File name: | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade |
Full analysis: | https://app.any.run/tasks/72ea8b5b-89c5-44a2-a060-358ea8e1a9bc |
Verdict: | Malicious activity |
Analysis date: | August 25, 2019, 07:17:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, RAR self-extracting archive |
MD5: | F4CADEA41BD26E93839AC5AEE3AB6E60 |
SHA1: | 47BEED8F0B6C3625DB36991D25C6DE43CEE9D912 |
SHA256: | F8429BF8DBA7377BB68F43C664A8F83CC79C3D61BA6D684B8AD97CD7AD795ADE |
SSDEEP: | 12288:ZlqhyafwjN4uNLXP/eBtZZf5Ria3j/PSYNpl9g:Z4hyqEN4uNLf/wvT/aYrlW |
.exe | | | WinRAR Self Extracting archive (88.2) |
---|---|---|
.exe | | | UPX compressed Win32 Executable (4.6) |
.exe | | | Win32 EXE Yoda's Crypter (4.5) |
.dll | | | Win32 Dynamic Link Library (generic) (1.1) |
.exe | | | Win32 Executable (generic) (0.7) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2004:01:22 14:36:06+01:00 |
PEType: | PE32 |
LinkerVersion: | 5 |
CodeSize: | 45056 |
InitializedDataSize: | 8192 |
UninitializedDataSize: | 86016 |
EntryPoint: | 0x209f0 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 22-Jan-2004 13:36:06 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000200 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 22-Jan-2004 13:36:06 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x00015000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x00016000 | 0x0000B000 | 0x0000AC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.89784 |
.rsrc | 0x00021000 | 0x00002000 | 0x00001C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.73457 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 2 | 4 | Latin 1 / Western European | Chinese - PRC | UNKNOWN |
2 | 3.88998 | 1384 | Latin 1 / Western European | Russian - Russia | RT_ICON |
3 | 4.12176 | 744 | Latin 1 / Western European | Russian - Russia | RT_ICON |
4 | 4.68705 | 2216 | Latin 1 / Western European | Russian - Russia | RT_ICON |
7 | 6.79952 | 238 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
8 | 7.24166 | 348 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
9 | 6.97432 | 220 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
10 | 7.38201 | 424 | Latin 1 / Western European | Chinese - PRC | RT_STRING |
100 | 2.64576 | 62 | Latin 1 / Western European | Russian - Russia | RT_GROUP_ICON |
101 | 7.85425 | 2998 | Latin 1 / Western European | Russian - Russia | RT_BITMAP |
ADVAPI32.DLL |
COMCTL32.DLL |
COMDLG32.DLL |
GDI32.DLL |
KERNEL32.DLL |
OLE32.DLL |
SHELL32.DLL |
USER32.DLL |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2880 | "C:\Users\admin\AppData\Local\Temp\f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe" | C:\Users\admin\AppData\Local\Temp\f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
3364 | "C:\Users\admin\AppData\Local\Temp\f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe" | C:\Users\admin\AppData\Local\Temp\f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | explorer.exe | |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
3192 | "C:\CS-F21\CSF11.exe" | C:\CS-F21\CSF11.exe | — | explorer.exe |
User: admin Company: Icom Inc. Integrity Level: MEDIUM Description: IC-F11克隆软件 Version: 1, 1, 0, 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3364 | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | C:\CS-F21\CS-F11.GID | gid | |
MD5:3251EB97BC0E3B1C3D250593C81A17A6 | SHA256:6891C229B8F4E083B9A8A0BAB1C3904AD2EF3437D79696A0B750E3D044AFCD0A | |||
3364 | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | C:\CS-F21\CS-F11.cnt | text | |
MD5:BB8E3EB7CAFA5E8241D22746DED14F5C | SHA256:CDF8A4BB14711B3991937EE724BF52A9E275E93D6CDC91B8C3690113F79B78F6 | |||
3364 | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | C:\CS-F21\CS-F11.HLP | hlp | |
MD5:30AE94751C42749C86669A6499A0EFB9 | SHA256:350D513B74975150F40E713F1F5312B750073464518F157AF584D1EDF02B217D | |||
3364 | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | C:\Users\Administrator\NTUSER.DAT | hiv | |
MD5:482933ADE79838EF23CD2755ABFB9E60 | SHA256:C21EBB46AD756ED59A159A6D8EF3CCBC207813A749BBDF6F233B8EFBF8F885E0 | |||
3364 | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | C:\Users\Administrator\NTUSER.DAT.LOG1 | log | |
MD5:3C969189CC35EE6562F2059364456B08 | SHA256:2A2B15C1F37A7C12C6B1455DA26C0510E3F13D6D514D8E68867221EAFE163B4E | |||
3364 | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | C:\CS-F21\CSF11.rc | text | |
MD5:A8B99FAC03B4A4C6D0079D2FFED7C79F | SHA256:4662DBEA7637B3FBB2FDBACC5DF644507B14EA088D820189C99566F1E91A390E | |||
3364 | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat | hiv | |
MD5:72DC379539B04F0EA20DC4DE2E2FB2A3 | SHA256:2572F3A798860B48A39A94C1D30988F08149B9FFD2349CF3EF89A743AD88A8A9 | |||
3364 | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 | log | |
MD5:782A115A6114DC94D9B0CFEA7524FACB | SHA256:13F53880D6615C05F13B249A219D6A97025ED55DE36C42216E1564B9B522FD99 | |||
3364 | f8429bf8dba7377bb68f43c664a8f83cc79c3d61ba6d684b8ad97cd7ad795ade.exe | C:\CS-F21\CSF11.exe | executable | |
MD5:66F6717E78051FF7D4BDC9C71A9A7DD4 | SHA256:0E6D6BC67E11FC4143A6CB032F84C58D72BCA6FFC3CC30BFAFB722ACEBC766DA |