File name:

EPPortalITS.exe

Full analysis: https://app.any.run/tasks/2fcea6b6-c1db-4720-ac91-58cc4c6e5a3a
Verdict: No threats detected
Analysis date: November 28, 2019, 10:10:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B3FBCCCD3E4885E2B361A95C7D7CCC17

SHA1:

B45DBB2521F9346C882CE321FC33D1A9CC850F62

SHA256:

CF704CD2A9DB526426AB27A31AD9E79B814CCC47BD945CAD85E72BDB41703364

SSDEEP:

196608:rMTki5zelmuu5bGOVcnB5X0JKrOtK2j+MCGYFM/IA+j:wTkYDhaOVu0JKrOt+VhUID

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
PEType: PE32
LinkerVersion: 2.25
CodeSize: 2109440
InitializedDataSize: 2817024
UninitializedDataSize: -
EntryPoint: 0x8b0090
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.0.124.2800
ProductVersionNumber: 3.0.124.2800
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
CompanyName: 税友软件集团股份有限公司
FileDescription: -
FileVersion: 3.0.124.2800
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: -
ProductVersion: 1.0.0.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Jun-1992 22:22:17
Detected languages:
  • Chinese - PRC
TLS Callbacks: 1 callback(s) detected.

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 13
Time date stamp: 19-Jun-1992 22:22:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
CODE
0x00001000
0x00202FAC
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
DATA
0x00204000
0x0000BD14
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
BSS
0x00210000
0x00013C59
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00224000
0x0001FD3E
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.edata
0x00244000
0x000002A0
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
4.16281
.tls
0x00245000
0x00000014
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x00246000
0x00000200
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
0.186583
.virbox
0x00247000
0x001351E1
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0
.vdata0
0x0037D000
0x004F2F30
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0
.vdata1
0x00870000
0x00010E60
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.95686
340
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

EPLib.bpl
GDI32.DLL
KERNEL32.dll
SHLWAPI.dll
USER32.dll
XPFarmer.bpl
adortl70.bpl
advapi32.dll
comctl32.dll
dbrtl70.bpl

Exports

Title
Ordinal
Address
NewBrowsePlugin_94063DD1392A
1
0x000D59D4
NeedAppTobeInstalled
2
0x00183E3C
UploadDataToCloud
3
0x0014A018
SwitchCompayEvent
4
0x001C6EA0
GetCloudMgntInf
5
0x001DE7B4
GetCloudInf
6
0x001DE810
SetCustomNavMenuStyle
7
0x001D7764
SetChannelMenuMsgNum
8
0x001D70E0
CloseOnlineHelps
9
0x001D8034
ShowOnlineHelps
10
0x001D6EF4
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start epportalits.exe epportalits.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1888"C:\Users\admin\AppData\Local\Temp\EPPortalITS.exe" C:\Users\admin\AppData\Local\Temp\EPPortalITS.exe—explorer.exe
User:
admin
Company:
税友软件集团股份有限公司
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
3.0.124.2800
Modules
Images
c:\users\admin\appdata\local\temp\epportalits.exe
c:\systemroot\system32\ntdll.dll
2632"C:\Users\admin\AppData\Local\Temp\EPPortalITS.exe" C:\Users\admin\AppData\Local\Temp\EPPortalITS.exe
explorer.exe
User:
admin
Company:
税友软件集团股份有限公司
Integrity Level:
HIGH
Exit code:
3221225781
Version:
3.0.124.2800
Modules
Images
c:\users\admin\appdata\local\temp\epportalits.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EPPortalITS.exe