analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FlixRape.exe

Full analysis: https://app.any.run/tasks/13551c95-417a-43f1-befb-52195834e2f0
Verdict: Malicious activity
Analysis date: February 11, 2019, 05:05:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

6607B4D4BEE1C76CE2D62EF99A135289

SHA1:

7DB46B3873D9AF6550458077CFACDD253289F2E9

SHA256:

E0D03EEC01589CED0B2872638650E5B1A1E83DEA526A9AB304DDF9D8BCE9CD31

SSDEEP:

196608:aGMMewaX5sBwaIaw48KwFqAZnaWTXS6SxndnZabT6jYSpW56X9j63KDe8HvK5eG1:QMhaX5sBwKwGAZ9Zsn7iI5rjM5eFVY5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • FlixRape.exe (PID: 3328)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • FlixRape.exe (PID: 3328)

    • Application launched itself

      • FlixRape.exe (PID: 3232)

    • Executable content was dropped or overwritten

      • FlixRape.exe (PID: 3232)

    • Loads Python modules

      • FlixRape.exe (PID: 3328)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • FlixRape.exe (PID: 3232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

Subsystem: Windows command line
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x769a
UninitializedDataSize: -
InitializedDataSize: 172032
CodeSize: 127488
LinkerVersion: 14
PEType: PE32
TimeStamp: 2017:12:11 16:09:08+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 11-Dec-2017 15:09:08

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000108

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 11-Dec-2017 15:09:08
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001F144
0x0001F200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.66103
.rdata
0x00021000
0x0000B06C
0x0000B200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.0856
.data
0x0002D000
0x0000E678
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.93451
.gfids
0x0003C000
0x000000B8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.85613
.rsrc
0x0003D000
0x0000EA38
0x0000EC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.29706
.reloc
0x0004C000
0x000017B8
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.6361

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.58652
3752
UNKNOWN
UNKNOWN
RT_ICON
2
6.05629
2216
UNKNOWN
UNKNOWN
RT_ICON
3
5.5741
1384
UNKNOWN
UNKNOWN
RT_ICON
4
7.95079
37019
UNKNOWN
UNKNOWN
RT_ICON
5
5.29119
9640
UNKNOWN
UNKNOWN
RT_ICON
6
5.43869
4264
UNKNOWN
UNKNOWN
RT_ICON
7
5.89356
1128
UNKNOWN
UNKNOWN
RT_ICON
101
2.71858
104
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

KERNEL32.dll
WS2_32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start flixrape.exe flixrape.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3232"C:\Users\admin\AppData\Local\Temp\FlixRape.exe" C:\Users\admin\AppData\Local\Temp\FlixRape.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
3328"C:\Users\admin\AppData\Local\Temp\FlixRape.exe" C:\Users\admin\AppData\Local\Temp\FlixRape.exe—FlixRape.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
2408C:\Windows\system32\cmd.exe /c clsC:\Windows\system32\cmd.exe—FlixRape.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
569
Read events
527
Write events
0
Delete events
0

Modification events

No data
Executable files
22
Suspicious files
1
Text files
913
Unknown types
2

Dropped files

PID
Process
Filename
Type
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\_bz2.pydexecutable
MD5:2CA0FDD57E58BAF984C2A983600D921A
SHA256:6F50408CE23F8F48BEFF467B3AD0EA34F140B8BC0DA3634CE6DAA8A9035E567F
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\_ctypes.pydexecutable
MD5:00051B5199D3B6A4DB50524BE9834400
SHA256:C8724CFFB9999C5D7A8D9684417A8BC32EC938214E9CF80D512043D9F975ABFA
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\select.pydexecutable
MD5:58404F55E2DA5A0E6F419D941B8C0551
SHA256:A99C9F9FB6EB823AA2472775125E63244EAA3895AC872F0F690962CF9DF21F29
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\lxml.etree.pydexecutable
MD5:4F9D9986B112B88CF8476C0B6F6DFB07
SHA256:94210465BABAD8DD84F112C4A338A77C21419337BBFEA1C73C14400D39486897
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\_lzma.pydexecutable
MD5:7C97599E2CA514B2787C3E5BCA56A7B8
SHA256:B4271370F7A93B767B1E57ED3889B84D088CD2606B7715B68EE06A6A280E1BCC
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\cryptography.hazmat.bindings._constant_time.pydexecutable
MD5:7F395D72AB4DDCC8306BD5BE8EA8FCC1
SHA256:8A5D51EB80F46F4F593A9C5CE25BA67A4078B141DBF1A75920B75C6631D92E3E
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\simplejson._speedups.pydexecutable
MD5:32B4B0EFE385826E0E9B151B2E839ED9
SHA256:6F1303691B5608F98E9C45E1B1A2DCA7F95F769FB63171785EDEFCBE7A4E7597
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\bcrypt._bcrypt.pydexecutable
MD5:0456151B6B7CB468225AD314DCC97137
SHA256:8844A665D3A6CFDFFE7C538AF4DA81751B0FCEDBD6408C07ABF9FB20FD1AB859
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\_ssl.pydexecutable
MD5:5F485041A6CA12EFFFC0FA2DBA3BD618
SHA256:AA4C266B8E6CACDFBE06FC53E60F5A09FE7B8092C9E9E5B3B0A3AB2C62F36B97
3232FlixRape.exeC:\Users\admin\AppData\Local\Temp\_MEI32322\_cffi_backend.pydexecutable
MD5:7BFFCF7C75E45FFABB1599D6B13B4882
SHA256:3FAF98FAFBB7EE72C2F7357AFFF62848FBE3570150B93387F00D7137505D4003
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
FlixRape.exe