analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | file |
| Full analysis: | https://app.any.run/tasks/3406cef5-47ff-4c88-baac-bf2b25a6c976 |
| Verdict: | Malicious activity |
| Threats: | GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools |
| Analysis date: | December 06, 2022, 04:03:18 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, InnoSetup self-extracting archive |
| MD5: | DADD4D65ED7D4B4311CE5D798EBFAE8D |
| SHA1: | 8C933B3B8395700E44C593123F482D1164728F4B |
| SHA256: | FEC72113589FD7EF3DCAE1A2A7CA8FC45DCF9B517B46F3C5D8532EA92840D90E |
| SSDEEP: | 98304:S02RH4M0l9+N1WWyUQzAObNIcahp0FYGvg0:KRH4ploIzAObNU2H7 |
MALICIOUS
Drops the executable file immediately after the start
- file.exe (PID: 3804)
- is-9B0A5.tmp (PID: 556)
Application was dropped or rewritten from another process
- dRAoXen5Al.exe (PID: 2356)
G-cleaner network activity is detected
- PrintFolders.exe (PID: 3500)
SUSPICIOUS
Drops a file with too old compile date
- file.exe (PID: 3804)
- is-9B0A5.tmp (PID: 556)
Executable content was dropped or overwritten
- file.exe (PID: 3804)
- is-9B0A5.tmp (PID: 556)
Reads Microsoft Outlook installation path
- PrintFolders.exe (PID: 3500)
Creates a directory in Program Files
- is-9B0A5.tmp (PID: 556)
Reads the Windows owner or organization settings
- is-9B0A5.tmp (PID: 556)
Connects to the server without a host name
- PrintFolders.exe (PID: 3500)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 3072)
Uses TASKKILL.EXE to terminate process
- cmd.exe (PID: 3072)
Starts CMD.EXE for commands execution
- PrintFolders.exe (PID: 3500)
Reads the Internet Settings
- PrintFolders.exe (PID: 3500)
INFO
Reads the computer name
- is-9B0A5.tmp (PID: 556)
- PrintFolders.exe (PID: 3500)
Checks supported languages
- file.exe (PID: 3804)
- PrintFolders.exe (PID: 3500)
- is-9B0A5.tmp (PID: 556)
- dRAoXen5Al.exe (PID: 2356)
Creates a software uninstall entry
- is-9B0A5.tmp (PID: 556)
Creates a file in a temporary directory
- is-9B0A5.tmp (PID: 556)
- file.exe (PID: 3804)
Creates files in the program directory
- is-9B0A5.tmp (PID: 556)
Checks proxy server information
- PrintFolders.exe (PID: 3500)
Application was dropped or rewritten from another process
- is-9B0A5.tmp (PID: 556)
Loads dropped or rewritten executable
- is-9B0A5.tmp (PID: 556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (82.8) |
|---|---|---|
| .exe | | | Win32 Executable Delphi generic (10.7) |
| .exe | | | Win32 Executable (generic) (3.4) |
| .exe | | | Generic Win/DOS Executable (1.5) |
| .exe | | | DOS Executable Generic (1.5) |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 1992-Jun-19 22:22:17 |
| Detected languages: |
|
| Comments: | This installation was built with Inno Setup: http://www.innosetup.com |
| CompanyName: | - |
| FileDescription: | PrintFolders Setup |
| FileVersion: | - |
| InternalName: | - |
| OriginalFilename: | - |
| ProductName: | - |
| ProductVersion: | - |
DOS Header
| e_magic: | MZ |
|---|---|
| e_cblp: | 80 |
| e_cp: | 2 |
| e_crlc: | - |
| e_cparhdr: | 4 |
| e_minalloc: | 15 |
| e_maxalloc: | 65535 |
| e_ss: | - |
| e_sp: | 184 |
| e_csum: | - |
| e_ip: | - |
| e_cs: | - |
| e_ovno: | 26 |
| e_oemid: | - |
| e_oeminfo: | - |
| e_lfanew: | 256 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| NumberofSections: | 8 |
| TimeDateStamp: | 1992-Jun-19 22:22:17 |
| PointerToSymbolTable: | - |
| NumberOfSymbols: | - |
| SizeOfOptionalHeader: | 224 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
CODE | 4096 | 36352 | 36352 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.60044 |
DATA | 40960 | 584 | 1024 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.72043 |
BSS | 45056 | 3684 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.idata | 49152 | 2248 | 2560 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.2508 |
.tls | 53248 | 8 | 0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.rdata | 57344 | 24 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 0.199108 |
.reloc | 61440 | 2156 | 0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | |
.rsrc | 65536 | 54688 | 54784 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED | 5.75782 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.26485 | 5672 | Latin 1 / Western European | English - United States | RT_ICON |
2 | 5.20743 | 3752 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 5.46677 | 2216 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 5.74812 | 1736 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 5.56273 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 4.79202 | 16936 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 5.82124 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
8 | 5.89108 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
9 | 6.13941 | 2440 | Latin 1 / Western European | English - United States | RT_ICON |
10 | 6.51874 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
Imports
advapi32.dll |
advapi32.dll (#2) |
comctl32.dll |
kernel32.dll |
kernel32.dll (#2) |
oleaut32.dll |
user32.dll |
user32.dll (#2) |
Total processes
46
Monitored processes
7
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2384 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Integrity Level: MEDIUM Description: PrintFolders Setup Exit code: 3221226540 Version: Modules
| |||||||||||||||
| 3804 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | Explorer.EXE | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: PrintFolders Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 556 | "C:\Users\admin\AppData\Local\Temp\is-GPICH.tmp\is-9B0A5.tmp" /SL4 $30138 "C:\Users\admin\AppData\Local\Temp\file.exe" 3658055 96256 | C:\Users\admin\AppData\Local\Temp\is-GPICH.tmp\is-9B0A5.tmp | file.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.42.0.0 Modules
| |||||||||||||||
| 3500 | "C:\Program Files\PrintFolders\PrintFolders.exe" | C:\Program Files\PrintFolders\PrintFolders.exe | is-9B0A5.tmp | ||||||||||||
User: admin Company: Atr Software Integrity Level: HIGH Description: Data Recovery Exit code: 0 Version: 1.2.3.101 Modules
| |||||||||||||||
| 2356 | C:\Users\admin\AppData\Roaming\{e29ac6c0-7037-11de-816d-806e6f6e6963}\dRAoXen5Al.exe | — | PrintFolders.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3072 | "C:\Windows\System32\cmd.exe" /c taskkill /im "PrintFolders.exe" /f & erase "C:\Program Files\PrintFolders\PrintFolders.exe" & exit | C:\Windows\System32\cmd.exe | — | PrintFolders.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2308 | taskkill /im "PrintFolders.exe" /f | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 360
Read events
1 326
Write events
34
Delete events
0
Modification events
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_CURRENT_USER\Software\Auapoint Software\PrintFolders |
| Operation: | write | Name: | Language |
Value: eng | |||
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2483CD7A-78F2-476F-86FF-B2EA93461085}}_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 5.1.2-beta | |||
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2483CD7A-78F2-476F-86FF-B2EA93461085}}_is1 |
| Operation: | write | Name: | Inno Setup: App Path |
Value: C:\Program Files\PrintFolders | |||
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2483CD7A-78F2-476F-86FF-B2EA93461085}}_is1 |
| Operation: | write | Name: | InstallLocation |
Value: C:\Program Files\PrintFolders\ | |||
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2483CD7A-78F2-476F-86FF-B2EA93461085}}_is1 |
| Operation: | write | Name: | Inno Setup: Icon Group |
Value: PrintFolders | |||
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2483CD7A-78F2-476F-86FF-B2EA93461085}}_is1 |
| Operation: | write | Name: | Inno Setup: User |
Value: admin | |||
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2483CD7A-78F2-476F-86FF-B2EA93461085}}_is1 |
| Operation: | write | Name: | DisplayName |
Value: PrintFolders 3.101 | |||
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2483CD7A-78F2-476F-86FF-B2EA93461085}}_is1 |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\PrintFolders\PrintFolders.exe | |||
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2483CD7A-78F2-476F-86FF-B2EA93461085}}_is1 |
| Operation: | write | Name: | UninstallString |
Value: "C:\Program Files\PrintFolders\unins000.exe" | |||
| (PID) Process: | (556) is-9B0A5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2483CD7A-78F2-476F-86FF-B2EA93461085}}_is1 |
| Operation: | write | Name: | QuietUninstallString |
Value: "C:\Program Files\PrintFolders\unins000.exe" /SILENT | |||
Executable files
8
Suspicious files
4
Text files
5
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 556 | is-9B0A5.tmp | C:\Program Files\PrintFolders\is-AA722.tmp | — | |
MD5:— | SHA256:— | |||
| 556 | is-9B0A5.tmp | C:\Program Files\PrintFolders\PrintFolders.exe | — | |
MD5:— | SHA256:— | |||
| 3804 | file.exe | C:\Users\admin\AppData\Local\Temp\is-GPICH.tmp\is-9B0A5.tmp | executable | |
MD5:075F33DA1EE1E9C480243CAC029B3C3E | SHA256:CEC47D181CF1DAD856463FC237EAD179FFA5AB1F2AEEEC442A99EE83C7DB5CB2 | |||
| 556 | is-9B0A5.tmp | C:\Program Files\PrintFolders\unins000.exe | executable | |
MD5:4C797D442BE1F6264A8EF767DF41B85A | SHA256:415E5D17EB635B23DAC030BA6AD0363507C2C4CBA9F87A206E7B9C2A5C7716D4 | |||
| 3500 | PrintFolders.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\fuckingdllENCR[1].dll | binary | |
MD5:418619EA97671304AF80EC60F5A50B62 | SHA256:EB7ECE66C14849064F462DF4987D6D59073D812C44D81568429614581106E0F4 | |||
| 3500 | PrintFolders.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ping[1].htm | text | |
MD5:064DB2A4C3D31A4DC6AA2538F3FE7377 | SHA256:0A3EC2C4FC062D561F0DC989C6699E06FFF850BBDA7923F14F26135EF42107C0 | |||
| 556 | is-9B0A5.tmp | C:\Program Files\PrintFolders\unins000.dat | dat | |
MD5:ED59EF77757FE31F831BDA61498321C4 | SHA256:58C3EBD744D92979E778E632D11A66DAFCFC551038772C859B5F72382240D3C9 | |||
| 556 | is-9B0A5.tmp | C:\Users\admin\AppData\Local\Temp\is-V3UG4.tmp\_iscrypt.dll | executable | |
MD5:A69559718AB506675E907FE49DEB71E9 | SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC | |||
| 556 | is-9B0A5.tmp | C:\Program Files\PrintFolders\Guide.chm | chm | |
MD5:204A5BF160646F9A55ED70AB6E1A07A6 | SHA256:CACDD2C8BFA4BAE33A16A10ED609F4841AC5C4C2FE481ED0FD8CB04BC8016BBD | |||
| 556 | is-9B0A5.tmp | C:\Program Files\PrintFolders\License.txt | text | |
MD5:A5E8094B0CBADE929AEE07F5DA5E9429 | SHA256:F3AC2009C96EB3A42AFAEC7FA67D3A14E5E9E30819B543D572C9BEA790CFCAD1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
3
DNS requests
0
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3500 | PrintFolders.exe | GET | 200 | 107.182.129.235:80 | http://107.182.129.235/storage/ping.php | US | text | 17 b | malicious |
3500 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
3500 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
3500 | PrintFolders.exe | GET | 200 | 107.182.129.235:80 | http://107.182.129.235/storage/extension.php | US | binary | 92.0 Kb | malicious |
3500 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
3500 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
3500 | PrintFolders.exe | GET | 200 | 45.139.105.171:80 | http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte | BG | binary | 1 b | malicious |
3500 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
3500 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
3500 | PrintFolders.exe | GET | 200 | 171.22.30.106:80 | http://171.22.30.106/library.php | GB | binary | 1 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3500 | PrintFolders.exe | 45.139.105.171:80 | — | Xdeer Limited | BG | malicious |
3500 | PrintFolders.exe | 107.182.129.235:80 | — | Delis LLC | US | malicious |
3500 | PrintFolders.exe | 171.22.30.106:80 | — | Delis LLC | US | malicious |