URL:

https://mobile.yangkeduo.com/goods.html?goods_id=477332952543&page_from=23&pxq_secret_key=A6SUG47PVMN6KT5OFUE7AVVAYUDSM2IDC7AHGJN4YSHOSDY5E2XQ&_oak_share_snapshot_num=3890&_oak_share_time=1683091947&_oak_share_detail_id=0&share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_id=c6e71b9c03f346ae9f7630ba9e37ae9c&refer_share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_channel=copy_link&refer_share_form=text

Full analysis: https://app.any.run/tasks/de2a8160-adac-489f-9aa4-37300ed51a16
Verdict: Malicious activity
Analysis date: May 15, 2023, 20:47:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

8A0846E891E72F63C3BBB96B1C9544BA

SHA1:

81F1C9569F263EDD2F81FCBFFCA24BD583DE9591

SHA256:

F61FFBB555BFD9BFA36F4397BC52D1E8C5695DD3D634A8FE821D7DF70D3E6CB6

SSDEEP:

6:2TwXnCWB84LUV5GpGz2Tyjwg+HKgGkscVtI095TmRIKNhT57PD8/5hT57PoVub1T:2MbLMYp9kwLblVt7bmRZNj7P4xj7POud

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3956)

    • Create files in a temporary directory

      • iexplore.exe (PID: 3956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1232"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3956 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3956"C:\Program Files\Internet Explorer\iexplore.exe" "https://mobile.yangkeduo.com/goods.html?goods_id=477332952543&page_from=23&pxq_secret_key=A6SUG47PVMN6KT5OFUE7AVVAYUDSM2IDC7AHGJN4YSHOSDY5E2XQ&_oak_share_snapshot_num=3890&_oak_share_time=1683091947&_oak_share_detail_id=0&share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_id=c6e71b9c03f346ae9f7630ba9e37ae9c&refer_share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_channel=copy_link&refer_share_form=text"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
25 632
Read events
25 388
Write events
244
Delete events
0

Modification events

(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
32
Text files
146
Unknown types
0

Dropped files

PID
Process
Filename
Type
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
3956iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3956iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:A43633F93B887AA4A8AB678477495B8E
SHA256:F327754340AF7D119F234EBC9180EC5F06055B943D176CB6CFC2C32528294502
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:0CA027021A416FE71250DA2301816AF5
SHA256:1E3215D7DF0619B107A4673711DA4AA275041FF3C6A58F187D7EF68EDE7D7985
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86289DDB9DCDB7A9CB80977D1B95D288binary
MD5:AD0FAA3AB265E1AA4F7DF85CFF68AE18
SHA256:6B738224AA02F1BE6B6F9D1893C42AB969556C5FB52494FB6A12F98A8951CB46
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_4F2D396492FDF7E9BF6C49996B3C7D78binary
MD5:1FA72CC6E822E56A4BEEA75EEED13C71
SHA256:9A3519F818FAAD3F89AE4BCE7917EDE57469B8153BE14898743387DD337DA04B
3956iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:AA901B483396F21CCDFDA6C64681BFD2
SHA256:6E1C22EB8001585E8D0658ACC97A520429E64AFB2E4CC797F51813661959CE43
3956iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\vendor_833a4a333dd35c6ee206_1026[1].jstext
MD5:F90D45DFEB900341B4FE5DE5C24286AF
SHA256:34989509B00B099CD3D911D341B36C12DF6F187DC2ED609643A610A9D31BA48C
3956iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
59
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3956
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
binary
1.47 Kb
whitelisted
1232
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?38e2b677295c939d
US
compressed
4.70 Kb
whitelisted
1232
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?84a0a9bd4dd839dc
US
compressed
4.70 Kb
whitelisted
1232
iexplore.exe
GET
200
163.181.56.157:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEAfLVxOynPZOD0AyaACXMtc%3D
US
der
471 b
whitelisted
1232
iexplore.exe
GET
200
163.181.56.159:80
http://crl.digicert.cn/DigiCertGlobalRootCA.crl
US
der
779 b
suspicious
1232
iexplore.exe
GET
200
163.181.56.157:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEA%2B6Nv2hYP1nPOUA6FqooHE%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3400
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1232
iexplore.exe
119.28.207.245:443
—
Tencent Building, Kejizhongyi Avenue
HK
unknown
1232
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
1232
iexplore.exe
163.181.56.157:80
ocsp.digicert.cn
Zhejiang Taobao Network Co.,Ltd
DE
suspicious
3956
iexplore.exe
104.126.37.154:443
www.bing.com
Akamai International B.V.
DE
suspicious
3956
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1232
iexplore.exe
163.181.56.159:80
crl.digicert.cn
Zhejiang Taobao Network Co.,Ltd
DE
malicious

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.cn
  • 163.181.56.157
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.154
  • 104.126.37.147
  • 104.126.37.162
  • 104.126.37.145
  • 104.126.37.163
  • 104.126.37.153
  • 104.126.37.155
  • 104.126.37.177
  • 104.126.37.160
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.digicert.cn
  • 163.181.56.159
suspicious
static.pddpic.com
  • 43.152.28.37
  • 43.152.29.20
  • 43.152.29.12
  • 43.152.29.14
  • 43.152.28.31
  • 43.152.29.13
  • 101.33.11.88
  • 43.152.28.36
  • 43.152.28.32
  • 43.152.29.19
  • 43.152.137.70
  • 43.152.28.33
  • 43.152.28.35
  • 43.152.29.17
  • 43.152.28.34
suspicious
th.yangkeduo.com
  • 49.234.0.122
  • 49.234.0.129
  • 49.234.0.131
  • 49.234.160.10
  • 49.234.160.120
  • 49.234.160.130
  • 49.234.160.140
  • 49.234.160.155
  • 49.234.160.164
  • 49.234.160.174
  • 111.231.185.10
  • 111.231.185.102
  • 111.231.185.110
  • 111.231.185.136
  • 111.231.185.151
  • 49.234.0.13
  • 49.234.0.120
  • 49.234.0.121
unknown
funimg.pddpic.com
  • 125.77.181.194
  • 125.77.181.193
suspicious
pmmtk-a.pinduoduo.com
  • 119.28.206.116
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mobile.yangkeduo.com/goods.html?goods_id=477332952543&page_from=23&pxq_secret_key=A6SUG47PVMN6KT5OFUE7AVVAYUDSM2IDC7AHGJN4YSHOSDY5E2XQ&_oak_share_snapshot_num=3890&_oak_share_time=1683091947&_oak_share_detail_id=0&share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_id=c6e71b9c03f346ae9f7630ba9e37ae9c&refer_share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_channel=copy_link&refer_share_form=text