File name: | DraftableCompare.exe |
Full analysis: | https://app.any.run/tasks/9a53c69d-dff2-4e34-99f3-4490f9de85f0 |
Verdict: | Malicious activity |
Analysis date: | May 14, 2019, 23:31:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 4DD1BBDC08B9C120AF5CC34A592CF917 |
SHA1: | F575F63888977250399F9513E82D8C11288B7223 |
SHA256: | E1283A9491E435D6ACFE54871E6BE8B036B713A14E2A1C244D908F0B6E4DDB12 |
SSDEEP: | 12288:bDPdsil5fCMggBIiMVO26kk+FGzeMb01JQntLOCVkoSrUf:bD1s2ts96kTMemVuc |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
ProductVersion: | 14.0.23107.0 |
---|---|
ProductName: | - |
OriginalFileName: | setup.exe |
LegalCopyright: | © Microsoft Corporation. All rights reserved. |
InternalName: | setup.exe |
FileVersion: | 14.0.23107.0 built by: D14REL |
FileDescription: | Setup |
CompanyName: | - |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 14.0.23107.0 |
FileVersionNumber: | 14.0.23107.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | 10 |
OSVersion: | 5.1 |
EntryPoint: | 0x330c2 |
UninitializedDataSize: | - |
InitializedDataSize: | 481792 |
CodeSize: | 364544 |
LinkerVersion: | 14 |
PEType: | PE32 |
TimeStamp: | 2015:07:07 08:26:33+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 07-Jul-2015 06:26:33 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | - |
FileDescription: | Setup |
FileVersion: | 14.0.23107.0 built by: D14REL |
InternalName: | setup.exe |
LegalCopyright: | © Microsoft Corporation. All rights reserved. |
OriginalFilename: | setup.exe |
ProductName: | - |
ProductVersion: | 14.0.23107.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000118 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 07-Jul-2015 06:26:33 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00058E58 | 0x00059000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.39733 |
.data | 0x0005A000 | 0x00003D2C | 0x00001800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.69795 |
.idata | 0x0005E000 | 0x0000152A | 0x00001600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.45654 |
.rsrc | 0x00060000 | 0x0006EF64 | 0x0006F000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.27334 |
.reloc | 0x000CF000 | 0x00003B4C | 0x00003C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.60243 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.22945 | 1378 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 2.59785 | 3752 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 2.61852 | 2216 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 1.63426 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 7.87399 | 7820 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 3.07929 | 16936 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 3.33247 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
8 | 3.65064 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
9 | 3.99341 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
10 | 7.07398 | 1885 | Latin 1 / Western European | English - United States | RT_ICON |
ADVAPI32.dll (delay-loaded) |
CRYPT32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
Secur32.dll |
USER32.dll |
WININET.dll |
msi.dll |
ole32.dll |
Title | Ordinal | Address |
---|---|---|
_DecodePointerInternal@4 | 1 | 0x0001FC22 |
_EncodePointerInternal@4 | 2 | 0x0001FC3D |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2836 | "C:\Users\admin\AppData\Local\Temp\DraftableCompare.exe" | C:\Users\admin\AppData\Local\Temp\DraftableCompare.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Description: Setup Exit code: 0 Version: 14.0.23107.0 built by: D14REL | ||||
3172 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe | DraftableCompare.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ClickOnce Version: 4.6.1055.0 built by: NETFXREL2 | ||||
2780 | "C:\Users\admin\AppData\Local\Apps\2.0\C0ETBZ5E.AQQ\C5Q0YD8G.2OH\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe" | C:\Users\admin\AppData\Local\Apps\2.0\C0ETBZ5E.AQQ\C5Q0YD8G.2OH\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe | dfsvc.exe | |
User: admin Company: Draftable Integrity Level: MEDIUM Description: Draftable.CompareTool Version: 1.1.3.2 |
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASAPI32 |
Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASMANCS |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASMANCS |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASMANCS |
Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
(PID) Process: | (2836) DraftableCompare.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\DraftableCompare_RASMANCS |
Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3172 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\RXRCG5P2.2NR\AN8B43ZQ.CKY\Resources\draftable.ico | image | |
MD5:02AA92CBB2DE4C732EDEB72A8F7B6B81 | SHA256:9732AE5D3775A8380461B3CE2079F2FB2F6FB4C4FFEDEE993F186750C249D462 | |||
2836 | DraftableCompare.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\Draftable.CompareTool[1].application | xml | |
MD5:EDE9EF4AC78C47252E3210EC4B633281 | SHA256:8814D166FC41920E55C9C044B330E3E74469BB968868731EC0C0DAAAE128BA7C | |||
3172 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\RXRCG5P2.2NR\AN8B43ZQ.CKY\x64\pdfium.dll | executable | |
MD5:2A3F9078D6CD6998A865BB10D3AE68D4 | SHA256:A44BA72EA56BDFCD3D3AF429D97816159ED13A96BB5CACA7D4D694C8A4DDAFDE | |||
3172 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\RXRCG5P2.2NR\AN8B43ZQ.CKY\x64\xcpro40.dll | executable | |
MD5:367EAF4A33FCEE47E0AB43C9A3545DF5 | SHA256:135700489D2E31D66F27E2CA7C15E2C6E12F8FA540779D93CF6475B554B54C09 | |||
2836 | DraftableCompare.exe | C:\Users\admin\AppData\Local\Temp\VSD4029.tmp\install.log | binary | |
MD5:95F029F6B8C00AEAFF181AD5098A103F | SHA256:13FD579F0438C5E72851B5CDE8BBEA098B704D8FE98C7F359BF70A46920E4EFA | |||
3172 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\RXRCG5P2.2NR\AN8B43ZQ.CKY\x64\xccdx40.dll | executable | |
MD5:39886F4270E543400FB275F04454364B | SHA256:A1FFB2D409B06D6AD5D73ABE66D150EFFF31AEC3630F1E1E943B552451EE2BC8 | |||
3172 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\TAGE7TEQ.R9W\W71C8J0K.L4Y.application | xml | |
MD5:EDE9EF4AC78C47252E3210EC4B633281 | SHA256:8814D166FC41920E55C9C044B330E3E74469BB968868731EC0C0DAAAE128BA7C | |||
3172 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\RXRCG5P2.2NR\AN8B43ZQ.CKY\x64\netlib40.dll | executable | |
MD5:C17A925588D8A56F9AD5766E166C9FEA | SHA256:2D3EA99A938C238D5E92227DDB7F7922F288AB48865600806CAC542DC9EBDAFF | |||
3172 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\RXRCG5P2.2NR\AN8B43ZQ.CKY\x64\pxclib40.dll | executable | |
MD5:8E19E4D78E8F0230DBCA1CC7EFB5C062 | SHA256:03132B54014F26154785D1C4F0B8F9CFDC8188BA326095F2ACC18CB381D27C09 | |||
3172 | dfsvc.exe | C:\Users\admin\AppData\Local\Temp\Deployment\RXRCG5P2.2NR\AN8B43ZQ.CKY\x86\xccdx40.dll | executable | |
MD5:FB004BF4D57437441B4B1184EE9CD68E | SHA256:A2298903155E9D4D81146496EB22DD71B004E09C3777F45519A72E5D9E76A49A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3172 | dfsvc.exe | GET | 200 | 104.18.11.39:80 | http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt | US | der | 1.30 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3172 | dfsvc.exe | 104.18.11.39:80 | cacerts.digicert.com | Cloudflare Inc | US | shared |
2836 | DraftableCompare.exe | 52.216.112.227:443 | draftable-compare.s3.amazonaws.com | Amazon.com, Inc. | US | unknown |
2780 | Draftable.CompareTool.exe | 52.216.100.27:443 | draftable-compare.s3.amazonaws.com | Amazon.com, Inc. | US | unknown |
3172 | dfsvc.exe | 52.216.112.227:443 | draftable-compare.s3.amazonaws.com | Amazon.com, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
draftable-compare.s3.amazonaws.com |
| shared |
cacerts.digicert.com |
| whitelisted |
Process | Message |
---|---|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|