analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

aaafeddedccbbaafeeedcddcccbbaafe

Full analysis: https://app.any.run/tasks/d43b7917-38fb-43e4-8292-c1717325807c
Verdict: Malicious activity
Analysis date: January 22, 2019, 16:42:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5:

7407545561EB01088043D5B400F50377

SHA1:

48987C8EE580AF3BA9A074B629C5DD44D3E55B3C

SHA256:

D00290AFE51D7177968915C3778E18659168EDC2356A32E41CCCBA23D390DAF6

SSDEEP:

98304:dV4XNpILQNegCEOllcc1J7W/72YUek6vT6v7pS0MMKkB6:viCLUClllcJ/71vTO7pSDk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • svchost.exe (PID: 844)
      • WerFault.exe (PID: 3100)
      • explorer.exe (PID: 284)
      • consent.exe (PID: 3552)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 284)

    • Creates files in the user directory

      • notepad++.exe (PID: 3092)

  • INFO

    • Loads main object executable

      • rundll32.exe (PID: 3796)

    • Application was crashed

      • rundll32.exe (PID: 3796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:06:28 23:22:43+02:00
PEType: PE32
LinkerVersion: 10
CodeSize: 74752
InitializedDataSize: 37888
UninitializedDataSize: -
EntryPoint: 0x3ccf
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 28-Jun-2017 21:22:43
Debug artifacts:
  • C:\Documents and Settings\Administrator\Desktop\shlexc\out\release\xyxptsvteo.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 28-Jun-2017 21:22:43
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DLL
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00012294
0x00012400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.69006
.rdata
0x00014000
0x00004130
0x00004200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.34469
.data
0x00019000
0x000036DC
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.42063
.reloc
0x0001D000
0x00001954
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.49894
.rsrc
0x0001F000
0x0055C4C0
0x0055C600
IMAGE_SCN_MEM_READ
6.78423

Imports

COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHLWAPI.dll
USER32.dll

Exports

Title
Ordinal
Address
FEfAWapcxqRsTcVN
1
0x00001BBB
ilsvztovgctursuw
2
0x00001292
kvforvjvgwuq
3
0x00001017
obgyutgxz
4
0x00001662
ooocdsvzfxl
5
0x000011A2
yfslbsffcfpb
6
0x0000194D
ypagnacmlidrorpk
7
0x00001270
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start rundll32.exe explorer.exe no specs svchost.exe werfault.exe no specs consent.exe no specs notepad++.exe gup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3796"C:\Windows\System32\rundll32.exe" "C:\Users\admin\Desktop\aaafeddedccbbaafeeedcddcccbbaafe.exe", FEfAWapcxqRsTcVNC:\Windows\System32\rundll32.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
3221225477
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
284C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
844C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3100C:\Windows\system32\WerFault.exe -u -p 3796 -s 188C:\Windows\system32\WerFault.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3552consent.exe 844 432 029D5990C:\Windows\system32\consent.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Consent UI for administrative applications
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3092"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\aaafeddedccbbaafeeedcddcccbbaafe.exe"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Version:
7.51
2356"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
Total events
1 917
Read events
1 859
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
4
Unknown types
5

Dropped files

PID
Process
Filename
Type
3100WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\rundll32.exe.3796.dmpdmp
MD5:48A6CCFD6E9739F6F32EB6060998BEA3
SHA256:1D8859208EACE06C52827E886DF54F5E57F7C6BABDCA823E614290E8AF732DCF
844svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:F21900C7A25F863C30D1D846EA91370B
SHA256:19E89AC099570546B4FB964A14D5E70B72AB17B892739FFE1A6111AD8404641F
3100WerFault.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_aaa_fe5af628cc8e5d7b24afbc2d58ea29ab421b8_0c3cfe98\Report.werbinary
MD5:9380EF145CB5F6DE9621AACF66E2FBA3
SHA256:E754C564A06E4B24D64DF0F963DBC2218852ED43F91C24C3931EEEC5F4B1090E
3092notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\stylers.xmlxml
MD5:44982E1D48434C0AB3E8277E322DD1E4
SHA256:3E661D3F1FF3977B022A0ACC26B840B5E57D600BC03DCFC6BEFDB408C665904C
3092notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\langs.xmlxml
MD5:E792264BEC29005B9044A435FBA185AB
SHA256:5298FD2F119C43D04F6CF831F379EC25B4156192278E40E458EC356F9B49D624
3092notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\plugins\Config\converter.initext
MD5:F70F579156C93B097E656CABA577A5C9
SHA256:B926498A19CA95DC28964B7336E5847107DD3C0F52C85195C135D9DD6CA402D4
3092notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\shortcuts.xmltext
MD5:AD21A64014891793DD9B21D835278F36
SHA256:C24699C9D00ABDD510140FE1B2ACE97BFC70D8B21BF3462DED85AFC4F73FE52F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
72.247.178.8:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
NL
der
471 b
whitelisted
—
—
GET
200
72.247.178.8:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEAXk3DuUOKs7hZfLpqGYUOM%3D
NL
der
727 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2356
gup.exe
37.59.28.236:443
notepad-plus-plus.org
OVH SAS
FR
whitelisted
—
—
72.247.178.8:80
ocsp.usertrust.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
ocsp.usertrust.com
  • 72.247.178.8
  • 72.247.178.16
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
aaafeddedccbbaafeeedcddcccbbaafe