analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d

Full analysis: https://app.any.run/tasks/bbea92aa-2c7b-41ef-95fc-e2e4eac95429
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: June 19, 2019, 05:51:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
adware
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
MD5:

2CDEDA4BE0FD9751393A3E53A5AC8AA0

SHA1:

4FA023AB9A506F003E2EB37DC633FC16951D2545

SHA256:

E3B1B7B35FA4221425760D6F75293CEB26A867780CB68BE004509C611E51B02D

SSDEEP:

12288:6tobbXN42nHq+EgqfRAUEcB3gOE6DZlZUXavlXluE70pFdZigcyrG4EEu44yZ:6t8RHjEgYAw1hZlZTWQu7igcyKPEuj2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe (PID: 2312)
    • Loads dropped or rewritten executable

      • e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe (PID: 3548)
    • Connects to CnC server

      • internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe (PID: 2312)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe (PID: 3548)
      • internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe (PID: 2312)
    • Changes tracing settings of the file or console

      • internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe (PID: 2312)
    • Reads internet explorer settings

      • internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe (PID: 2312)
  • INFO

    • Reads settings of System Certificates

      • internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe (PID: 2312)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:19 16:01:49+01:00
PEType: PE32
LinkerVersion: 2.22
CodeSize: 35328
InitializedDataSize: 20480
UninitializedDataSize: 109568
EntryPoint: 0x4327
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.1.1.35
ProductVersionNumber: 1.1.1.35
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Casino.com
FileDescription: Casino.com Installer
FileVersion: 1.1.1.35
LegalCopyright: Copyright 2017
ProductName: Casino.com

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Feb-2012 15:01:49
Detected languages:
  • English - United States
CompanyName: Casino.com
FileDescription: Casino.com Installer
FileVersion: 1.1.1.35
LegalCopyright: Copyright 2017
ProductName: Casino.com

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 19-Feb-2012 15:01:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00008844
0x00008A00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.97387
.data
0x0000A000
0x0000008C
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.18031
.rdata
0x0000B000
0x00002394
0x00002400
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.89911
.bss
0x0000E000
0x0001ABD0
0x00000000
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00029000
0x00001304
0x00001400
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.23715
.ndata
0x0002B000
0x0000A000
0x00000400
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00035000
0x00005B20
0x00005C00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.46013

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.22935
949
UNKNOWN
English - United States
RT_MANIFEST
2
4.51155
4264
UNKNOWN
English - United States
RT_ICON
3
4.74626
2440
UNKNOWN
English - United States
RT_ICON
4
4.33487
1384
UNKNOWN
English - United States
RT_ICON
5
0
1128
UNKNOWN
English - United States
RT_ICON
6
0
744
UNKNOWN
English - United States
RT_ICON
7
0
296
UNKNOWN
English - United States
RT_ICON
103
2.71414
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.72007
574
UNKNOWN
English - United States
RT_DIALOG
106
2.84976
260
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.DLL
GDI32.dll
KERNEL32.dll
SHELL32.DLL
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe

Process information

PID
CMD
Path
Indicators
Parent process
3548"C:\Users\admin\AppData\Local\Temp\e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe" C:\Users\admin\AppData\Local\Temp\e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
explorer.exe
User:
admin
Company:
Casino.com
Integrity Level:
MEDIUM
Description:
Casino.com Installer
Version:
1.1.1.35
2312C:\Users\admin\AppData\Local\Temp\nsl402B.tmp\internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe /baseInstaller='C:/Users/admin/AppData/Local/Temp/e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe' /fallbackfolder='C:/Users/admin/AppData/Local/Temp/nsl402B.tmp/fallbackfiles/'C:\Users\admin\AppData\Local\Temp\nsl402B.tmp\internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
User:
admin
Company:
Casino.com
Integrity Level:
MEDIUM
Description:
Casino.com
Version:
1.1.1.33
Total events
560
Read events
517
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
6
Text files
268
Unknown types
4

Dropped files

PID
Process
Filename
Type
2312internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Temp\81D013712EBF4E3D91B066BB9818A6BE\81D013712EBF4E3D91B066BB9818A6BE_LogFile.txttext
MD5:ADF5D8878A7FE17252EF6192909C0D90
SHA256:701D274429C573C6A2D642D748F30327805239ECE614383682C8875B07E995CE
3548e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Temp\nsl402B.tmp\internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d_icon.icoimage
MD5:055C2CB77FA2EDC2802B7FD397B9C213
SHA256:78D0ED2288334F341225ACEE3D6200D01BB0BB80B873C448AB151D0661817BF2
3548e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Temp\nsl402B.tmp\internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d_splash.pngimage
MD5:FE272D040E82704707B19BFBF29D65CA
SHA256:1CB036DA61DC7B1AD62280681C724D74CBCC313D530A799728A4D38B4E2B1983
3548e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Temp\nsl402B.tmp\internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeexecutable
MD5:9AB5DB4BB5971035B4D287D64F9676B5
SHA256:F2126481C02D2A5AF29E56023902A0897D05867C1CAAF8079CF6E1F05DD9B209
3548e3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Temp\nsl402B.tmp\StdUtils.dllexecutable
MD5:21010DF9BC37DAFFCC0B5AE190381D85
SHA256:0EBD62DE633FA108CF18139BE6778FA560680F9F8A755E41C6AB544AB8DB5C16
2312internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\index[1].7zebinary
MD5:E1EA8E5E038B48BCB904D5FDC8E90E89
SHA256:F45DFA771A941533ECC41BB1178DFD6289CE6333124BAD5F217FFB41E6200C13
2312internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Temp\81D013712EBF4E3D91B066BB9818A6BE\index27538.7zecompressed
MD5:9D5CA0A2963AA647B83C94574DF961B3
SHA256:A900B168786AB7BE127005DBB86BCE319CB1738EC7F2DF0614558BE6059385EA
2312internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019061920190620\index.datdat
MD5:93E8BECFE266FB919E098CB4E8DFC31A
SHA256:AA908A5E6E03E0AA49686975F7F161FD58BF0385D53559EF3A247DBCD89CCA5C
2312internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Temp\81D013712EBF4E3D91B066BB9818A6BE\index.htmlhtml
MD5:765778B0694375D4632310AF7B31A304
SHA256:FF42B641F96F3869A2225D36B475C1F0E209F97B3D3771BA11B91AF4EE89F7F0
2312internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exeC:\Users\admin\AppData\Local\Temp\81D013712EBF4E3D91B066BB9818A6BE\index.7zebinary
MD5:E1EA8E5E038B48BCB904D5FDC8E90E89
SHA256:F45DFA771A941533ECC41BB1178DFD6289CE6333124BAD5F217FFB41E6200C13
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
10
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
GET
200
163.171.128.148:80
http://cache.download2.casino.com/download/casino/115/casino[en].cab
US
84.3 Mb
malicious
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
GET
200
205.185.208.154:80
http://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/casino_casinocom_new/index.7ze
US
binary
124 Kb
malicious
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
GET
200
163.171.128.148:80
http://cache.download2.casino.com/download/casino/client_update_urls.php
US
text
55 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
205.185.208.154:80
t8u4n6u7.ssl.hwcdn.net
Highwinds Network Group, Inc.
US
malicious
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
205.185.208.154:443
t8u4n6u7.ssl.hwcdn.net
Highwinds Network Group, Inc.
US
malicious
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
163.171.128.148:80
cache.download2.casino.com
US
malicious

DNS requests

Domain
IP
Reputation
t8u4n6u7.ssl.hwcdn.net
  • 205.185.208.154
malicious
c6m7w2m9.ssl.hwcdn.net
  • 205.185.208.154
malicious
cache.download2.casino.com
  • 163.171.128.148
  • 163.171.132.119
malicious

Threats

PID
Process
Class
Message
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
Misc activity
SUSPICIOUS [PTsecurity] C: \ filepath observed in HTTP header
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
Misc activity
ADWARE [PTsecurity] Win32/PlayTech.A
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
A Network Trojan was detected
ET TROJAN Playtech Downloader Online Gaming Checkin
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
Misc activity
ADWARE [PTsecurity] Win32/PlayTech.A
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
Misc activity
SUSPICIOUS [PTsecurity] C: \ filepath observed in HTTP header
2312
internale3b1b7b35fa4221425760d6f75293ceb26a867780cb68be004509c611e51b02d.exe
Misc activity
ADWARE [PTsecurity] Win32/PlayTech.A
2 ETPRO signatures available at the full report
No debug info