URL:

https://mobile.yangkeduo.com/goods.html?goods_id=477332952543&page_from=23&pxq_secret_key=A6SUG47PVMN6KT5OFUE7AVVAYUDSM2IDC7AHGJN4YSHOSDY5E2XQ&_oak_share_snapshot_num=3890&_oak_share_time=1683091947&_oak_share_detail_id=0&share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_id=c6e71b9c03f346ae9f7630ba9e37ae9c&refer_share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_channel=copy_link&refer_share_form=text

Full analysis: https://app.any.run/tasks/de2a8160-adac-489f-9aa4-37300ed51a16
Verdict: Malicious activity
Analysis date: May 15, 2023, 20:47:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

8A0846E891E72F63C3BBB96B1C9544BA

SHA1:

81F1C9569F263EDD2F81FCBFFCA24BD583DE9591

SHA256:

F61FFBB555BFD9BFA36F4397BC52D1E8C5695DD3D634A8FE821D7DF70D3E6CB6

SSDEEP:

6:2TwXnCWB84LUV5GpGz2Tyjwg+HKgGkscVtI095TmRIKNhT57PD8/5hT57PoVub1T:2MbLMYp9kwLblVt7bmRZNj7P4xj7POud

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3956)

    • Create files in a temporary directory

      • iexplore.exe (PID: 3956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1232"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3956 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3956"C:\Program Files\Internet Explorer\iexplore.exe" "https://mobile.yangkeduo.com/goods.html?goods_id=477332952543&page_from=23&pxq_secret_key=A6SUG47PVMN6KT5OFUE7AVVAYUDSM2IDC7AHGJN4YSHOSDY5E2XQ&_oak_share_snapshot_num=3890&_oak_share_time=1683091947&_oak_share_detail_id=0&share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_id=c6e71b9c03f346ae9f7630ba9e37ae9c&refer_share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_channel=copy_link&refer_share_form=text"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
25 632
Read events
25 388
Write events
244
Delete events
0

Modification events

(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
32
Text files
146
Unknown types
0

Dropped files

PID
Process
Filename
Type
3956iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86289DDB9DCDB7A9CB80977D1B95D288binary
MD5:AD0FAA3AB265E1AA4F7DF85CFF68AE18
SHA256:6B738224AA02F1BE6B6F9D1893C42AB969556C5FB52494FB6A12F98A8951CB46
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:0CA027021A416FE71250DA2301816AF5
SHA256:1E3215D7DF0619B107A4673711DA4AA275041FF3C6A58F187D7EF68EDE7D7985
3956iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\react_goods_648e50494444042aa5e8_1026[1].jstext
MD5:462D3DF884049681C23A56C3E8A91327
SHA256:B4D4EB1DF9A46B3806D02A1E028C09FD4A80E3699111E0008727AAAE42601278
1232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\goods[1].htmhtml
MD5:E38A03B26FD8F140935B573BF92ACD44
SHA256:D6F2CB5E094967843EB37501F4DED2300DCBDB13DBA10336A6121134D45CD34C
1232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\react_pdd_d9c01feaa07cb3e2b500[1].csstext
MD5:B3993D9B7718940D0BD936F8AC504EB4
SHA256:8C80732B2CA1A6127C59099F64B29F90AD98BC3AED2FD80D1FF660C4F10D7E34
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_4F2D396492FDF7E9BF6C49996B3C7D78binary
MD5:1FA72CC6E822E56A4BEEA75EEED13C71
SHA256:9A3519F818FAAD3F89AE4BCE7917EDE57469B8153BE14898743387DD337DA04B
1232iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\2RJMN5VQ.txttext
MD5:75757909CCD6D37C5F004256032448E8
SHA256:A9FCF84E6C2507702B36832593BFD99F6F274178B34DA99297E1B0449ECB0A83
1232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\vendor_833a4a333dd35c6ee206_1026[1].jstext
MD5:F90D45DFEB900341B4FE5DE5C24286AF
SHA256:34989509B00B099CD3D911D341B36C12DF6F187DC2ED609643A610A9D31BA48C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
59
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1232
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?38e2b677295c939d
US
compressed
4.70 Kb
whitelisted
1232
iexplore.exe
GET
200
163.181.56.159:80
http://crl.digicert.cn/DigiCertGlobalRootCA.crl
US
der
779 b
suspicious
3956
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
binary
1.47 Kb
whitelisted
1232
iexplore.exe
GET
200
163.181.56.157:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEAfLVxOynPZOD0AyaACXMtc%3D
US
der
471 b
whitelisted
1232
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?84a0a9bd4dd839dc
US
compressed
4.70 Kb
whitelisted
1232
iexplore.exe
GET
200
163.181.56.157:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEA%2B6Nv2hYP1nPOUA6FqooHE%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3400
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1232
iexplore.exe
119.28.207.245:443
—
Tencent Building, Kejizhongyi Avenue
HK
unknown
3956
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1232
iexplore.exe
43.152.28.37:443
static.pddpic.com
ACE
SG
unknown
1232
iexplore.exe
163.181.56.157:80
ocsp.digicert.cn
Zhejiang Taobao Network Co.,Ltd
DE
suspicious
3956
iexplore.exe
104.126.37.154:443
www.bing.com
Akamai International B.V.
DE
suspicious
1232
iexplore.exe
49.234.0.122:443
th.yangkeduo.com
Shenzhen Tencent Computer Systems Company Limited
CN
unknown
3956
iexplore.exe
119.28.207.245:443
—
Tencent Building, Kejizhongyi Avenue
HK
unknown
1232
iexplore.exe
125.77.181.194:443
funimg.pddpic.com
Fuzhou
CN
unknown
3956
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.cn
  • 163.181.56.157
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.154
  • 104.126.37.147
  • 104.126.37.162
  • 104.126.37.145
  • 104.126.37.163
  • 104.126.37.153
  • 104.126.37.155
  • 104.126.37.177
  • 104.126.37.160
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.digicert.cn
  • 163.181.56.159
suspicious
static.pddpic.com
  • 43.152.28.37
  • 43.152.29.20
  • 43.152.29.12
  • 43.152.29.14
  • 43.152.28.31
  • 43.152.29.13
  • 101.33.11.88
  • 43.152.28.36
  • 43.152.28.32
  • 43.152.29.19
  • 43.152.137.70
  • 43.152.28.33
  • 43.152.28.35
  • 43.152.29.17
  • 43.152.28.34
suspicious
th.yangkeduo.com
  • 49.234.0.122
  • 49.234.0.129
  • 49.234.0.131
  • 49.234.160.10
  • 49.234.160.120
  • 49.234.160.130
  • 49.234.160.140
  • 49.234.160.155
  • 49.234.160.164
  • 49.234.160.174
  • 111.231.185.10
  • 111.231.185.102
  • 111.231.185.110
  • 111.231.185.136
  • 111.231.185.151
  • 49.234.0.13
  • 49.234.0.120
  • 49.234.0.121
unknown
funimg.pddpic.com
  • 125.77.181.194
  • 125.77.181.193
suspicious
pmmtk-a.pinduoduo.com
  • 119.28.206.116
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mobile.yangkeduo.com/goods.html?goods_id=477332952543&page_from=23&pxq_secret_key=A6SUG47PVMN6KT5OFUE7AVVAYUDSM2IDC7AHGJN4YSHOSDY5E2XQ&_oak_share_snapshot_num=3890&_oak_share_time=1683091947&_oak_share_detail_id=0&share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_id=c6e71b9c03f346ae9f7630ba9e37ae9c&refer_share_uin=HKKRQGRKA7MSUIGCHHIBZWP24E_GEXDA&refer_share_channel=copy_link&refer_share_form=text