File name:

4d372cadcd7790892b8d82cd0f530ceb

Full analysis: https://app.any.run/tasks/3b7a375e-431b-4523-88ab-c73dc66bf612
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: March 24, 2021, 01:40:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4D372CADCD7790892B8D82CD0F530CEB

SHA1:

4B6F8ECCAB3117A1E6624518B6FDC9AF6995CF48

SHA256:

D6394B3BC14DF20E805417FD3A6B9097ADBF715023127E4ED56D02CE11CE2014

SSDEEP:

98304:ahD46QFU8zuh4SP8sKv8GAU4uNE/5H8i3c:aF46U5zmrhKXA4NI5V3c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • 4d372cadcd7790892b8d82cd0f530ceb.exe (PID: 3072)

  • SUSPICIOUS

    • Creates files in the user directory

      • 4d372cadcd7790892b8d82cd0f530ceb.exe (PID: 3072)

    • Reads internet explorer settings

      • 4d372cadcd7790892b8d82cd0f530ceb.exe (PID: 3072)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:11:10 10:23:12+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x67595d
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 6.6.0.0
ProductVersionNumber: 6.6.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 6.6.0.0
FileDescription: 闻风GM工具
ProductName: 闻风GM工具
ProductVersion: 6.6.0.0
CompanyName: 闻风-QQ:8027323
LegalCopyright: 闻风-QQ:8027323 版权所有
Comments: 闻风GM工具

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 10-Nov-2016 09:23:12
Detected languages:
  • Chinese - PRC
FileVersion: 6.6.0.0
FileDescription: 闻风GM工具
ProductName: 闻风GM工具
ProductVersion: 6.6.0.0
CompanyName: 闻风-QQ:8027323
LegalCopyright: 闻风-QQ:8027323 版权所有
Comments: 闻风GM工具

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000120

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 10-Nov-2016 09:23:12
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00552000
0x0022F000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.9998
.sedata
0x0067B000
0x00001000
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.98435
.idata
0x00677000
0x00001000
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.85929
.rsrc
0x00678000
0x00003000
0x00003000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.60014

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.07695
461
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
2
2.18858
296
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
7.02021
7336
Latin 1 / Western European
UNKNOWN
RT_ICON
1151
2.16096
20
Latin 1 / Western European
Chinese - PRC
RT_GROUP_ICON
1152
2.02322
20
Latin 1 / Western European
Chinese - PRC
RT_GROUP_ICON
DEFAULT_ICON
1.71664
20
Latin 1 / Western European
UNKNOWN
RT_GROUP_ICON

Imports

ADVAPI32.dll
AVIFIL32.dll
COMCTL32.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
OLEAUT32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 4d372cadcd7790892b8d82cd0f530ceb.exe

Process information

PID
CMD
Path
Indicators
Parent process
3072"C:\Users\admin\AppData\Local\Temp\4d372cadcd7790892b8d82cd0f530ceb.exe" C:\Users\admin\AppData\Local\Temp\4d372cadcd7790892b8d82cd0f530ceb.exe
explorer.exe
User:
admin
Company:
闻风-QQ:8027323
Integrity Level:
MEDIUM
Description:
闻风GM工具
Exit code:
0
Version:
6.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\4d372cadcd7790892b8d82cd0f530ceb.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvfw32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
68
Read events
59
Write events
9
Delete events
0

Modification events

(PID) Process:(3072) 4d372cadcd7790892b8d82cd0f530ceb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3072) 4d372cadcd7790892b8d82cd0f530ceb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A6000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3072) 4d372cadcd7790892b8d82cd0f530ceb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3072) 4d372cadcd7790892b8d82cd0f530ceb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3072) 4d372cadcd7790892b8d82cd0f530ceb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3072) 4d372cadcd7790892b8d82cd0f530ceb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3072) 4d372cadcd7790892b8d82cd0f530ceb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
30724d372cadcd7790892b8d82cd0f530ceb.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\WVH2W9WZ.htmtext
MD5:—
SHA256:—
30724d372cadcd7790892b8d82cd0f530ceb.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\8PW0S952.txttext
MD5:—
SHA256:—
30724d372cadcd7790892b8d82cd0f530ceb.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\stat[1].htmtext
MD5:444BCB3A3FCF8389296C49467F27E1D6
SHA256:2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
13
DNS requests
11
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
GET
200
162.159.237.196:80
http://tcxfxy.ys168.com/
unknown
text
84 b
shared
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
GET
200
106.11.86.67:80
http://z11.cnzz.com/stat.htm?id=1259869022&r=&lg=zh-cn&ntime=none&cnzz_eid=none&showp=1280x720&t=&h=1&rnd=1000041
CN
text
2 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
106.11.86.67:80
z11.cnzz.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
suspicious
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
162.159.237.196:80
tcxfxy.ys168.com
Cloudflare Inc
—
shared
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
121.40.128.232:64524
—
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
121.40.233.80:64880
—
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
121.40.81.182:64239
—
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
121.40.183.33:64595
—
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
121.40.34.135:64951
—
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
43.227.216.31:65500
c0.baibaoyun.org
National Computer Network And Information
CN
malicious
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
47.99.143.151:65500
c4.baibaoyun.org
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious
3072
4d372cadcd7790892b8d82cd0f530ceb.exe
47.99.136.234:65500
c2.baibaoyun.org
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious

DNS requests

Domain
IP
Reputation
z11.cnzz.com
  • 106.11.86.67
whitelisted
tcxfxy.ys168.com
  • 162.159.237.196
  • 162.159.236.196
unknown
c0.baibaoyun.org
  • 43.227.216.31
malicious
c4.baibaoyun.org
  • 47.99.143.151
malicious
c2.baibaoyun.org
  • 47.99.136.234
malicious
c3.baibaoyun.org
  • 43.227.216.31
malicious
c1.baibaoyun.org
  • 47.99.136.234
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

Found threats are available for the paid subscriptions
11 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4d372cadcd7790892b8d82cd0f530ceb