File name:

SecuriteInfo.com.FileRepMalware.639.15215

Full analysis: https://app.any.run/tasks/575aecfd-4859-45ba-9914-f60f227974dd
Verdict: Malicious activity
Analysis date: October 27, 2023, 06:21:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
sinkhole
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

668E6960BD1A9DF56FE81BB7E2CBE540

SHA1:

1B452D2F25A394CCAC86C37CBD1AFD2E6F0267F4

SHA256:

FD49D2F4AB29DCE03AA19B39EFC96C42BEBA15135CA4F5FAAF99D2BE2391D7BF

SSDEEP:

49152:rnSNWFWYvc12zBmwDV2bLnCNsa2DUPIUp20dxG0BN+fBgL7jtdlNIC2BEwtdItS2:vt0Q0c8nPa24PIGBLnTOBgRdEB/tGtS2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

  • SUSPICIOUS

    • Reads the Internet Settings

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Checks Windows Trust Settings

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Reads Microsoft Outlook installation path

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Reads settings of System Certificates

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Reads Internet Explorer settings

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

  • INFO

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Checks supported languages

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Reads the computer name

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Checks proxy server information

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Create files in a temporary directory

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)

    • Creates files or folders in the user directory

      • SecuriteInfo.com.FileRepMalware.639.15215.exe (PID: 308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:03:30 16:58:30+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 524288
InitializedDataSize: 991232
UninitializedDataSize: -
EntryPoint: 0x330000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.8.1.6
ProductVersionNumber: 1.8.1.6
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 1.8.1.6
FileDescription: 炫舞助手
ProductName: 炫舞助手
ProductVersion: 1.8.1.6
CompanyName: 炫舞助手
LegalCopyright: www.x5yd.com
Comments: 炫舞助手
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
31
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.filerepmalware.639.15215.exe

Process information

PID
CMD
Path
Indicators
Parent process
308"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.639.15215.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.639.15215.exe
explorer.exe
User:
admin
Company:
炫舞助手
Integrity Level:
MEDIUM
Description:
炫舞助手
Exit code:
0
Version:
1.8.1.6
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.filerepmalware.639.15215.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64.dll
c:\windows\syswow64\kernelbase.dll
Total events
1 302
Read events
1 260
Write events
34
Delete events
8

Modification events

(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(308) SecuriteInfo.com.FileRepMalware.639.15215.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E81D000000010000001000000073B6876195F5D18E048510422AEF04E314000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E090000000100000016000000301406082B0601050507030206082B060105050703010B000000010000001A0000004900530052004700200052006F006F007400200058003100000062000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C620000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
Executable files
0
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
308SecuriteInfo.com.FileRepMalware.639.15215.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\jy[1].htmhtml
MD5:DC6B56833D1C79E1CC76852E0396290D
SHA256:A1C749732CCA2D2C05E4CD092D7A3320C6D0F35B305DDE52A1ECD632A2759CD5
308SecuriteInfo.com.FileRepMalware.639.15215.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:692F251481332028237EEEB46373FB46
SHA256:8F24953E5C416EA9388DDC7E8721377F364BBB2F8EF07CCFC01BADBD214E824C
308SecuriteInfo.com.FileRepMalware.639.15215.exeC:\Users\admin\AppData\Local\Temp\CabB6D7.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
308SecuriteInfo.com.FileRepMalware.639.15215.exeC:\Users\admin\AppData\Local\Temp\TarB6E8.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
308SecuriteInfo.com.FileRepMalware.639.15215.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
11
DNS requests
3
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
308
SecuriteInfo.com.FileRepMalware.639.15215.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb79c703d5410771
unknown
compressed
61.6 Kb
unknown
308
SecuriteInfo.com.FileRepMalware.639.15215.exe
GET
301
206.237.198.82:80
http://www.x5yd.com/yd.txt
unknown
html
297 b
unknown
308
SecuriteInfo.com.FileRepMalware.639.15215.exe
GET
301
206.237.198.82:80
http://www.x5yd.com/jy.html
unknown
html
298 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
308
SecuriteInfo.com.FileRepMalware.639.15215.exe
206.237.198.82:80
www.x5yd.com
PEGTECHINC-AP-02
US
unknown
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
308
SecuriteInfo.com.FileRepMalware.639.15215.exe
206.237.198.82:443
www.x5yd.com
PEGTECHINC-AP-02
US
unknown
308
SecuriteInfo.com.FileRepMalware.639.15215.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted

DNS requests

Domain
IP
Reputation
www.x5yd.com
  • 206.237.198.82
unknown
www.x5yan.com
  • —
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted

Threats

PID
Process
Class
Message
308
SecuriteInfo.com.FileRepMalware.639.15215.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
2 ETPRO signatures available at the full report
Process
Message
SecuriteInfo.com.FileRepMalware.639.15215.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2010 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.FileRepMalware.639.15215