analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip

Full analysis: https://app.any.run/tasks/04e961da-5291-41e1-8213-036d2d5aeca7
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 22:36:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ransomware
stop
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

C1ACB33E084DAF418279BAD5C383470B

SHA1:

BAA2F4F5B3655EF427BAA42D5F59E2511C05D1E7

SHA256:

E7314F5F29097BF5E3AC35220E15030FEF9E1DF53753D12352D8420D869725EF

SSDEEP:

12288:9kLHXjgM14/64hT/05NIVoclKU6OwaloRHoCyrrnN7C/s65/WUVVad8b:sjgSuYjIVocgR7gnN70ss//VaM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3824)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3068)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1764)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3592)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 116)

    • Changes settings of System certificates

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 116)

    • Changes the autorun value in the registry

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)

    • Loads the Task Scheduler COM API

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3592)

    • STOP was detected

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3592)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2180)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3824)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1764)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3592)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3068)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 116)
      • notepad++.exe (PID: 2856)

    • Reads the computer name

      • WinRAR.exe (PID: 2180)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3592)
      • notepad++.exe (PID: 2856)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 116)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2180)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2180)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)

    • Application launched itself

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3824)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1764)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3068)

    • Adds / modifies Windows certificates

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 116)

    • Uses ICACLS.EXE to modify access control list

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)

  • INFO

    • Checks supported languages

      • explorer.exe (PID: 2100)
      • icacls.exe (PID: 2036)

    • Reads the computer name

      • explorer.exe (PID: 2100)
      • icacls.exe (PID: 2036)

    • Manual execution by user

      • explorer.exe (PID: 2100)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3824)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1764)
      • notepad++.exe (PID: 2856)

    • Reads settings of System Certificates

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 116)

    • Checks Windows Trust Settings

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2320)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2022:01:24 15:40:21
ZipCRC: 0xac31dfc4
ZipCompressedSize: 716690
ZipUncompressedSize: 808448
ZipFileName: 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
10
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe explorer.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe icacls.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe #STOP 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe notepad++.exe

Process information

PID
CMD
Path
Indicators
Parent process
2180"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
2100"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3824"C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2320"C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2036icacls "C:\Users\admin\AppData\Local\e6b5fd98-65c3-443b-b7ac-7e4123032026" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\system32\icacls.exe—161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3068"C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3592"C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Integrity Level:
HIGH
1764"C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
116"C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2856"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe"C:\Program Files\Notepad++\notepad++.exe
Explorer.EXE
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
3221225547
Version:
7.91
Total events
9 997
Read events
9 813
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
8
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
2320161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:53ABFD4643765A8A6E888EFD17EBA63A
SHA256:4148EF703D054EDBD17E6732D9FC60E96C1F48FCE98D92B68560E7425D2EE8BA
2320161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:DB706D9D44D9EB7E16F92E39CA2BAF9E
SHA256:7218AAC0DC5BDEE7A5AE58F9744DBAAED1B26DC88471F965BCCEA66610D7EE9E
116161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\geo[1].jsonbinary
MD5:9C7C82D6DE8FCFBEBC5693D1AE6815EE
SHA256:E22A291BB5B3C4DF18EBF91900C699089668D6CA8AA220B284E8ECDEF539A888
3592161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\get[1].htmbinary
MD5:856F86FA2DBB84B24F7DC5CE447859FB
SHA256:4D8FF1AB7F22F5D740C6FC63021358E207DE1E918983DAAA773AA3EB6F40BA96
2180WinRAR.exeC:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeexecutable
MD5:7382BE38C39BFD3FF5DDD1D8A9FAAA6A
SHA256:161548B327B0AB4197A1F1B0D3BC8668BEADBBBDBB05A92D25478F4358733C34
2856notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\session.xmltext
MD5:E2F20186F637E3770B80E16A74E61AE4
SHA256:61F36DB19BF0E5FD44E3352158676F48C8E21C66E0748F39288DA1F21C808245
2320161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:49639B4124119DFEB7616D8DD50F9BB7
SHA256:7F935C9D0A9BD17558459D5A6387B61452011BEA4589AD94A6F2435540A373B5
2320161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:3764883055DA6FFC81E4A929CA5072C1
SHA256:7FF45E2195491FA6A2F3CECEE4B52D9E964CB6719448431B1C7B702E98076920
2320161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:264B14520732D44F5F6937D5303F1F18
SHA256:A5A71C5914C95B0DD63FBE2A43A010D0225C16C65C15E16D965DCFB58C5C15E7
2320161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\geo[1].jsonbinary
MD5:9C7C82D6DE8FCFBEBC5693D1AE6815EE
SHA256:E22A291BB5B3C4DF18EBF91900C699089668D6CA8AA220B284E8ECDEF539A888
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
8
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2320
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
104.18.31.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
3592
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
58.124.228.242:80
http://tzgl.org/fhsgtsspen6/get.php?pid=6E3AAB7CB29BC9495DFDE01272C66F39&first=true
KR
binary
559 b
malicious
3592
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
404
58.124.228.242:80
http://tzgl.org/files/1/build3.exe
KR
html
216 b
malicious
2320
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
104.18.30.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2320
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0657f48f330ccdd6
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2320
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2320
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
104.18.31.182:80
ocsp.comodoca.com
Cloudflare Inc
US
unknown
2320
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
—
—
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
116
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
2320
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
104.18.30.182:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious
3592
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
58.124.228.242:80
tzgl.org
SK Broadband Co Ltd
KR
malicious

DNS requests

Domain
IP
Reputation
api.2ip.ua
  • 77.123.139.190
shared
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.comodoca.com
  • 104.18.31.182
  • 104.18.30.182
whitelisted
ocsp.usertrust.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
kotob.top
  • —
malicious
tzgl.org
  • 58.124.228.242
  • 58.235.189.190
  • 84.40.106.91
  • 95.104.121.111
  • 37.34.176.37
  • 183.100.39.157
  • 186.212.119.117
  • 77.243.64.119
  • 196.200.111.5
  • 197.44.54.172
malicious

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET POLICY External IP Address Lookup DNS Query (2ip .ua)
2320
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
3592
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
3592
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
3592
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
A Network Trojan was detected
ET TROJAN Potential Dridex.Maldoc Minimal Executable Request
116
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
3 ETPRO signatures available at the full report
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip