| File name: | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe |
| Full analysis: | https://app.any.run/tasks/afa29126-32bd-4a33-a1a9-62038b9b8c0e |
| Verdict: | Malicious activity |
| Analysis date: | January 10, 2025, 12:04:16 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 4D39154BBA70E90AB313DEBE1CA8D354 |
| SHA1: | F7B2D466BFF967CBA9C2FE6C6B88BFAC14556DEC |
| SHA256: | D2439B45FDBDE9F2E72C2C5A9DA6E6E05CFE80FC80534408F3A9D09419627FEC |
| SSDEEP: | 196608:omeyrPq93JobyHjZ4isdq8nBp+bGUcuJk2O/J:omeyrPE5nFL4/BpgGTY9O/J |
MALICIOUS
No malicious indicators.SUSPICIOUS
The process drops C-runtime libraries
- Create_Installer_ACAD_E_2025_Spanish_WIN64.exe (PID: 2972)
Drops 7-zip archiver for unpacking
- Create_Installer_ACAD_E_2025_Spanish_WIN64.exe (PID: 2972)
Process drops legitimate windows executable
- Create_Installer_ACAD_E_2025_Spanish_WIN64.exe (PID: 2972)
Executable content was dropped or overwritten
- Create_Installer_ACAD_E_2025_Spanish_WIN64.exe (PID: 2972)
The process checks if it is being run in the virtual environment
- DownloadManager.exe (PID: 5540)
INFO
The sample compiled with english language support
- Create_Installer_ACAD_E_2025_Spanish_WIN64.exe (PID: 2972)
Checks supported languages
- Create_Installer_ACAD_E_2025_Spanish_WIN64.exe (PID: 2972)
- AdOdisDeployTool.exe (PID: 5096)
- ADPClientService.exe (PID: 3032)
- 7za.exe (PID: 6092)
- DownloadManager.exe (PID: 5540)
- 7za.exe (PID: 1684)
Creates files in the program directory
- AdOdisDeployTool.exe (PID: 5096)
Reads the computer name
- AdOdisDeployTool.exe (PID: 5096)
- DownloadManager.exe (PID: 5540)
- 7za.exe (PID: 6092)
- 7za.exe (PID: 1684)
- ADPClientService.exe (PID: 3032)
Creates files or folders in the user directory
- AdOdisDeployTool.exe (PID: 5096)
- DownloadManager.exe (PID: 5540)
- ADPClientService.exe (PID: 3032)
Create files in a temporary directory
- Create_Installer_ACAD_E_2025_Spanish_WIN64.exe (PID: 2972)
- ADPClientService.exe (PID: 3032)
Sends debugging messages
- AdOdisDeployTool.exe (PID: 5096)
Reads Windows Product ID
- ADPClientService.exe (PID: 3032)
Checks proxy server information
- DownloadManager.exe (PID: 5540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2010:11:18 16:27:35+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 104960 |
| InitializedDataSize: | 75264 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x14b04 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 9.20.0.0 |
| ProductVersionNumber: | 9.20.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Unknown (0x60006) |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Autodesk |
| FileDescription: | Autodesk Create Installer |
| FileVersion: | 19 |
| InternalName: | ADT Image Tool |
| LegalCopyright: | Autodesk 2022© |
| OriginalFileName: | AdOdisDeployTool.exe |
| ProductName: | Autodesk Create Installer |
| ProductVersion: | 19 |
Total processes
127
Monitored processes
9
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1520 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | ADPClientService.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1684 | "C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp/7za.exe" x -txz "C:/Autodesk/WI/13081776954469730854/pkg.webfileopen0.tar.xz" -bsp2 -so | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\7za.exe | — | DownloadManager.exe | |||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7-Zip Standalone Console Exit code: 0 Version: 23.01 Modules
| |||||||||||||||
| 2324 | "C:\Users\admin\Desktop\Create_Installer_ACAD_E_2025_Spanish_WIN64.exe" | C:\Users\admin\Desktop\Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | — | explorer.exe | |||||||||||
User: admin Company: Autodesk Integrity Level: MEDIUM Description: Autodesk Create Installer Exit code: 3221226540 Version: 19.00 Modules
| |||||||||||||||
| 2972 | "C:\Users\admin\Desktop\Create_Installer_ACAD_E_2025_Spanish_WIN64.exe" | C:\Users\admin\Desktop\Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | explorer.exe | ||||||||||||
User: admin Company: Autodesk Integrity Level: HIGH Description: Autodesk Create Installer Version: 19.00 Modules
| |||||||||||||||
| 3032 | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\ADPClientService.exe -f C:\Users\admin\AppData\Roaming\Autodesk\ADPSDK\JSON | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\ADPClientService.exe | AdOdisDeployTool.exe | ||||||||||||
User: admin Company: Autodesk, Inc. Integrity Level: HIGH Description: Autodesk Analytics Client Service Version: 5.1.34.0 Modules
| |||||||||||||||
| 5096 | .\AdOdisDeployTool.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\AdOdisDeployTool.exe | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | ||||||||||||
User: admin Company: Autodesk, Inc. Integrity Level: HIGH Description: Autodesk Desktop Deployment Application Version: 2.10.0.5 Modules
| |||||||||||||||
| 5540 | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\DownloadManager.exe -e --productname "Autodesk Custom Install Setup" --productversion 2.10.0.5 | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\DownloadManager.exe | AdOdisDeployTool.exe | ||||||||||||
User: admin Company: Autodesk, Inc. Integrity Level: HIGH Description: Autodesk Desktop Delivery Application Version: 2.10.0.3 Modules
| |||||||||||||||
| 5548 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | DownloadManager.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6092 | "C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp/7za.exe" x -ttar -si -aoa -bsp2 -o"C:\Users\admin\Downloads/Autodesk\AutoCAD Electrical 2025 - (ES)\image\ACAD_E_2025_es-ES" | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\7za.exe | — | DownloadManager.exe | |||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7-Zip Standalone Console Exit code: 0 Version: 23.01 Modules
| |||||||||||||||
Total events
4 018
Read events
4 016
Write events
2
Delete events
0
Modification events
| (PID) Process: | (5096) AdOdisDeployTool.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Autodesk\Autodesk ImageTool\CER\2.10.0.5 |
| Operation: | write | Name: | SessionStartCount |
Value: 1 | |||
| (PID) Process: | (5540) DownloadManager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Autodesk\DDA\DLM\CER\2.10.0.3 |
| Operation: | write | Name: | SessionStartCount |
Value: 1 | |||
Executable files
46
Suspicious files
91
Text files
57
Unknown types
15
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\Resources\qm_Files\AdOdisDeployTool_es.qm | qm | |
MD5:7AB33591EBF7A098331543F2FCD7DB9B | SHA256:A95F0044956C21E095CBEE224379157E0C7AC3F0AA51F5829C932AB4AD7EC298 | |||
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\Resources\qm_Files\AdOdisDeployTool_en.qm | qm | |
MD5:AAEA7BA475C961F941D0A23488457BEB | SHA256:494AC9A2B2CB2FDECED353F4A9F898ED8DCF616E9BC667438C62681E3F7F79CF | |||
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\Resources\qm_Files\AdOdisDeployTool_pt_BR.qm | qm | |
MD5:E9F3F5BFC5B619800F2E925DDA9B235D | SHA256:20F3527AFC659178B34F23913EBA1B6AC2394A3BFCC8E1111CE601EA874E2CB7 | |||
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\Resources\qm_Files\AdOdisDeployTool_zh_TW.qm | qm | |
MD5:326181B5F7AD56C0409B4110D1EAD208 | SHA256:A46AC087317DDA90F10196DF425826500D84C738421A51D70B65303DC0E4619E | |||
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\ACAD_E_2025_es-ES\3rdParty\WPT\pkg.WPTx64-x86_en-us.xml | xml | |
MD5:050A95B6F390E06D83778B97566C77C9 | SHA256:8DC74B8F2DF01A2A08810F885708B15191B4CDA035994C07DDAEB9DAFA5D70BC | |||
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\Resources\qm_Files\AdOdisDeployTool_zh.qm | qm | |
MD5:E45439E89558E15B8BB711B78F80A409 | SHA256:D6B6F557845E29E5E48D4B963877587F75968B110F2866FFA04826400CAD4633 | |||
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\CER\senddmp.exe.config | xml | |
MD5:C64632957C9A46B320E412D857E176C0 | SHA256:16A5B2D1D7CC9914BCE73914D4D956D3BA7A2EC34E3D41E876F2E265C15D8096 | |||
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\7z-license.txt | text | |
MD5:D99AA46C2205B66C776292A2BCF7F366 | SHA256:EFE357154875B80E6FC3787E7C83C6F368BD6EF4C25A872D59801C8E137CFE32 | |||
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\CER\upiconfig.xml | text | |
MD5:E3AF9F85738B3832BBA0E3048F9533FC | SHA256:354EB66E9D5565ED41CF5AFFA1E583F123C9907D05B98283B815E6278D7A6845 | |||
| 2972 | Create_Installer_ACAD_E_2025_Spanish_WIN64.exe | C:\Users\admin\AppData\Local\Temp\7zS6A37.tmp\Resources\qm_Files\AdOdisDeployTool_cs.qm | qm | |
MD5:C78B06374321BCAFA543B517F6B04BA9 | SHA256:219C0913CD86B602F1A7A57230BA884718F9AD0F20B220652208B3DD0CEEC23E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
131
TCP/UDP connections
159
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | svchost.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 1.01 Kb | whitelisted |
5496 | svchost.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 973 b | whitelisted |
— | — | HEAD | 200 | 23.32.101.119:443 | https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/ACADOID/D592F06E-768C-4622-9524-5DDD1A3157B8/pkg.webfileopen0.tar.xz | NL | — | — | unknown |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 973 b | whitelisted |
— | — | HEAD | 200 | 23.32.101.119:443 | https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/ACCESS/1EB42BDC-1445-35D1-96C6-3536A7A83A3B/pkg.access.tar.xz | NL | — | — | unknown |
— | — | HEAD | 200 | 23.32.101.119:443 | https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/ACTINST/E141F225-EF21-3CEF-BC97-FDEC03189517/pkg.dwggraph0.tar | NL | — | — | unknown |
— | — | POST | 200 | 54.87.10.208:443 | https://ase.autodesk.com/adp/v1/analytics/batch | US | — | — | whitelisted |
— | — | HEAD | 200 | 23.32.101.119:443 | https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/ACTINST/E141F225-EF21-3CEF-BC97-FDEC03189517/pkg.dwggraph1.tar.xz | NL | — | — | unknown |
— | — | HEAD | 200 | 23.32.101.119:443 | https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/CERCLIENT/6215A5C8-CDD9-478C-B699-67FCF4E898BF/pkg.cer.tar.xz | NL | — | — | unknown |
— | — | HEAD | 200 | 23.32.101.119:443 | https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/HIVE/3B8A5F5F-B4D4-43A7-AA9E-29F5A320DD52/pkg.hive.tar.xz | NL | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 2.16.204.134:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | svchost.exe | 2.16.253.202:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.253.202:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
3976 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
dds.autodesk.com |
| whitelisted |
adppa.api.autodesk.com |
| shared |
ase.autodesk.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
up1.autodesk.com |
| whitelisted |
Threats
Process | Message |
|---|---|
AdOdisDeployTool.exe | QLayout: Attempting to add QLayout "" to AppDialog "", which already has a layout
|