File name:

zd51177415-certified.exe

Full analysis: https://app.any.run/tasks/4fb3fbc1-4936-433d-b159-25a150cfbbad
Verdict: Malicious activity
Analysis date: April 04, 2025, 01:18:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

25EA814F830788A206AF762684144D10

SHA1:

D7340409ECCAA45069AE4C33C754F5E3B2045535

SHA256:

D5E074CEDD1CECB4751843960185D376927451F3CD56F02BAA0B30BCB48AE246

SSDEEP:

98304:5OUBtbn/hxk0rQ3RpoDalqnKRupVIgcqT/q8H2KsYhRGNUOiVpOEc5S3C4l7hLKN:5TrY7CanIXYRPzAYu4Qzv/XxC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • zd51177415-certified.exe (PID: 7548)
      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)

    • Process drops legitimate windows executable

      • zd51177415-certified.exe (PID: 7548)

    • Executable content was dropped or overwritten

      • zd51177415-certified.exe (PID: 7548)
      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)
      • Prn64.bin (PID: 2140)

    • Drops 7-zip archiver for unpacking

      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)

    • Reads the Windows owner or organization settings

      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)

    • Starts application with an unusual extension

      • PrnInst.exe (PID: 7148)

    • Reads security settings of Internet Explorer

      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)

  • INFO

    • The sample compiled with english language support

      • zd51177415-certified.exe (PID: 7548)
      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)
      • Prn64.bin (PID: 2140)

    • Checks supported languages

      • zd51177415-certified.exe (PID: 7548)
      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)
      • PrnInst.exe (PID: 7148)
      • Prn64.bin (PID: 2140)

    • Creates files in the program directory

      • zd51177415-certified.exe (PID: 7548)
      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)

    • Reads the computer name

      • zd51177415-certified.exe (PID: 7548)
      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)
      • PrnInst.exe (PID: 7148)
      • Prn64.bin (PID: 2140)

    • Creates files or folders in the user directory

      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)

    • Create files in a temporary directory

      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)
      • Prn64.bin (PID: 2140)

    • Process checks computer location settings

      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)

    • Compiled with Borland Delphi (YARA)

      • zddriver-v5-1-17-7415-installer.exe (PID: 7972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:07:29 23:29:47+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 197632
InitializedDataSize: 156672
UninitializedDataSize: -
EntryPoint: 0x22c58
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 5.1.17.7415
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: This installation was built with InstallAware: http://www.installaware.com
CompanyName: Zebra Technologies
FileDescription: Printer Driver Installation
FileVersion: 5.1.17.7415
LegalCopyright: ZEBRA and the stylized Zebra head are trademarks of Zebra Technologies Corporation, registered in many jurisdictions worldwide. All other trademarks are the property of their respective owners. ©2025 Zebra Technologies Corporation and/or its affiliates. All rights reserved
ProductName: ZDesigner Windows Printer Driver Version 5.1.17.7415
ProductVersion: 5.1.17.7415
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start zd51177415-certified.exe zddriver-v5-1-17-7415-installer.exe prninst.exe no specs prn64.bin slui.exe no specs zd51177415-certified.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2140c:\ZD5-1-17-7415\zbrn\Win64\Prn64.bin "PreinstallDriverPackage=c:\ZD5-1-17-7415\zbrn\zbrn.inf"C:\ZD5-1-17-7415\ZBRN\Win64\Prn64.bin
PrnInst.exe
User:
admin
Company:
Euro Plus d.o.o.
Integrity Level:
HIGH
Description:
Printer Installation 64bit helper
Version:
4.6.14
Modules
Images
c:\zd5-1-17-7415\zbrn\win64\prn64.bin
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4692C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7148"C:\ZD5-1-17-7415\PrnInst.exe" /PREINSTALL="c:\ZD5-1-17-7415\zbrn\zbrn.inf"C:\ZD5-1-17-7415\PrnInst.exe—zddriver-v5-1-17-7415-installer.exe
User:
admin
Company:
Zebra Technologies International, LLC
Integrity Level:
HIGH
Description:
Printer Installation Wizard
Version:
5.3.45
Modules
Images
c:\zd5-1-17-7415\prninst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7444"C:\Users\admin\AppData\Local\Temp\zd51177415-certified.exe" C:\Users\admin\AppData\Local\Temp\zd51177415-certified.exe—explorer.exe
User:
admin
Company:
Zebra Technologies
Integrity Level:
MEDIUM
Description:
Printer Driver Installation
Exit code:
3221226540
Version:
5.1.17.7415
Modules
Images
c:\users\admin\appdata\local\temp\zd51177415-certified.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7548"C:\Users\admin\AppData\Local\Temp\zd51177415-certified.exe" C:\Users\admin\AppData\Local\Temp\zd51177415-certified.exe
explorer.exe
User:
admin
Company:
Zebra Technologies
Integrity Level:
HIGH
Description:
Printer Driver Installation
Version:
5.1.17.7415
Modules
Images
c:\users\admin\appdata\local\temp\zd51177415-certified.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7972.\zddriver-v5-1-17-7415-installer.exe /m="C:\Users\admin\AppData\Local\Temp\ZD5117~1.EXE" /k=""C:\ProgramData\miaB8F1.tmp\zddriver-v5-1-17-7415-installer.exe
zd51177415-certified.exe
User:
admin
Company:
Zebra Technologies
Integrity Level:
HIGH
Description:
Printer Driver Installation
Version:
5.1.17.7415
Modules
Images
c:\programdata\miab8f1.tmp\zddriver-v5-1-17-7415-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
508
Read events
505
Write events
3
Delete events
0

Modification events

(PID) Process:(7548) zd51177415-certified.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\zd51177415-certified.exe
Operation:writeName:IsHostApp
Value:
(PID) Process:(7972) zddriver-v5-1-17-7415-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\zddriver-v5-1-17-7415-installer.exe
Operation:writeName:IsHostApp
Value:
(PID) Process:(2140) Prn64.binKey:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
Operation:writeName:setupapi.dev.log
Value:
4096
Executable files
1 433
Suspicious files
24
Text files
66
Unknown types
0

Dropped files

PID
Process
Filename
Type
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\133A620F\F75D0379\ZDesign.chmbinary
MD5:2F1AC81A8964E6213C591F63CAB97240
SHA256:388D6BEE77BD2CF790A97BB0EDF957268A5263ECCDE689B2014F6646106D3ECF
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\991735A1\A2C5B76A\Prn64.binexecutable
MD5:D4EECE652E94EB3B41A0D7C8CE947259
SHA256:170536B689E79445B3201B8E7C045FACF289712C268F7D927D74EB39159E330F
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\133A620F\F75D0379\About.bmpimage
MD5:79E9D314BB3F1040E042F814603EBA55
SHA256:C4D975F8A2A6B50AB5BF34D4A018270F54323C135FFE421BC712F2A1194D40DA
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\mWinRun.dll\ansi\instmsi.msiexecutable
MD5:DACAD73CE0EF57276296E89A4F28710E
SHA256:61AD5E27FC7D0D39E7CBA51C3792F18E6FDC744921E6C416798D8179AACFC32A
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\mWinRun.dll\ansi\msiexec.exeexecutable
MD5:E6B975475B001A15B14AE6BDCDE58E45
SHA256:175435FD486045310E8C393B9B151638756AD14C7C93232BBD9D6920F1268E46
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\133A620F\F75D0379\ZebraBarcode.ttfbinary
MD5:86783BB204BD942A98768CA9DE2AEF5E
SHA256:4A19C33BAFD4A19F433BF047C0A65B03032F30CA9E79CF81162679C995AB7FD3
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\72189700\6B71268F\notices.htmlhtml
MD5:CE23A057BB8AC69C6045F9801CE0A997
SHA256:853F45CA0A1781484032D99F827541B7A936DCB193253D61C8A4042865E6D98E
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\25DB93B\6B71268F\ZebraFD.exeexecutable
MD5:C384ECE3C7DAFCA6EE975FC0963493B4
SHA256:3D53924CF71BBF03751D0B60782358A3ECF4CF7BD446D2FCFCBE80140A4BD039
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\675D11F2\6B71268F\EULA.pdfpdf
MD5:EDE201CD561CB5C524EF18B0073ED100
SHA256:5960FB1A21A4AE7824896FBDB8B3E288D01C3979FECD08EFD1134BB5B1F42B08
7548zd51177415-certified.exeC:\ProgramData\miaB8F1.tmp\data\OFFLINE\mWinRun.dll\ansi\cabinet.dllexecutable
MD5:267AB17A3526C6C46B2A1CF9A0A51280
SHA256:CB535E27870708F94F46ECB75BF6A5DFF17422C28B9F21C2C80AB7B1FCF1F715
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
19
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8092
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8092
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.7.1.246:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.42
whitelisted
google.com
  • 142.250.185.174
whitelisted
client.wns.windows.com
  • 20.7.1.246
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.4
  • 20.190.160.5
  • 40.126.32.136
  • 20.190.160.64
  • 20.190.160.131
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zd51177415-certified.exe