File name: | you-get-0.4.985-win32.exe |
Full analysis: | https://app.any.run/tasks/14a49910-9394-4d2d-b951-95f59d6a35cd |
Verdict: | Malicious activity |
Analysis date: | October 05, 2022, 00:58:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows |
MD5: | 8FC83220258965FB31D3385B83A1AF43 |
SHA1: | A50409FAEB5B0DDD77935331FE832C2AD2335864 |
SHA256: | F2A72D3927A73081A8DF7C36424BE5183692198BE25B1547A8200AA36215DDBD |
SSDEEP: | 196608:afxY4Txyv5Oi2QG33kWOE30GX925D4gYQIp:WY485OilikWVEGX9gYQIp |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.1) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_CUI |
Compilation Date: | 1970-Jan-02 10:28:52 |
TLS Callbacks: | 2 callback(s) detected. |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 128 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 8 |
TimeDateStamp: | 1970-Jan-02 10:28:52 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 39332 | 39424 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.11465 |
.data | 45056 | 52 | 512 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.584487 |
.rdata | 49152 | 18624 | 18944 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.99351 |
.bss | 69632 | 50696 | 0 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.idata | 122880 | 2940 | 3072 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.0676 |
.CRT | 126976 | 52 | 512 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.271114 |
.tls | 131072 | 32 | 512 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.175526 |
.rsrc | 135168 | 73208 | 73216 | IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.56322 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
0 | 1.91924 | 20 | Latin 1 / Western European | UNKNOWN | RT_GROUP_ICON |
1 | 2.23123 | 16936 | Latin 1 / Western European | UNKNOWN | RT_ICON |
2 | 6.05629 | 2216 | Latin 1 / Western European | UNKNOWN | RT_ICON |
3 | 5.5741 | 1384 | Latin 1 / Western European | UNKNOWN | RT_ICON |
4 | 7.95079 | 37019 | Latin 1 / Western European | UNKNOWN | RT_ICON |
5 | 5.29119 | 9640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
6 | 5.43869 | 4264 | Latin 1 / Western European | UNKNOWN | RT_ICON |
7 | 5.89356 | 1128 | Latin 1 / Western European | UNKNOWN | RT_ICON |
101 | 2.71858 | 104 | Latin 1 / Western European | UNKNOWN | RT_GROUP_ICON |
KERNEL32.dll |
WS2_32.dll |
msvcrt.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3412 | "C:\Users\admin\AppData\Local\Temp\you-get-0.4.985-win32.exe" | C:\Users\admin\AppData\Local\Temp\you-get-0.4.985-win32.exe | Explorer.EXE | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1088 | "C:\Users\admin\AppData\Local\Temp\you-get-0.4.985-win32.exe" | C:\Users\admin\AppData\Local\Temp\you-get-0.4.985-win32.exe | — | you-get-0.4.985-win32.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\_lzma.cp35-win32.pyd | executable | |
MD5:0A4078331B78B23AE2A1138DFB2FD361 | SHA256:68DBEEDA117B23B4F7194D6C0E5E8A6945CF6CA508EA0BCD9C83DBB2B9E710ED | |||
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\_sqlite3.cp35-win32.pyd | executable | |
MD5:2F20F73DE7EED08F0C9A5FD947EA70CC | SHA256:5F916BA4EF381256B25858F2B0607151D949585FD6E5A702B0A40050206C64AA | |||
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\_ssl.cp35-win32.pyd | executable | |
MD5:A29BEDF3AD5050EBA39925A306174918 | SHA256:8837663E21A18BC57D71727C3957D2EDD985AEE895465817B6F6A17734A8C809 | |||
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\api-ms-win-core-file-l1-1-0.dll | executable | |
MD5:1D2190EF60277ACB4B88675E623D6D52 | SHA256:4FD4D4EF96BA008CBBA57ED3CC29518F45027823A772989F2A6302D11A0A02AE | |||
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\api-ms-win-core-console-l1-1-0.dll | executable | |
MD5:6691B174D5696A71D9BE7C698403C8D4 | SHA256:423A5B8CE109586F2C2EA222EDC1F13D085C7B97F81D3D77AF51B751DDB6D9DB | |||
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\_hashlib.cp35-win32.pyd | executable | |
MD5:3C41F5FDD84874BB85413F00E49B7D11 | SHA256:368758811830C1EBB6E15A6C229EAE00B4D44E5811DEB0189ABB94DB6D53F2DA | |||
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\_bz2.cp35-win32.pyd | executable | |
MD5:5B2F49A32DC84A2EE0B6217F4A3F9A5A | SHA256:F10CF1B2BA06D4D42D07AD01C33C224FEC41EB95D876E43FFC05904E2282C2C9 | |||
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\api-ms-win-core-debug-l1-1-0.dll | executable | |
MD5:8C0AA5C8BE5A4888663DC580C64461D9 | SHA256:2FD48E1BDFF9D69E6E80AD73867B43A200BB5CB6E6B63AD0010FF7FC6F151075 | |||
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\_socket.cp35-win32.pyd | executable | |
MD5:E8205D1F7D59A4D16E2402F9BBDB1C10 | SHA256:8A58A4876BE2DD7D72B60D7A8BD049E60AE664E78CE48E058B431DDA23391426 | |||
3412 | you-get-0.4.985-win32.exe | C:\Users\admin\AppData\Local\Temp\_MEI34122\_elementtree.cp35-win32.pyd | executable | |
MD5:BF836FB34FE4EE833B9E57E10EDC48A3 | SHA256:67E47B71F71EABD10C5B2B22BDEC4554536ABFB4701E1B62FD985757EE4FEF69 |