File name:

WiperSoft-installer.exe

Full analysis: https://app.any.run/tasks/6d2d2a0e-ba43-46c5-a8fb-4026aa12e8e0
Verdict: Malicious activity
Analysis date: August 05, 2021, 06:36:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

26B56223FC79AC551B88B47DC8116358

SHA1:

EED5A3C1EC2C0812D35BABCA0FBA7E9CA2E838FE

SHA256:

FD9DBB971A9995F6D146237933FBE27F18217D3CACBB6DA121DE4CC9590030BE

SSDEEP:

49152:OHqopJaqntqLJAdEgVs7C33mKWaJTxijVZM02AL2YdJq:aqVLWdE0aKnqZ7vqYdI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • WiperSoft-installer.exe (PID: 1540)

    • Uses Task Scheduler to autorun other applications

      • WiperSoft-installer.exe (PID: 1540)

    • Application was dropped or rewritten from another process

      • WiperSoft.exe (PID: 1004)
      • SearchFilterHost.exe (PID: 3788)
      • SearchProtocolHost.exe (PID: 1512)
      • DllHost.exe (PID: 2904)
      • DllHost.exe (PID: 3048)
      • DllHost.exe (PID: 2452)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 468)
      • WiperSoft.exe (PID: 1004)

    • Actions looks like stealing of personal data

      • WiperSoft.exe (PID: 1004)

    • Steals credentials from Web Browsers

      • WiperSoft.exe (PID: 1004)

  • SUSPICIOUS

    • Checks supported languages

      • WiperSoft-installer.exe (PID: 2180)
      • WiperSoft-installer.exe (PID: 1540)
      • WiperSoft.exe (PID: 1004)

    • Reads the computer name

      • WiperSoft-installer.exe (PID: 2180)
      • WiperSoft-installer.exe (PID: 1540)
      • WiperSoft.exe (PID: 1004)

    • Creates a directory in Program Files

      • WiperSoft-installer.exe (PID: 1540)

    • Application launched itself

      • WiperSoft-installer.exe (PID: 2180)

    • Creates files in the program directory

      • WiperSoft-installer.exe (PID: 1540)

    • Creates files in the Windows directory

      • WiperSoft-installer.exe (PID: 1540)

    • Creates a software uninstall entry

      • WiperSoft-installer.exe (PID: 1540)

    • Creates files in the user directory

      • WiperSoft-installer.exe (PID: 1540)
      • WiperSoft.exe (PID: 1004)

    • Drops a file that was compiled in debug mode

      • WiperSoft-installer.exe (PID: 1540)
      • WiperSoft.exe (PID: 1004)

    • Executable content was dropped or overwritten

      • WiperSoft-installer.exe (PID: 1540)
      • WiperSoft.exe (PID: 1004)

    • Reads the cookies of Mozilla Firefox

      • WiperSoft.exe (PID: 1004)

    • Reads the cookies of Google Chrome

      • WiperSoft.exe (PID: 1004)

    • Drops a file with too old compile date

      • WiperSoft.exe (PID: 1004)

  • INFO

    • Checks supported languages

      • DllHost.exe (PID: 2904)
      • DllHost.exe (PID: 3048)
      • SearchProtocolHost.exe (PID: 1512)
      • SearchFilterHost.exe (PID: 3788)
      • DllHost.exe (PID: 2452)
      • schtasks.exe (PID: 468)
      • schtasks.exe (PID: 3004)

    • Reads the computer name

      • DllHost.exe (PID: 2904)
      • DllHost.exe (PID: 3048)
      • SearchProtocolHost.exe (PID: 1512)
      • SearchFilterHost.exe (PID: 3788)
      • DllHost.exe (PID: 2452)
      • schtasks.exe (PID: 468)

    • Reads settings of System Certificates

      • WiperSoft-installer.exe (PID: 1540)
      • WiperSoft.exe (PID: 1004)

    • Dropped object may contain Bitcoin addresses

      • WiperSoft.exe (PID: 1004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

ProductVersion: 1.1.120.32
ProductName: WiperSoft
OriginalFileName: WiperSoft_installer.exe
LegalCopyright: Copyright (C) 2013-2020.
InternalName: WiperSoft_installer.exe
FileVersion: 1.1.120.32
Comments: Written by: Wiper Software, UAB
FileDescription: WiperSoft installer
CompanyName: Wiper Software, UAB
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.1.120.32
FileVersionNumber: 1.1.120.32
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x120ba5
UninitializedDataSize: -
InitializedDataSize: 1079296
CodeSize: 1444864
LinkerVersion: 14.16
PEType: PE32
TimeStamp: 2020:06:22 13:58:13+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 22-Jun-2020 11:58:13
Detected languages:
  • English - United States
TLS Callbacks: 1 callback(s) detected.
Debug artifacts:
  • d:\Projects\WiperInstaller\Release\Installer.pdb
CompanyName: Wiper Software, UAB
FileDescription: WiperSoft installer
Comments: Written by: Wiper Software, UAB
FileVersion: 1.1.120.32
InternalName: WiperSoft_installer.exe
LegalCopyright: Copyright (C) 2013-2020.
OriginalFilename: WiperSoft_installer.exe
ProductName: WiperSoft
ProductVersion: 1.1.120.32

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 22-Jun-2020 11:58:13
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00160B54
0x00160C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62166
.rdata
0x00162000
0x00055E2E
0x00056000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.69638
.data
0x001B8000
0x0000ABB8
0x00007000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.95305
.rsrc
0x001C3000
0x00095E68
0x00096000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.70994
.reloc
0x00259000
0x00010A80
0x00010C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.6374

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00773
1621
UNKNOWN
English - United States
RT_MANIFEST
2
7.97099
18086
UNKNOWN
English - United States
RT_ICON
3
3.54045
67624
UNKNOWN
English - United States
RT_ICON
4
3.73393
38056
UNKNOWN
English - United States
RT_ICON
5
4.43109
16936
UNKNOWN
English - United States
RT_ICON
6
4.62217
9640
UNKNOWN
English - United States
RT_ICON
7
5.35709
4264
UNKNOWN
English - United States
RT_ICON
8
5.61287
2440
UNKNOWN
English - United States
RT_ICON
9
6.22475
1128
UNKNOWN
English - United States
RT_ICON
10
7.94733
28383
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
CRYPT32.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
Secur32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start wipersoft-installer.exe no specs PSIProfileNotify no specs Profile Notification Host no specs wipersoft-installer.exe searchprotocolhost.exe no specs searchfilterhost.exe no specs Thumbnail Cache Class Factory for Out of Proc Server no specs schtasks.exe no specs schtasks.exe no specs wipersoft.exe

Process information

PID
CMD
Path
Indicators
Parent process
468"C:\windows\System32\schtasks.exe" /delete /tn "WiperSoft Startup" /fC:\windows\System32\schtasks.exe—WiperSoft-installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1004"C:\program files\WiperSoft\WiperSoft.exe" C:\program files\WiperSoft\WiperSoft.exe
WiperSoft-installer.exe
User:
admin
Company:
Wiper Software, UAB
Integrity Level:
HIGH
Description:
WiperSoft
Exit code:
0
Version:
1.1.1157.32
Modules
Images
c:\program files\wipersoft\wipersoft.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1512"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1540"C:\Users\admin\AppData\Local\Temp\WiperSoft-installer.exe" C:\Users\admin\AppData\Local\Temp\WiperSoft-installer.exe
WiperSoft-installer.exe
User:
admin
Company:
Wiper Software, UAB
Integrity Level:
HIGH
Description:
WiperSoft installer
Exit code:
1
Version:
1.1.120.32
Modules
Images
c:\users\admin\appdata\local\temp\wipersoft-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2180"C:\Users\admin\AppData\Local\Temp\WiperSoft-installer.exe" C:\Users\admin\AppData\Local\Temp\WiperSoft-installer.exe—Explorer.EXE
User:
admin
Company:
Wiper Software, UAB
Integrity Level:
MEDIUM
Description:
WiperSoft installer
Exit code:
4294967295
Version:
1.1.120.32
Modules
Images
c:\users\admin\appdata\local\temp\wipersoft-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2452C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2904C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}C:\Windows\system32\DllHost.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3004"C:\windows\System32\schtasks.exe" /create /tn "WiperSoft Startup" /sc ONLOGON /tr "\\"c:\program files\WiperSoft\WiperSoft.exe\" /guard" /ru USER-PC\admin /rl HIGHEST /fC:\windows\System32\schtasks.exe—WiperSoft-installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
2147500037
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3048C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}C:\Windows\system32\DllHost.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3788"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528 C:\Windows\system32\SearchFilterHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Filter Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\searchfilterhost.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
21 064
Read events
21 021
Write events
43
Delete events
0

Modification events

(PID) Process:(2180) WiperSoft-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2180) WiperSoft-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2180) WiperSoft-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2180) WiperSoft-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1540) WiperSoft-installer.exeKey:HKEY_CURRENT_USER\Software\WiperSoft\WiperSoft
Operation:writeName:lng
Value:
en
(PID) Process:(1540) WiperSoft-installer.exeKey:HKEY_CURRENT_USER\Software\WiperSoft\WiperSoft
Operation:writeName:featureset
Value:
enabletrial=1
(PID) Process:(1540) WiperSoft-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB1C8C91-4D8E-4C28-80E7-FD135FB90515}}_is1
Operation:writeName:DisplayIcon
Value:
c:\program files\WiperSoft\wipersoft-inst.exe,-128
(PID) Process:(1540) WiperSoft-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB1C8C91-4D8E-4C28-80E7-FD135FB90515}}_is1
Operation:writeName:DisplayName
Value:
WiperSoft 1.1.1157.32
(PID) Process:(1540) WiperSoft-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB1C8C91-4D8E-4C28-80E7-FD135FB90515}}_is1
Operation:writeName:DisplayVersion
Value:
1.1.1157.32
(PID) Process:(1540) WiperSoft-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB1C8C91-4D8E-4C28-80E7-FD135FB90515}}_is1
Operation:writeName:HelpLink
Value:
http://www.wipersoft.com/
Executable files
1 519
Suspicious files
5
Text files
5
Unknown types
11

Dropped files

PID
Process
Filename
Type
1540WiperSoft-installer.exeC:\program files\WiperSoft\install.dattext
MD5:—
SHA256:—
1540WiperSoft-installer.exeC:\users\admin\appdata\roaming\WiperSoft\signatures.dat.tmp —
MD5:—
SHA256:—
1540WiperSoft-installer.exeC:\Users\admin\AppData\Roaming\WiperSoft\signatures.dat —
MD5:—
SHA256:—
1540WiperSoft-installer.exeC:\users\admin\appdata\local\temp\WiperSoft_Installer.dattext
MD5:—
SHA256:—
1540WiperSoft-installer.exeC:\program files\WiperSoft\WiperSoft-inst.exe.tmpexecutable
MD5:—
SHA256:—
1540WiperSoft-installer.exeC:\program files\WiperSoft\WiperSoft.exe.tmpexecutable
MD5:—
SHA256:—
1540WiperSoft-installer.exeC:\users\admin\appdata\roaming\WiperSoft\wipersoft.eni.tmpbinary
MD5:—
SHA256:—
1540WiperSoft-installer.exeC:\Users\admin\AppData\Roaming\WiperSoft\wipersoft.enibinary
MD5:—
SHA256:—
1540WiperSoft-installer.exeC:\Program Files\WiperSoft\WiperSoft.exeexecutable
MD5:—
SHA256:—
1540WiperSoft-installer.exeC:\program files\WiperSoft\license_en.txt.tmptext
MD5:EAF50126B709747E4C3A664C4B51A216
SHA256:5FC8F4B2595FEA38D179C5889F2AAD4C2CD4BE8F4A72E47EF2B543E2BD0CC4C8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
93
DNS requests
38
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1540
WiperSoft-installer.exe
GET
302
83.169.5.121:80
http://wiper.wipersoft.com/download-app.php?app=32&transid=95a0e189858e592bd54090aa693ecd6e
DE
—
—
malicious
1540
WiperSoft-installer.exe
GET
200
83.169.5.121:80
http://wiper.wipersoft.com/downloadinst.php?transid=2767a27eab86c05d875b8ced327c230a
DE
executable
2.41 Mb
malicious
1540
WiperSoft-installer.exe
GET
200
83.169.5.121:80
http://wiper.wipersoft.com/wiper/versions/2020/1-1-1157/wiper1.1_1_1_11571.exe
DE
executable
4.10 Mb
malicious
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
—
—
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
—
—
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
—
—
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
—
—
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCFQbZZzLvpQv
US
der
1.74 Kb
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
—
—
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1540
WiperSoft-installer.exe
83.169.5.121:443
wiper.wipersoft.com
Host Europe GmbH
DE
malicious
1540
WiperSoft-installer.exe
83.169.5.121:80
wiper.wipersoft.com
Host Europe GmbH
DE
malicious
1004
WiperSoft.exe
83.169.5.121:443
wiper.wipersoft.com
Host Europe GmbH
DE
malicious
—
—
83.169.5.121:443
wiper.wipersoft.com
Host Europe GmbH
DE
malicious
—
—
92.51.164.125:443
wipersoft.com
Host Europe GmbH
DE
unknown
—
—
2.16.186.19:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
—
—
192.124.249.24:80
ocsp.godaddy.com
Sucuri
US
suspicious
—
—
142.250.185.74:443
fonts.googleapis.com
Google Inc.
US
whitelisted
—
—
104.20.60.238:443
cdn.paddle.com
Cloudflare Inc
US
shared
—
—
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
wiper.wipersoft.com
  • 83.169.5.121
malicious
wipersoft.com
  • 92.51.164.125
unknown
ctldl.windowsupdate.com
  • 2.16.186.19
  • 2.16.186.25
  • 2.16.186.11
  • 2.16.186.32
  • 2.16.186.41
  • 2.16.186.27
  • 2.16.186.26
  • 2.16.186.42
whitelisted
ocsp.godaddy.com
  • 192.124.249.24
  • 192.124.249.22
  • 192.124.249.23
  • 192.124.249.41
  • 192.124.249.36
whitelisted
www.wipersoft.com
  • 92.51.164.125
unknown
fonts.googleapis.com
  • 142.250.185.74
whitelisted
cdn.paddle.com
  • 104.20.60.238
  • 104.20.59.238
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.pki.goog
  • 142.250.74.195
whitelisted

Threats

PID
Process
Class
Message
1540
WiperSoft-installer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1540
WiperSoft-installer.exe
Misc activity
ET INFO EXE - Served Attached HTTP
1540
WiperSoft-installer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WiperSoft-installer.exe