File name:

droid4x.exe

Full analysis: https://app.any.run/tasks/83b1c79a-76ec-4e1e-a14b-7841289563a8
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: November 19, 2020, 22:02:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F258A1BB7BD68D68CD0A5AA826FEF3B8

SHA1:

546428DA88A53BA68C24FE38EA14E6238AEB948D

SHA256:

ECB36D1A2B9DB95D49BA39C83495108CC2C5B2171FFBBCC887ED12AA53D64535

SSDEEP:

196608:RiCeZw7/ErVJP393fZHbRw85DYYCwHOgm+E:qHrVJRTj+wHE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • MiniThunderPlatform.exe (PID: 3176)
      • droid4x.exe (PID: 2492)

    • Application was dropped or rewritten from another process

      • MiniThunderPlatform.exe (PID: 3176)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • droid4x.exe (PID: 2492)

    • Creates files in the user directory

      • droid4x.exe (PID: 2492)

    • Creates files in the program directory

      • MiniThunderPlatform.exe (PID: 3176)

    • Low-level read access rights to disk partition

      • MiniThunderPlatform.exe (PID: 3176)

  • INFO

    • Reads the hosts file

      • MiniThunderPlatform.exe (PID: 3176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ax | DirectShow filter (54.7)
.exe | Win32 EXE PECompact compressed (generic) (11.2)
.exe | Win32 Executable (generic) (1.2)
.exe | Generic Win/DOS Executable (0.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:12:11 14:05:54+01:00
PEType: PE32
LinkerVersion: 12
CodeSize: 738816
InitializedDataSize: 8004096
UninitializedDataSize: -
EntryPoint: 0x97323
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Dec-2015 13:05:54
Detected languages:
  • Chinese - PRC
  • English - United States
Debug artifacts:
  • D:\packPlayer\smartInstaller\SmartInstaller\Release\Droid4XSetup.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 11-Dec-2015 13:05:54
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000B4506
0x000B4600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.49203
.rdata
0x000B6000
0x000217CE
0x00021800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.06346
.data
0x000D8000
0x00005E5C
0x00002C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.35566
.rsrc
0x000DE000
0x00771BF0
0x00771C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.76971
.reloc
0x00850000
0x00008CA4
0x00008E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.58444

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89623
392
UNKNOWN
English - United States
RT_MANIFEST
2
3.27441
2440
UNKNOWN
Chinese - PRC
RT_ICON
3
2.63843
4264
UNKNOWN
Chinese - PRC
RT_ICON
4
2.57184
9640
UNKNOWN
Chinese - PRC
RT_ICON
5
2.13514
16936
UNKNOWN
Chinese - PRC
RT_ICON
6
1.8542
67624
UNKNOWN
Chinese - PRC
RT_ICON
7
2.31718
88
UNKNOWN
Chinese - PRC
RT_STRING
8
3.26148
1128
UNKNOWN
Chinese - PRC
RT_ICON
9
3.27441
2440
UNKNOWN
Chinese - PRC
RT_ICON
10
2.63843
4264
UNKNOWN
Chinese - PRC
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WLDAP32.dll
WS2_32.dll

Exports

Title
Ordinal
Address
WMI_Exit
1
0x0000AAB0
WMI_GetFirstHardwareInfo
2
0x0000AAD0
WMI_GetNextHardwareInfo
3
0x0000AB10
WMI_Init
4
0x0000AB50
WMI_Install
5
0x0000AB80
WMI_UnInstall
6
0x0000AC90
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start droid4x.exe minithunderplatform.exe droid4x.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2376"C:\Users\admin\AppData\Local\Temp\droid4x.exe" C:\Users\admin\AppData\Local\Temp\droid4x.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\droid4x.exe
c:\systemroot\system32\ntdll.dll
2492"C:\Users\admin\AppData\Local\Temp\droid4x.exe" C:\Users\admin\AppData\Local\Temp\droid4x.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\droid4x.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3176"C:\Users\admin\AppData\Roaming\HaiYuInst\plugins\download\MiniThunderPlatform.exe" -StartTPC:\Users\admin\AppData\Roaming\HaiYuInst\plugins\download\MiniThunderPlatform.exe
droid4x.exe
User:
admin
Company:
深圳市迅雷网络技术有限公司
Integrity Level:
HIGH
Description:
迅雷云加速开放平台
Exit code:
0
Version:
3.2.1.50
Modules
Images
c:\users\admin\appdata\roaming\haiyuinst\plugins\download\minithunderplatform.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
49
Read events
32
Write events
17
Delete events
0

Modification events

(PID) Process:(2492) droid4x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
droid4x.exe
(PID) Process:(3176) MiniThunderPlatform.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3176) MiniThunderPlatform.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MiniThunderPlatform_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3176) MiniThunderPlatform.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MiniThunderPlatform_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3176) MiniThunderPlatform.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MiniThunderPlatform_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3176) MiniThunderPlatform.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MiniThunderPlatform_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3176) MiniThunderPlatform.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MiniThunderPlatform_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3176) MiniThunderPlatform.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MiniThunderPlatform_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
11
Suspicious files
1
Text files
29
Unknown types
0

Dropped files

PID
Process
Filename
Type
2492droid4x.exeC:\Users\admin\AppData\Roaming\HaiYuInst\plugins\download\id.dattext
MD5:—
SHA256:—
3176MiniThunderPlatform.exeC:\Users\Public\Thunder Network\Mini_downloadlib\ODAwMDA2MDA=\Version_3_2_1_50\Profiles\asyn_frame.dattext
MD5:—
SHA256:—
3176MiniThunderPlatform.exeC:\Users\Public\Thunder Network\Mini_downloadlib\ODAwMDA2MDA=\Version_3_2_1_50\Profiles\download.cfgtext
MD5:—
SHA256:—
2492droid4x.exeC:\Users\admin\AppData\Roaming\HaiYuInst\plugins\download\XLBugReport.exeexecutable
MD5:67C767470D0893C4A2E46BE84C9AFCBB
SHA256:64F8D68CC1CFC5B9CC182DF3BECF704AF93D0F1CC93EE59DBF682C75B6D4FFC0
2492droid4x.exeC:\Users\admin\AppData\Roaming\HaiYuInst\plugins\download\msvcr71.dllexecutable
MD5:CA2F560921B7B8BE1CF555A5A18D54C3
SHA256:C4D4339DF314A27FF75A38967B7569D9962337B8D4CD4B0DB3ABA5FF72B2BFBB
2492droid4x.exeC:\Users\admin\AppData\Roaming\HaiYuInst\plugins\download\zlib1.dllexecutable
MD5:89F6488524EAA3E5A66C5F34F3B92405
SHA256:BD29D2B1F930E4B660ADF71606D1B9634188B7160A704A8D140CADAFB46E1E56
2492droid4x.exeC:\Users\admin\AppData\Roaming\HaiYuInst\plugins\download\msvcp71.dllexecutable
MD5:A94DC60A90EFD7A35C36D971E3EE7470
SHA256:6C483CBE349863C7DCF6F8CB7334E7D28C299E7D5AA063297EA2F62352F6BDD9
2492droid4x.exeC:\Users\admin\AppData\Roaming\HaiYuInst\plugins\xldl.dllexecutable
MD5:EDB0B9ED05444D6C25A03C257936A8F6
SHA256:B73F9AB562E3CCBF5605F9017AC5D8C258DD839DCAA4F58547F742B43FB9D08C
2492droid4x.exeC:\Users\admin\AppData\Roaming\HaiYuInst\plugins\download\download_engine.dllexecutable
MD5:0D732EEA70FD5208A4454A8B0668C9BB
SHA256:440D13B2BD0988F6F6F0C4C7842ACC20A8ABF5B050D4024711AABAB29AA88E93
3176MiniThunderPlatform.exeC:\Users\Public\Thunder Network\Mini_downloadlib\ODAwMDA2MDA=\038Ucompressed
MD5:F96B8FE4DCFF1F91F2BAAC0B7EBA2D15
SHA256:5BA9C439600ECEAD4D137F9F8F9F0818DE311570B288E21217B79F6EB56F1994
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
10
DNS requests
28
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2492
droid4x.exe
GET
200
208.91.197.27:80
http://www.droid4x.com/dxadmin/operate.php?sys=Windows%207&type=0&sysver=6.1.7601&name=Installer&version=InstallerVersion&cpudes=&cpu=4&cpusn=1F8BFBFF000506E3&memory=3583&gpu=Standard%20VGA%20Graphics%20Adapter&gpudriver=vga.dll&vt=-1&sign=f17ef5d9fb63a1ff7c1cb9d4b51f9bc6&rand=23067&mac=12:A9:86:6C:77:DE&hdsn=4d51303030302031202020202020202020202020&guid=90059c37-1320-41a4-b58d-2b75a9850d2f&step=DownloaderStart&interval=0&channel=Z001&time=2020:11:19_22:03:20&baifenbi=0&did=1755834a047e1cb34b644ddc0f52390a
US
html
19.6 Kb
malicious
2492
droid4x.exe
POST
200
120.26.3.181:80
http://log.droid4x.cn/dxadmin/launchid.php
CN
text
32 b
unknown
3176
MiniThunderPlatform.exe
POST
200
47.92.39.6:80
http://47.92.39.6:80/
CN
binary
28 b
malicious
3176
MiniThunderPlatform.exe
POST
200
47.97.7.140:80
http://47.97.7.140:80/
CN
binary
8.40 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2492
droid4x.exe
120.26.3.181:80
log.droid4x.cn
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
2492
droid4x.exe
120.26.14.152:80
config.droid4x.cn
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3176
MiniThunderPlatform.exe
47.92.99.221:8000
hub5pnc.hz.sandai.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious
2492
droid4x.exe
208.91.197.27:80
www.droid4x.com
Confluence Networks Inc
US
malicious
3176
MiniThunderPlatform.exe
140.206.225.244:80
hub5c.hz.sandai.net
China Unicom Shanghai network
CN
malicious
—
—
39.98.57.143:8000
hub5u.hz.sandai.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3176
MiniThunderPlatform.exe
47.97.7.140:80
pmap.hz.sandai.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious
3176
MiniThunderPlatform.exe
47.92.39.6:80
hub5pr.hz.sandai.net
Hangzhou Alibaba Advertising Co.,Ltd.
CN
malicious
3176
MiniThunderPlatform.exe
140.206.225.232:80
hubstat.hz.sandai.net
China Unicom Shanghai network
CN
malicious

DNS requests

Domain
IP
Reputation
config.droid4x.cn
  • 120.26.14.152
unknown
log.droid4x.cn
  • 120.26.3.181
unknown
www.droid4x.com
  • 208.91.197.27
malicious
hub5pnc.hz.sandai.net
  • 47.92.99.221
  • 47.92.100.53
malicious
hub5pn.hz.sandai.net
  • 157.255.225.53
  • 211.91.242.37
  • 58.144.251.2
  • 118.212.146.21
  • 118.212.146.20
  • 111.206.4.176
  • 157.255.225.49
  • 153.3.232.174
  • 58.144.251.1
  • 153.3.232.175
  • 111.206.4.164
  • 211.91.242.38
unknown
hub5u.hz.sandai.net
  • 39.98.57.143
  • 39.100.9.39
  • 47.92.75.245
unknown
hub5c.hz.sandai.net
  • 140.206.225.244
  • 123.125.221.6
  • 123.125.221.72
  • 140.206.225.138
  • 140.206.225.169
  • 123.125.221.44
malicious
pmap.hz.sandai.net
  • 47.97.7.140
malicious
relay.phub.hz.sandai.net
  • —
whitelisted
hub5pr.hz.sandai.net
  • 47.92.39.6
  • 47.92.169.85
  • 47.92.194.216
  • 47.92.125.145
  • 47.92.171.207
  • 47.92.195.246
unknown

Threats

PID
Process
Class
Message
3176
MiniThunderPlatform.exe
Misc activity
ADWARE [PTsecurity] Win32.Downloader (Sogou/Chindo)
3176
MiniThunderPlatform.exe
Misc activity
ADWARE [PTsecurity] Win32.Downloader (Sogou/Chindo)
Process
Message
droid4x.exe
C:\Users\admin\AppData\Roaming\droid4xinstaller.log
droid4x.exe
droid4x.exe
C:\Program Files
droid4x.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
droid4x.exe