File name:

Brothersoftdownloader_for_Cross_Fire.exe

Full analysis: https://app.any.run/tasks/e20f71a4-52a9-4363-aa21-be2ece23d2f6
Verdict: No threats detected
Analysis date: March 21, 2019, 14:07:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

1721772B993CD737211D61EADD812628

SHA1:

72C23BAE8397E6DA31E8BAD386AB62AADF8211FA

SHA256:

E6B817CF810C7667D9F98A896A5AA1CABC39E5999DA2D8AF3A7574C61EB20B69

SSDEEP:

6144:ZgRyiIWQFpUv4/B+FrM144XlzKlUAzYYbuewX79GtPuB8PxwPh79i5s/CoS9iP6Q:3iMCv45+uK4VKXknewr9GBY85wPTi5s9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads internet explorer settings

      • Brothersoftdownloader_for_Cross_Fire.exe (PID: 1524)

    • Creates files in the user directory

      • Brothersoftdownloader_for_Cross_Fire.exe (PID: 1524)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (28.6)
.exe | UPX compressed Win32 Executable (28)
.exe | Win32 EXE Yoda's Crypter (27.5)
.dll | Win32 Dynamic Link Library (generic) (6.8)
.exe | Win32 Executable (generic) (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:08:02 20:17:21+02:00
PEType: PE32
LinkerVersion: 8
CodeSize: 327680
InitializedDataSize: 40960
UninitializedDataSize: 729088
EntryPoint: 0x101a80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.7.1
ProductVersionNumber: 1.0.7.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Conduit
FileDescription: Brothersoft Download Manager
FileVersion: 1.0.0
InternalName: Brothersoft Download Manager
LegalCopyright: © Conduit
OriginalFileName: cdm.exe
ProductName: Brothersoft Download Manager
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start brothersoftdownloader_for_cross_fire.exe

Process information

PID
CMD
Path
Indicators
Parent process
1524"C:\Users\admin\AppData\Local\Temp\Brothersoftdownloader_for_Cross_Fire.exe" C:\Users\admin\AppData\Local\Temp\Brothersoftdownloader_for_Cross_Fire.exe
explorer.exe
User:
admin
Company:
Conduit
Integrity Level:
MEDIUM
Description:
Brothersoft Download Manager
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\brothersoftdownloader_for_cross_fire.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
121
Read events
91
Write events
30
Delete events
0

Modification events

(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_CURRENT_USER\Software\Headlight\GetRightToGo\CustomizedApps
Operation:writeName:Brothersoftdownloader_for_Cross_Fire
Value:
1
(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_CURRENT_USER\Software\Headlight\GetRightToGo\SharedConfig
Operation:writeName:BusyPause
Value:
15
(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_CURRENT_USER\Software\Headlight\GetRightToGo\SharedConfig
Operation:writeName:FileCache
Value:
0
(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_CURRENT_USER\Software\Headlight\GetRightToGo\SharedConfig
Operation:writeName:FileCacheKB
Value:
100
(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_CURRENT_USER\Software\Headlight\GetRightToGo\SharedConfig
Operation:writeName:Rollback
Value:
0
(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_CURRENT_USER\Software\Headlight\GetRightToGo\SharedConfig
Operation:writeName:DotGetRight
Value:
0
(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Brothersoftdownloader_for_Cross_Fire_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1524) Brothersoftdownloader_for_Cross_Fire.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Brothersoftdownloader_for_Cross_Fire_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
0
Text files
11
Unknown types
1

Dropped files

PID
Process
Filename
Type
1524Brothersoftdownloader_for_Cross_Fire.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\20100826[1].jpgimage
MD5:—
SHA256:—
1524Brothersoftdownloader_for_Cross_Fire.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019032120190322\index.datdat
MD5:—
SHA256:—
1524Brothersoftdownloader_for_Cross_Fire.exeC:\Users\admin\AppData\Roaming\GetRightToGo\Brothersoftdownloader_for_Cross_Fire.d000text
MD5:—
SHA256:—
1524Brothersoftdownloader_for_Cross_Fire.exeC:\Users\admin\AppData\Roaming\GetRightToGo\Brothersoftdownloader_for_Cross_Fire.data0text
MD5:—
SHA256:—
1524Brothersoftdownloader_for_Cross_Fire.exeC:\Users\admin\AppData\Roaming\GetRightToGo\Brothersoftdownloader_for_Cross_Fire.htmhtml
MD5:33F09577707D079A40F706A18E126D92
SHA256:E7F6BD122FCB829793F4047A5B929668B0A91EBFE31247B479586EC6D8F2B378
1524Brothersoftdownloader_for_Cross_Fire.exeC:\Users\admin\AppData\Roaming\GetRightToGo\Brothersoftdownloader_for_Cross_Fire.datatext
MD5:94DF78033ED3B6805C6816A700BC3BB0
SHA256:FB9B84D76EE3711A20A84A6E8A947F8168C1612702B872093572C8FFAD92B879
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
6
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1524
Brothersoftdownloader_for_Cross_Fire.exe
GET
—
148.153.64.199:80
http://usfiles.brothersoft.com/internet/miscellaneous/11CT2776682_BrotherSoft_Extreme.exe
US
—
—
malicious
1524
Brothersoftdownloader_for_Cross_Fire.exe
GET
302
184.172.2.118:80
http://downloader.brothersoft.com/toolbar_statistics.php?flag=international
US
—
—
whitelisted
1524
Brothersoftdownloader_for_Cross_Fire.exe
GET
200
2.16.186.74:80
http://img.brothersoft.com/softsale/img/20100826.jpg
unknown
image
35.1 Kb
whitelisted
1524
Brothersoftdownloader_for_Cross_Fire.exe
GET
403
148.153.64.199:80
http://usfiles.brothersoft.com/internet/miscellaneous/11CT2776682_BrotherSoft_Extreme.exe
US
html
169 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1524
Brothersoftdownloader_for_Cross_Fire.exe
2.16.186.120:80
img.brothersoft.com
Akamai International B.V.
—
whitelisted
1524
Brothersoftdownloader_for_Cross_Fire.exe
184.172.2.118:80
downloader.brothersoft.com
SoftLayer Technologies Inc.
US
suspicious
1524
Brothersoftdownloader_for_Cross_Fire.exe
148.153.64.199:80
usfiles.brothersoft.com
Capitalonline Data Service Co.,LTD
US
malicious
1524
Brothersoftdownloader_for_Cross_Fire.exe
2.16.186.74:80
img.brothersoft.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
img.brothersoft.com
  • 2.16.186.120
  • 2.16.186.74
whitelisted
downloader.brothersoft.com
  • 184.172.2.118
whitelisted
usfiles.brothersoft.com
  • 148.153.64.199
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Brothersoftdownloader_for_Cross_Fire.exe