File name:

mobiletrans_setup_full5793.exe

Full analysis: https://app.any.run/tasks/48162675-1830-49f5-85d1-84dadb7aad85
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: December 31, 2020, 12:21:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

010D4F2DDAA7CBF9DCE29D65A346D472

SHA1:

B5F2AA238C7A150E67A694DFEFB617BE51E76461

SHA256:

DD30CFF29DE8C9F2FE9CEE868828E5C179AC71C2E2100A468FC734881BA91973

SSDEEP:

24576:yvFVRM3bG8CvRf/X3Yw0WDmpUFv8XlGAMDG:gFVRM3bG8ORf/nY0aUNi8AMi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NFWCHK.exe (PID: 2220)
      • MobileTrans.exe (PID: 2212)
      • ElevationService.exe (PID: 3536)
      • WAFSetup.exe (PID: 3088)
      • MobileTrans.exe (PID: 2496)
      • WsAppService3.exe (PID: 2812)

    • Drops executable file immediately after starts

      • mobiletrans_full5793.tmp (PID: 2916)
      • mobiletrans_full5793.exe (PID: 1092)
      • WAFSetup.tmp (PID: 3944)
      • WAFSetup.exe (PID: 3088)

    • Writes to a start menu file

      • mobiletrans_full5793.tmp (PID: 2916)

    • Changes settings of System certificates

      • mobiletrans_full5793.tmp (PID: 2916)
      • MobileTrans.exe (PID: 2212)
      • CertUtil.exe (PID: 1972)

    • Loads dropped or rewritten executable

      • MobileTrans.exe (PID: 2212)
      • MobileTrans.exe (PID: 2496)

  • SUSPICIOUS

    • Reads internet explorer settings

      • mobiletrans_setup_full5793.exe (PID: 3312)
      • MobileTrans.exe (PID: 2212)

    • Executable content was dropped or overwritten

      • mobiletrans_full5793.exe (PID: 1092)
      • mobiletrans_setup_full5793.exe (PID: 3312)
      • mobiletrans_full5793.tmp (PID: 2916)
      • WAFSetup.tmp (PID: 3944)
      • MobileTrans.exe (PID: 2212)
      • WAFSetup.exe (PID: 3088)

    • Reads Windows owner or organization settings

      • mobiletrans_full5793.tmp (PID: 2916)
      • WAFSetup.tmp (PID: 3944)

    • Reads the Windows organization settings

      • mobiletrans_full5793.tmp (PID: 2916)
      • WAFSetup.tmp (PID: 3944)

    • Low-level read access rights to disk partition

      • mobiletrans_setup_full5793.exe (PID: 3312)

    • Drops a file that was compiled in debug mode

      • mobiletrans_setup_full5793.exe (PID: 3312)
      • mobiletrans_full5793.tmp (PID: 2916)
      • WAFSetup.tmp (PID: 3944)
      • MobileTrans.exe (PID: 2212)

    • Creates files in the Windows directory

      • mobiletrans_full5793.tmp (PID: 2916)
      • CertUtil.exe (PID: 3572)
      • CertUtil.exe (PID: 1972)
      • InstallUtil.exe (PID: 1352)

    • Drops a file with too old compile date

      • mobiletrans_full5793.tmp (PID: 2916)
      • WAFSetup.tmp (PID: 3944)

    • Creates files in the user directory

      • mobiletrans_full5793.tmp (PID: 2916)
      • MobileTrans.exe (PID: 2212)

    • Drops a file with a compile date too recent

      • mobiletrans_full5793.tmp (PID: 2916)

    • Starts SC.EXE for service management

      • mobiletrans_full5793.tmp (PID: 2916)

    • Removes files from Windows directory

      • CertUtil.exe (PID: 3572)
      • CertUtil.exe (PID: 1972)

    • Creates a directory in Program Files

      • mobiletrans_full5793.tmp (PID: 2916)
      • WAFSetup.tmp (PID: 3944)

    • Creates/Modifies COM task schedule object

      • RegAsm.exe (PID: 3732)

    • Creates files in the program directory

      • RegAsm.exe (PID: 3732)
      • InstallUtil.exe (PID: 1352)
      • WsAppService3.exe (PID: 2812)
      • MobileTrans.exe (PID: 2212)

    • Executed as Windows Service

      • WsAppService3.exe (PID: 2812)
      • ElevationService.exe (PID: 3536)

    • Adds / modifies Windows certificates

      • mobiletrans_full5793.tmp (PID: 2916)
      • MobileTrans.exe (PID: 2212)

    • Starts Internet Explorer

      • mobiletrans_setup_full5793.exe (PID: 3312)

    • Reads Environment values

      • MobileTrans.exe (PID: 2212)

    • Executed via COM

      • rundll32.exe (PID: 888)
      • rundll32.exe (PID: 2452)
      • DrvInst.exe (PID: 2148)

    • Changes IE settings (feature browser emulation)

      • MobileTrans.exe (PID: 2212)

    • Searches for installed software

      • MobileTrans.exe (PID: 2212)

  • INFO

    • Application was dropped or rewritten from another process

      • mobiletrans_full5793.tmp (PID: 2916)
      • WAFSetup.tmp (PID: 3944)
      • WsAppUpdateHelper.exe (PID: 3292)
      • ProcessKiller.exe (PID: 2780)

    • Loads dropped or rewritten executable

      • mobiletrans_full5793.tmp (PID: 2916)
      • WAFSetup.tmp (PID: 3944)

    • Creates a software uninstall entry

      • mobiletrans_full5793.tmp (PID: 2916)

    • Creates files in the program directory

      • WAFSetup.tmp (PID: 3944)
      • mobiletrans_full5793.tmp (PID: 2916)

    • Application launched itself

      • iexplore.exe (PID: 2820)

    • Changes internet zones settings

      • iexplore.exe (PID: 2820)

    • Creates files in the user directory

      • iexplore.exe (PID: 3440)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3440)
      • MobileTrans.exe (PID: 2212)
      • iexplore.exe (PID: 2820)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3440)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3440)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3440)

    • Manual execution by user

      • MobileTrans.exe (PID: 2496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:04 13:29:54+01:00
PEType: PE32
LinkerVersion: 10
CodeSize: 470016
InitializedDataSize: 973824
UninitializedDataSize: -
EntryPoint: 0x56206
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.1.3.2
ProductVersionNumber: 2.1.3.2
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: mobiletranspro_setup_full5793.exe
FileVersion: 2.1.3.2
LegalCopyright: Copyright©2017 Wondershare. All rights reserved.
ProductName: MobileTransPro
ProductVersion: 1.0.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
25
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start mobiletrans_setup_full5793.exe nfwchk.exe no specs mobiletrans_full5793.exe mobiletrans_full5793.tmp sc.exe no specs certutil.exe no specs certutil.exe no specs wafsetup.exe wafsetup.tmp wsappupdatehelper.exe no specs regasm.exe regasm.exe no specs installutil.exe no specs wsappservice3.exe processkiller.exe elevationservice.exe no specs mobiletrans.exe iexplore.exe iexplore.exe mobiletrans.exe rundll32.exe no specs drvinst.exe no specs dinotify.exe no specs rundll32.exe no specs mobiletrans_setup_full5793.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
888rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{cd152a99-6fde-41bd-8945-3c55c37eb483} "(null)"C:\Windows\system32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1092"C:\Users\Public\Documents\Wondershare\mobiletrans_full5793.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-MobileTransPro.log" /installpath: "C:\Program Files\Wondershare\MobileTransPro\" /DIR="C:\Program Files\Wondershare\MobileTransPro\"C:\Users\Public\Documents\Wondershare\mobiletrans_full5793.exe
mobiletrans_setup_full5793.exe
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
MobileTrans
Exit code:
0
Version:
2.1.0.129
Modules
Images
c:\users\public\documents\wondershare\mobiletrans_full5793.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1252"C:\Windows\system32\sc.exe" create "ElevationService" start= auto DisplayName= "Wondershare Driver Install Service help" binPath= "C:\Program Files\Wondershare\MobileTransPro\ElevationService.exe"C:\Windows\system32\sc.exe—mobiletrans_full5793.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1352"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" "C:\Program Files\Wondershare\WAF3\3.0.0.308\WsAppService3.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—WAFSetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1972"CertUtil.exe" -addstore TrustedPublisher "C:\Program Files\Wondershare\MobileTransPro\WsInfoTech.cer"C:\Windows\system32\CertUtil.exe—mobiletrans_full5793.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\certutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\certcli.dll
c:\windows\system32\user32.dll
2148DrvInst.exe "1" "200" "PCI\VEN_1AF4&DEV_1002&SUBSYS_00051AF4&REV_00\3&13c0b0c5&0&28" "" "" "6db87dc0b" "000005B4" "000003CC" "0000054C"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
3758096899
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2212"C:\Program Files\Wondershare\MobileTransPro\MobileTrans.exe" C:\Program Files\Wondershare\MobileTransPro\MobileTrans.exe
mobiletrans_setup_full5793.exe
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
Wondershare MobileTrans
Exit code:
0
Version:
2.1.0.129
Modules
Images
c:\program files\wondershare\mobiletranspro\mobiletrans.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2220C:\Users\Public\Documents\Wondershare\NFWCHK.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exe—mobiletrans_setup_full5793.exe
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
.NET Framework Checker
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\public\documents\wondershare\nfwchk.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2220"C:\Windows\System32\dinotify.exe" pnpui.dll,SimplifiedDINotificationC:\Windows\System32\dinotify.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Device Installation
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\nsi.dll
c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.windows.forms\3afcd5168c7a6cb02eab99d7fd71e102\system.windows.forms.ni.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
2452rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{76ab2c72-8833-41f8-9e6f-2a18f02506f8} "(null)"C:\Windows\system32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
2 975
Read events
2 581
Write events
378
Delete events
16

Modification events

(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WafCX
Operation:writeName:(default)
Value:
sku-ween
(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WafCX
Operation:writeName:5793
Value:
sku-ween
(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\Wondershare Helper Compact
Operation:writeName:ClientSign
Value:
{C4BA3647-0000-0QM0-0001-12A9866C77DE}
(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\WAF
Operation:writeName:ClientSign
Value:
{C4BA3647-0000-0QM0-0001-12A9866C77DE}
(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3312) mobiletrans_setup_full5793.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
190
Suspicious files
73
Text files
2 825
Unknown types
60

Dropped files

PID
Process
Filename
Type
3312mobiletrans_setup_full5793.exeC:\Users\admin\AppData\Local\Temp\wsWAE.logtext
MD5:—
SHA256:—
3312mobiletrans_setup_full5793.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exe.configxml
MD5:AD0967A0AB95AA7D71B3DC92B71B8F7A
SHA256:9C1212BC648A2533B53A2D0AFCEC518846D97630AFB013742A9622F0DF7B04FC
3312mobiletrans_setup_full5793.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exeexecutable
MD5:27CFB3990872CAA5930FA69D57AEFE7B
SHA256:43881549228975C7506B050BCE4D9B671412D3CDC08C7516C9DBBB7F50C25146
3312mobiletrans_setup_full5793.exeC:\Users\Public\Documents\Wondershare\mobiletrans_full5793.exe.~P2S —
MD5:—
SHA256:—
3312mobiletrans_setup_full5793.exeC:\Users\Public\Documents\Wondershare\mobiletrans_full5793.exe —
MD5:—
SHA256:—
2916mobiletrans_full5793.tmpC:\Users\admin\AppData\Local\Temp\is-COEV8.tmp\RCXBFD8.tmp —
MD5:—
SHA256:—
2916mobiletrans_full5793.tmpC:\Program Files\Wondershare\MobileTransPro\is-1QJCP.tmp —
MD5:—
SHA256:—
3312mobiletrans_setup_full5793.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\3[1].pngimage
MD5:—
SHA256:—
2916mobiletrans_full5793.tmpC:\Users\admin\AppData\Local\Temp\is-CJ15Q.tmp\is-HM0MS.tmp —
MD5:—
SHA256:—
3312mobiletrans_setup_full5793.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\5793-20191206163329[1].htmhtml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
90
TCP/UDP connections
165
DNS requests
69
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3312
mobiletrans_setup_full5793.exe
GET
—
47.91.67.36:80
http://dlinst.wondershare.com/player/style/jquery.orbit.min.js
US
—
—
suspicious
3312
mobiletrans_setup_full5793.exe
HEAD
200
47.246.43.209:80
http://download.wondershare.com/cbs_down/mobiletrans_full5793.exe
US
—
—
whitelisted
3312
mobiletrans_setup_full5793.exe
GET
—
47.91.67.36:80
http://dlinst.wondershare.com/player/style/jquery-1.4.4.min.js
US
—
—
suspicious
3312
mobiletrans_setup_full5793.exe
GET
304
47.91.67.36:80
http://dlinst.wondershare.com/player/style/fit-style1.0.1.css
US
—
—
suspicious
3312
mobiletrans_setup_full5793.exe
GET
—
47.246.43.209:80
http://download.wondershare.com/cbs_down/mobiletrans_full5793.exe
US
—
—
whitelisted
3312
mobiletrans_setup_full5793.exe
GET
206
47.246.43.209:80
http://download.wondershare.com/cbs_down/mobiletrans_full5793.exe
US
binary
18.8 Mb
whitelisted
3312
mobiletrans_setup_full5793.exe
GET
200
47.91.67.36:80
http://dlinst.wondershare.com/player/5793-20191206163329.html
US
html
881 b
suspicious
3312
mobiletrans_setup_full5793.exe
GET
206
47.246.43.209:80
http://download.wondershare.com/cbs_down/mobiletrans_full5793.exe
US
binary
18.8 Mb
whitelisted
3312
mobiletrans_setup_full5793.exe
GET
200
47.91.67.36:80
http://dlinst.wondershare.com/player/5793-20191206163329.html
US
html
881 b
suspicious
3312
mobiletrans_setup_full5793.exe
GET
200
47.91.67.36:80
http://dlinst.wondershare.com/player/5793-20191206163329/3.png?t=20191206163329
US
image
163 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3312
mobiletrans_setup_full5793.exe
47.91.67.36:80
platform.wondershare.com
Alibaba (China) Technology Co., Ltd.
US
suspicious
3312
mobiletrans_setup_full5793.exe
47.246.43.209:80
download.wondershare.com
—
US
malicious
—
—
47.246.43.209:80
download.wondershare.com
—
US
malicious
2916
mobiletrans_full5793.tmp
47.91.89.199:80
cbs.wondershare.com
Alibaba (China) Technology Co., Ltd.
US
malicious
2916
mobiletrans_full5793.tmp
104.109.78.157:443
mobiletrans.wondershare.com
Akamai International B.V.
NL
unknown
3440
iexplore.exe
47.91.89.199:80
cbs.wondershare.com
Alibaba (China) Technology Co., Ltd.
US
malicious
3440
iexplore.exe
104.109.78.157:443
mobiletrans.wondershare.com
Akamai International B.V.
NL
unknown
2212
MobileTrans.exe
64.233.180.101:443
www.google-analytics.com
Google Inc.
US
whitelisted
3440
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3440
iexplore.exe
104.108.40.45:443
neveragain.allstatics.com
Akamai Technologies, Inc.
NL
unknown

DNS requests

Domain
IP
Reputation
platform.wondershare.com
  • 47.91.67.36
suspicious
download.wondershare.com
  • 47.246.43.209
whitelisted
dlinst.wondershare.com
  • 47.91.67.36
suspicious
cbs.wondershare.com
  • 47.91.89.199
  • 47.91.91.66
  • 47.91.76.37
  • 47.91.89.20
whitelisted
mobiletrans.wondershare.com
  • 104.109.78.157
suspicious
www.google-analytics.com
  • 64.233.180.101
  • 64.233.180.102
  • 64.233.180.139
  • 64.233.180.113
  • 64.233.180.100
  • 64.233.180.138
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
neveragain.allstatics.com
  • 104.108.40.45
whitelisted
dc.wondershare.cc
  • 63.159.217.174
  • 70.39.188.24
  • 70.39.189.43
suspicious
images.wondershare.com
  • 23.66.22.104
whitelisted

Threats

PID
Process
Class
Message
3312
mobiletrans_setup_full5793.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
3312
mobiletrans_setup_full5793.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
3312
mobiletrans_setup_full5793.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
3312
mobiletrans_setup_full5793.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
3312
mobiletrans_setup_full5793.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
3312
mobiletrans_setup_full5793.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
3312
mobiletrans_setup_full5793.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
3312
mobiletrans_setup_full5793.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
3312
mobiletrans_setup_full5793.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3312
mobiletrans_setup_full5793.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
RegAsm.exe
Cannot delete a subkey tree because the subkey does not exist.
WsAppService3.exe
Program.InitApp 3.0.0.308: Start
ProcessKiller.exe
Plan A, 2s
ProcessKiller.exe
Plan A, start...
MobileTrans.exe
Program.InitApp
MobileTrans.exe
WsAppFoundation.InitApp 3.0.0.309: Start
MobileTrans.exe
SaveToXml(C:\ProgramData\Wondershare\WAF\ProductionStore.dat)
MobileTrans.exe
App com.wondershare.mobiletranswin, Start
MobileTrans.exe
Load ClientSign:
MobileTrans.exe
NewClientSign: {C4BA3647-FBFF-0005-06E3-12A9866C77DE}
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mobiletrans_setup_full5793.exe