File name:

VictorKill.exe

Full analysis: https://app.any.run/tasks/45076da3-1850-4d62-a2bc-19f670be6a44
Verdict: Malicious activity
Analysis date: April 21, 2025, 02:50:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sfx
dropper
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 4 sections
MD5:

F70B7BE648112F6427156F72972DB9EC

SHA1:

6B37519A32115F1C78344A1BE36FDF6D9C11E0D6

SHA256:

F080DF95B2F046184FE6BCD96DE8B9CCE820ECD35E30F4F831551157E76FEA2A

SSDEEP:

786432:hgATYBuLDHIF9j3gXYPfYLjrw36F3mJ52gh+RmW:hVTYBuLEF953Yfrw36UJ52d8W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SFX dropper has been detected

      • VictorKill.exe (PID: 904)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • VictorKill.exe (PID: 904)

    • Application launched itself

      • VictorKill.exe (PID: 904)

    • Reads Internet Explorer settings

      • VictorKill.exe (PID: 904)

    • Reads security settings of Internet Explorer

      • VictorKill.exe (PID: 904)
      • VictorKill.exe (PID: 780)

    • Executable content was dropped or overwritten

      • VictorKill.exe (PID: 780)

    • Process drops legitimate windows executable

      • VictorKill.exe (PID: 780)

  • INFO

    • Reads the computer name

      • VictorKill.exe (PID: 904)
      • VictorKill.exe (PID: 780)
      • Victor.exe (PID: 1072)

    • Process checks computer location settings

      • VictorKill.exe (PID: 904)
      • VictorKill.exe (PID: 780)

    • Checks supported languages

      • VictorKill.exe (PID: 904)
      • VictorKill.exe (PID: 780)
      • Victor.exe (PID: 1072)

    • Checks proxy server information

      • VictorKill.exe (PID: 904)
      • slui.exe (PID: 6324)

    • The sample compiled with english language support

      • VictorKill.exe (PID: 780)

    • The sample compiled with german language support

      • VictorKill.exe (PID: 780)

    • Create files in a temporary directory

      • Victor.exe (PID: 1072)

    • Reads the software policy settings

      • slui.exe (PID: 6324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:01:20 18:59:36+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 169984
InitializedDataSize: 50176
UninitializedDataSize: -
EntryPoint: 0x1e64b
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DROPPER victorkill.exe no specs victorkill.exe victor.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
780"C:\Users\admin\AppData\Local\Temp\VictorKill.exe" -el -s2 "-dC:\" "-p" "-sp"C:\Users\admin\AppData\Local\Temp\VictorKill.exe
VictorKill.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\victorkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\version.dll
904"C:\Users\admin\AppData\Local\Temp\VictorKill.exe" C:\Users\admin\AppData\Local\Temp\VictorKill.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\victorkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\version.dll
1072"C:\victor\Victor.exe" C:\victor\Victor.exe—VictorKill.exe
User:
admin
Company:
BellCraft Technologies
Integrity Level:
HIGH
Exit code:
0
Version:
7.05
Modules
Images
c:\victor\victor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6324C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 606
Read events
1 600
Write events
4
Delete events
2

Modification events

(PID) Process:(904) VictorKill.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(904) VictorKill.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(904) VictorKill.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(904) VictorKill.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX
Operation:writeName:C%%
Value:
C:\
(PID) Process:(904) VictorKill.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(904) VictorKill.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
Executable files
13
Suspicious files
5
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
780VictorKill.exeC:\victor\party.wav —
MD5:—
SHA256:—
780VictorKill.exeC:\victor\QQPlayer.exe —
MD5:—
SHA256:—
780VictorKill.exeC:\victor\bg.battext
MD5:2630D89CD62645DA4077B5E5E04E7398
SHA256:44B8788F028868B20CDC420ECB2EDDE37AF3846C673FFDBE1CDAE488F991DED4
780VictorKill.exeC:\victor\clippy.exeexecutable
MD5:038BF1F54A35164FEDB79E2319E1BC49
SHA256:655A8C2BED8E2D85B24525AA426E5D647F15DDFA156967D64F144C497E8C9665
780VictorKill.exeC:\victor\end.battext
MD5:0A4E293729D9A24EE49576AA491E6507
SHA256:E14B6360B50182629DF70EDE4A933A691405D9BA5416F10F56F0622466673551
780VictorKill.exeC:\victor\Dog.mshini
MD5:30A41A1EC1FA4BC74A36C920E0FA495A
SHA256:28CB791F572937E8092D49180EAE7518100770C01435FB7092F067013286735A
780VictorKill.exeC:\victor\Dogpc.exeexecutable
MD5:32D084F636F3E6D8472A447965B7FF3D
SHA256:B8BC2A692C0188AB8C973D6752820A4A26BE5BFFC9C86EB2C84F238CE80856DF
780VictorKill.exeC:\victor\LimePro.exeexecutable
MD5:A6BA111C7EA638EDAC79CE34BB7A3DE3
SHA256:6C87657CFE2D7576333C2887D90F543C8FD4241E50F653B2C3A95EFFF2C4A268
780VictorKill.exeC:\victor\ReadMe SpongeBob.txttext
MD5:1B21017D69341C37A95C8525A459ECC6
SHA256:02F4CCF321CE16F2D554D9816C65287B9B5063CFB092C6EABF63C6B8DFC74BD1
780VictorKill.exeC:\victor\paint.battext
MD5:0BF8457A7BF267218C8CA2928A602648
SHA256:3DAC4564BB45BC592D146545DE3B44890261DA175E91CDB683B37BE3C57E4E58
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5400
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5400
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5400
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.128
  • 20.190.160.67
  • 20.190.160.66
  • 40.126.32.136
  • 20.190.160.5
  • 40.126.32.74
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VictorKill.exe