogspot.de | Google Inc. | US | whitelisted |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 104.24.99.185:443 | incloak.com | Cloudflare Inc | US | shared |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 159.69.42.212:80 | txt.proxyspy.net | — | US | malicious |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 158.69.213.59:80 | free-proxy.cz | OVH SAS | CA | suspicious |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 104.24.116.90:443 | www.my-proxy.com | Cloudflare Inc | US | shared |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 103.224.212.241:80 | www.getproxy.jp | Trellian Pty. Limited | AU | unknown |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 108.61.205.140:80 | www.idcloak.com | Choopa, LLC | US | unknown |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | 213.174.129.16:80 | proxy-list.org | DataWeb Global Group B.V. | US | unknown |
Domain | IP | Reputation |
|---|---|---|
www.babatools.com |
| unknown |
newfreshproxies24.blogspot.de |
| whitelisted |
www.idcloak.com |
| unknown |
hidemy.name |
| whitelisted |
proxyserverlist-24.blogspot.de |
| whitelisted |
www.xicidaili.com |
| malicious |
www.my-proxy.com |
| unknown |
www.getproxy.jp |
| malicious |
incloak.com |
| unknown |
sslproxies24.blogspot.de |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | access to a potentially vulnerable web application | ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source) |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | access to a potentially vulnerable web application | ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source) |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | access to a potentially vulnerable web application | ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source) |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | access to a potentially vulnerable web application | ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source) |
1052 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | access to a potentially vulnerable web application | ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source) |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | access to a potentially vulnerable web application | ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source) |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | access to a potentially vulnerable web application | ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source) |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | access to a potentially vulnerable web application | ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source) |
3764 | Proxy Shark 2018 v1.4 (Vip Pro Edition).exe | access to a potentially vulnerable web application | ET WEB_CLIENT Suspicious HTML Script Tag in 401 Unauthorized Response (External Source) |