File name: | Peaky Blinders_ Mastermind[qpIk5L2mk].exe |
Full analysis: | https://app.any.run/tasks/9ddef5e5-6a85-4c24-aa36-2b0aea9b35ad |
Verdict: | Malicious activity |
Analysis date: | April 01, 2023, 09:59:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | 8824F57C20F073B9CD929FFA3A85227E |
SHA1: | 9A17A2E248A249131ACCDFD20907FA483F212984 |
SHA256: | D1D72BF2588B35DF7934F86B84013338EBF2C3912CEE617B816C61E21F6A2060 |
SSDEEP: | 12288:++oc0PZW6EltWDg/ikuUhQD85E0j+TsThemkzH7Kt8zdEBrM:+Pc5xHsg/ipUqDmE0j+g0mkzbKWzdWrM |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
ProductVersion: | 1.19.0.3 (rv113c) |
---|---|
ProductName: | DS Setup |
LegalCopyright: | 2023 (c) Download Studio Project |
FileVersion: | 1.19.0.3 |
FileDescription: | DS Setup |
CompanyName: | Download Studio Project |
CharacterSet: | Unicode |
LanguageCode: | Unknown (04B0) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0000 |
ProductVersionNumber: | 1.19.0.3 |
FileVersionNumber: | 1.19.0.3 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | 6 |
OSVersion: | 5.1 |
EntryPoint: | 0x338f |
UninitializedDataSize: | 16384 |
InitializedDataSize: | 464384 |
CodeSize: | 24064 |
LinkerVersion: | 14.29 |
PEType: | PE32 |
ImageFileCharacteristics: | No relocs, Executable, 32-bit |
TimeStamp: | 2022:09:20 09:43:28+00:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 20-Sep-2022 09:43:28 |
Detected languages: |
|
CompanyName: | Download Studio Project |
FileDescription: | DS Setup |
FileVersion: | 1.19.0.3 |
LegalCopyright: | 2023 (c) Download Studio Project |
ProductName: | DS Setup |
ProductVersion: | 1.19.0.3 (rv113c) |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000E0 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 20-Sep-2022 09:43:28 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00005DE0 | 0x00005E00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.45642 |
.rdata | 0x00007000 | 0x000017B4 | 0x00001800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.99587 |
.data | 0x00009000 | 0x0006F300 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.00064 |
.gdata | 0x00079000 | 0x001F0000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00269000 | 0x0001E2C8 | 0x0001E400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.0254 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.28928 | 1260 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 7.92982 | 18748 | UNKNOWN | English - United States | RT_ICON |
3 | 4.33435 | 16936 | UNKNOWN | English - United States | RT_ICON |
4 | 4.49243 | 9640 | UNKNOWN | English - United States | RT_ICON |
5 | 4.80295 | 4264 | UNKNOWN | English - United States | RT_ICON |
6 | 5.10184 | 1128 | UNKNOWN | English - United States | RT_ICON |
7 | 0 | 296 | UNKNOWN | English - United States | RT_ICON |
102 | 2.71813 | 180 | UNKNOWN | English - United States | RT_DIALOG |
103 | 2.53641 | 104 | UNKNOWN | English - United States | RT_GROUP_ICON |
104 | 2.70411 | 344 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2668 | "C:\Users\admin\AppData\Local\Temp\Peaky Blinders_ Mastermind[qpIk5L2mk].exe" | C:\Users\admin\AppData\Local\Temp\Peaky Blinders_ Mastermind[qpIk5L2mk].exe | explorer.exe | ||||||||||||
User: admin Company: Download Studio Project Integrity Level: MEDIUM Description: DS Setup Version: 1.19.0.3 Modules
| |||||||||||||||
3380 | "C:\Users\admin\AppData\Local\Temp\Peaky Blinders_ Mastermind[qpIk5L2mk].exe" /UAC:A013A /NCRC | C:\Users\admin\AppData\Local\Temp\Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | ||||||||||||
User: admin Company: Download Studio Project Integrity Level: HIGH Description: DS Setup Version: 1.19.0.3 Modules
|
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3380) Peaky Blinders_ Mastermind[qpIk5L2mk].exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 |
Operation: | write | Name: | Blob |
Value: 1900000001000000100000002FE1F70BB05D7C92335BC5E05B984DA662000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C60B000000010000001A0000004900530052004700200052006F006F007400200058003100000014000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E1D000000010000001000000073B6876195F5D18E048510422AEF04E309000000010000000C000000300A06082B06010505070301030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E80F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F6320000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:B2B8EA985950B80EDB7A96F009330F08 | SHA256:452596050A9C3B7439517E000E879FBD5C9629DEBB82438A41E60C196716116B | |||
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:FC73E9C010B44366498895BA6C554AFA | SHA256:33B5F87EF5763A4E65D62A8BBE3A1ABE47AD31E9CEF7973AB86A8282F97C987A | |||
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\Local\Temp\nsuFDFA.tmp\System.dll | executable | |
MD5:3E5DBC37B5790B6A1137F0441AFC93B0 | SHA256:6979A3766120389868145D5DCF1310B084A15046B389273FDE7EDE870E213CA0 | |||
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:630FC57946F8CF8FF9B20EBAFB0365C5 | SHA256:A9DB8A49BD70058B49B79459FC055DC29490510642159471153BA55965CDBB74 | |||
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\Local\Temp\nsuFDFA.tmp\UAC.dll | executable | |
MD5:113C5F02686D865BC9E8332350274FD1 | SHA256:0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D | |||
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:F7DCB24540769805E5BB30D193944DCE | SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA | |||
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\Local\Temp\Cab473.tmp | compressed | |
MD5:E71C8443AE0BC2E282C73FAEAD0A6DD3 | SHA256:95B0A5ACC5BF70D3ABDFD091D0C9F9063AA4FDE65BD34DBF16786082E1992E72 | |||
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\Local\Temp\nsuFDFA.tmp\StdUtils.dll | executable | |
MD5:C6A6E03F77C313B267498515488C5740 | SHA256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E | |||
2668 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\Local\Temp\nszFC45.tmp\UAC.dll | executable | |
MD5:113C5F02686D865BC9E8332350274FD1 | SHA256:0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D | |||
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | C:\Users\admin\AppData\Local\Temp\Tar474.tmp | cat | |
MD5:BE2BEC6E8C5653136D3E72FE53C98AA3 | SHA256:1919AAB2A820642490169BDC4E88BD1189E22F83E7498BF8EBDFB62EC7D843FD |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | GET | 200 | 23.37.41.57:80 | http://x1.c.lencr.org/ | NL | der | 717 b | whitelisted |
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8fde78fe545865e9 | US | compressed | 4.70 Kb | whitelisted |
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?94e5d7e743f18a71 | US | compressed | 61.1 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | 23.37.41.57:80 | x1.c.lencr.org | AKAMAI-AS | DE | suspicious |
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | 5.135.110.101:443 | dl5.dstudio.app | OVH SAS | FR | unknown |
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | 18.198.4.253:443 | apis.downloadstud.io | AMAZON-02 | DE | suspicious |
3380 | Peaky Blinders_ Mastermind[qpIk5L2mk].exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
Domain | IP | Reputation |
---|---|---|
apis.downloadstud.io |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
dl5.dstudio.app |
| unknown |