File name: | fb07f875dc45e6045735513e75a83c50c78154851bd23a645d43ea853e6800ac.bin |
Full analysis: | https://app.any.run/tasks/915916e5-1b1a-4d64-9143-cbcc677ec6e0 |
Verdict: | Malicious activity |
Analysis date: | November 30, 2020, 00:40:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (DLL) (console) Intel 80386, for MS Windows |
MD5: | 706EA7F029E6BC4DBF845DB3366F9A0E |
SHA1: | 942443DFB8784066523DB761886115E08C99575F |
SHA256: | FB07F875DC45E6045735513E75A83C50C78154851BD23A645D43EA853E6800AC |
SSDEEP: | 12288:NWSikkQXsGOCAStP1W+TXPc9JXvaWv7j3:ESiL5Sp1W+TYfHj |
.exe | | | Win64 Executable (generic) (76.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (12.4) |
.exe | | | Generic Win/DOS Executable (5.5) |
.exe | | | DOS Executable Generic (5.5) |
Subsystem: | Windows command line |
---|---|
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x7d64 |
UninitializedDataSize: | - |
InitializedDataSize: | 377856 |
CodeSize: | 70656 |
LinkerVersion: | 14.16 |
PEType: | PE32 |
TimeStamp: | 2020:10:28 05:01:47+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_CUI |
Compilation Date: | 28-Oct-2020 04:01:47 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000108 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 28-Oct-2020 04:01:47 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00011267 | 0x00011400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.79095 |
.rdata | 0x00013000 | 0x00005C64 | 0x00005E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.92674 |
.data | 0x00019000 | 0x000011E8 | 0x00000800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.47133 |
.rsrc | 0x0001B000 | 0x00054250 | 0x00054400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.9687 |
.reloc | 0x00070000 | 0x00000E88 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.24538 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
2 | 4.91161 | 381 | UNKNOWN | English - United States | RT_MANIFEST |
101 | 7.97261 | 344110 | UNKNOWN | English - United States | RT_RCDATA |
KERNEL32.dll |
WININET.dll |
Title | Ordinal | Address |
---|---|---|
In | 1 | 0x000078F0 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
340 | "C:\Windows\System32\rundll32.exe" "C:\Users\admin\AppData\Local\Temp\fb07f875dc45e6045735513e75a83c50c78154851bd23a645d43ea853e6800ac.bin.exe", In | C:\Windows\System32\rundll32.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3340 | C:\Users\admin\AppData\Local\Temp/tmp_e473b4.exe | C:\Users\admin\AppData\Local\Temp\tmp_e473b4.exe | — | rundll32.exe |
User: admin Company: Twenty Squares Integrity Level: MEDIUM Description: Addictedsarah chaturbate iree token Exit code: 0 Version: 1.00 |
PID | Process | Filename | Type | |
---|---|---|---|---|
340 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\CabF158.tmp | — | |
MD5:— | SHA256:— | |||
340 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\TarF159.tmp | — | |
MD5:— | SHA256:— | |||
340 | rundll32.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\365594_video[1].mp4 | — | |
MD5:— | SHA256:— | |||
3340 | tmp_e473b4.exe | C:\Users\admin\AppData\Local\Temp\~DF02945A472EAA1D47.TMP | — | |
MD5:— | SHA256:— | |||
340 | rundll32.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_F680E7E82172E5401DB2C7AF3973CA64 | binary | |
MD5:EAC1070A1F4E62C5F8FBB7DA37C45B8D | SHA256:D4B9B60AEC375A136AE8C1A57A2A50C3A8C27FC06F93E662CA4D1BEF8FE435FD | |||
340 | rundll32.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_90FB200D05D74D07E890355DD37226A1 | binary | |
MD5:2616F375A8052B64EA1BBEDA2C4960FF | SHA256:A826F08176D5393DA188BF26E62CB08FEC64979C9DF8ACA7178E7B673E696C85 | |||
340 | rundll32.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\tayna_tung[1].htm | html | |
MD5:DA0CDDA6E103F1C50D368B757C636AB3 | SHA256:4FE91EB35AB829B8452956588092BFA1A33F0A346A1B92A054B04BCDB4A577B3 | |||
340 | rundll32.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB | binary | |
MD5:84607D2DBB2A0ACCB2BCF37D73CD4C2A | SHA256:5524E149E8F5114B94FD44AD0500F85C57A473ABCAF6287F73C30EE9E92FEE81 | |||
340 | rundll32.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_90FB200D05D74D07E890355DD37226A1 | der | |
MD5:9A3F360A7AC5CBBBD08F593B0F30B771 | SHA256:C1AB79DD5BB8D36B0E59807463EF7A002E4BF06AE528EAC0B701984FF1D65BDF | |||
340 | rundll32.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | binary | |
MD5:F7D2DB0C5560D659EBB7BB4BED9532C3 | SHA256:F55D3F72758C90F7FF7343A0336FE842F8CB6E0EDBE934022D0E6B918FB8494D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
340 | rundll32.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRyyuDOSqb8BtprWZSAvBT9kFoYdwQU%2BftQxItnu2dk%2FoMhpqnOP1WEk5kCEBl1KfDoE6Kd%2B9KkjaxXnpA%3D | US | der | 471 b | whitelisted |
340 | rundll32.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQCTi7COYph7T3X5jLalBFyW | US | der | 728 b | whitelisted |
340 | rundll32.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
340 | rundll32.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAjKSzrqHlGx8XC%2FpYpj8LQ%3D | US | der | 279 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
340 | rundll32.exe | 151.139.128.14:80 | ocsp.usertrust.com | Highwinds Network Group, Inc. | US | suspicious |
340 | rundll32.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
340 | rundll32.exe | 104.28.19.220:443 | pornthash.mobi | Cloudflare Inc | US | suspicious |
340 | rundll32.exe | 89.40.211.3:443 | ip115038968.ahcdn.com | Sc Rexnet Srl | RO | unknown |
340 | rundll32.exe | 104.28.18.220:443 | pornthash.mobi | Cloudflare Inc | US | unknown |
Domain | IP | Reputation |
---|---|---|
pornthash.mobi |
| suspicious |
ocsp.digicert.com |
| whitelisted |
mov.pornthash.mobi |
| suspicious |
ip115038968.ahcdn.com |
| unknown |
ocsp.usertrust.com |
| whitelisted |