File name:

XSpammer - Linkvertise Downloader.zip

Full analysis: https://app.any.run/tasks/7b3234e4-417a-4154-8d90-2c5190b870e4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 16, 2022, 16:47:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

92D233B4BD9C907FB0B88D7658658088

SHA1:

40DFE1680AF4442B38F474EA7FC51F2EC8140006

SHA256:

FFB04D623F7D3B8EEE70D56F48FB1C73414B25EDECD7DA25A0322D4B95BDB1FA

SSDEEP:

49152:Mwt/MYULhNCLvKOFICf+kXf8L6iAvyUSOEq:lt/MvhN2vFx+0f82l5SZq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)
      • sbr.exe (PID: 2344)

    • Drops executable file immediately after starts

      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Changes settings of System certificates

      • saBSI.exe (PID: 3572)

    • Loads dropped or rewritten executable

      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Changes the autorun value in the registry

      • instup.exe (PID: 3224)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 848)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)
      • sbr.exe (PID: 2344)

    • Reads the computer name

      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 848)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Drops a file with a compile date too recent

      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Reads the Windows organization settings

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Reads Windows owner or organization settings

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Creates files in the Windows directory

      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Creates files in the program directory

      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Adds / modifies Windows certificates

      • saBSI.exe (PID: 3572)

    • Reads CPU info

      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Reads Environment values

      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Creates or modifies windows services

      • instup.exe (PID: 2600)

    • Starts Internet Explorer

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Removes files from Windows directory

      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1228)

    • Starts itself from another location

      • instup.exe (PID: 2600)

    • Creates a directory in Program Files

      • instup.exe (PID: 3224)

  • INFO

    • Application was dropped or rewritten from another process

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 848)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Reads settings of System Certificates

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • iexplore.exe (PID: 1228)
      • instup.exe (PID: 3224)

    • Loads dropped or rewritten executable

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Checks Windows Trust Settings

      • saBSI.exe (PID: 3572)
      • iexplore.exe (PID: 1228)

    • Reads the hosts file

      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Reads the computer name

      • iexplore.exe (PID: 3568)
      • iexplore.exe (PID: 1228)

    • Application launched itself

      • iexplore.exe (PID: 3568)

    • Checks supported languages

      • iexplore.exe (PID: 3568)
      • iexplore.exe (PID: 1228)

    • Changes internet zones settings

      • iexplore.exe (PID: 3568)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3568)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2022:03:23 16:41:23
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: .. /
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
13
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe xspammer - linkvertise downloader_as-ffs1.exe xspammer - linkvertise downloader_as-ffs1.tmp no specs xspammer - linkvertise downloader_as-ffs1.exe xspammer - linkvertise downloader_as-ffs1.tmp cookie_mmm_irs_ppi_005_888_a.exe sabsi.exe avast_free_antivirus_setup_online.exe instup.exe iexplore.exe no specs iexplore.exe instup.exe sbr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3212"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\XSpammer - Linkvertise Downloader.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
400"C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe
WinRAR.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Linkvertise GmbH & Co. KG
Exit code:
0
Version:
2.0.0.13
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3212.32858\xspammer - linkvertise downloader_as-ffs1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
848"C:\Users\admin\AppData\Local\Temp\is-82DLE.tmp\XSpammer - Linkvertise Downloader_as-fFs1.tmp" /SL5="$30170,1785071,899584,C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe" C:\Users\admin\AppData\Local\Temp\is-82DLE.tmp\XSpammer - Linkvertise Downloader_as-fFs1.tmp—XSpammer - Linkvertise Downloader_as-fFs1.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\is-82dle.tmp\xspammer - linkvertise downloader_as-ffs1.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3088"C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe" /SPAWNWND=$2017A /NOTIFYWND=$30170 C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe
XSpammer - Linkvertise Downloader_as-fFs1.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Linkvertise GmbH & Co. KG
Exit code:
0
Version:
2.0.0.13
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3212.32858\xspammer - linkvertise downloader_as-ffs1.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
c:\windows\system32\lpk.dll
3656"C:\Users\admin\AppData\Local\Temp\is-1UVJ9.tmp\XSpammer - Linkvertise Downloader_as-fFs1.tmp" /SL5="$30178,1785071,899584,C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe" /SPAWNWND=$2017A /NOTIFYWND=$30170 C:\Users\admin\AppData\Local\Temp\is-1UVJ9.tmp\XSpammer - Linkvertise Downloader_as-fFs1.tmp
XSpammer - Linkvertise Downloader_as-fFs1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-1uvj9.tmp\xspammer - linkvertise downloader_as-ffs1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3496"C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod0_extract\cookie_mmm_irs_ppi_005_888_a.exe" /silent /ws /psh:2bJ1khOMmNrPCmgf2Q5gVmYl3uEvqFEjGH2r86B04X7PLwnZBBBbMVJJ9WHMAbK9oTrn1anZ5VR3MC:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod0_extract\cookie_mmm_irs_ppi_005_888_a.exe
XSpammer - Linkvertise Downloader_as-fFs1.tmp
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Version:
2.1.1286.0
Modules
Images
c:\users\admin\appdata\local\temp\is-a0re6.tmp\prod0_extract\cookie_mmm_irs_ppi_005_888_a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
3572"C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\saBSI.exe" /affid 91082 PaidDistribution=true C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\saBSI.exe
XSpammer - Linkvertise Downloader_as-fFs1.tmp
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
4294967295
Version:
4,1,1,663
Modules
Images
c:\users\admin\appdata\local\temp\is-a0re6.tmp\prod1_extract\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3988"C:\Windows\Temp\asw.4bcaee902d086e96\avast_free_antivirus_setup_online.exe" /silent /ws /psh:2bJ1khOMmNrPCmgf2Q5gVmYl3uEvqFEjGH2r86B04X7PLwnZBBBbMVJJ9WHMAbK9oTrn1anZ5VR3M /cookie:mmm_irs_ppi_005_888_a /ga_clientid:7f5c81d6-32d3-4986-ae01-4810e64b4ab7 /edat_dir:C:\Windows\Temp\asw.4bcaee902d086e96C:\Windows\Temp\asw.4bcaee902d086e96\avast_free_antivirus_setup_online.exe
cookie_mmm_irs_ppi_005_888_a.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus
Version:
22.3.7108.0
Modules
Images
c:\windows\temp\asw.4bcaee902d086e96\avast_free_antivirus_setup_online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2600"C:\Windows\Temp\asw.bd476eb43a08d577\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.bd476eb43a08d577 /edition:1 /prod:ais /guid:ecb66c6d-032e-40f3-bad9-2e169c02bf3e /ga_clientid:7f5c81d6-32d3-4986-ae01-4810e64b4ab7 /silent /ws /psh:2bJ1khOMmNrPCmgf2Q5gVmYl3uEvqFEjGH2r86B04X7PLwnZBBBbMVJJ9WHMAbK9oTrn1anZ5VR3M /cookie:mmm_irs_ppi_005_888_a /ga_clientid:7f5c81d6-32d3-4986-ae01-4810e64b4ab7 /edat_dir:C:\Windows\Temp\asw.4bcaee902d086e96C:\Windows\Temp\asw.bd476eb43a08d577\instup.exe
avast_free_antivirus_setup_online.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Version:
22.3.7108.0
Modules
Images
c:\windows\temp\asw.bd476eb43a08d577\instup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3568"C:\Program Files\Internet Explorer\iexplore.exe" https://universalcheats.com/download/XSpammer_5E914.rarC:\Program Files\Internet Explorer\iexplore.exe—XSpammer - Linkvertise Downloader_as-fFs1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
Total events
28 169
Read events
26 549
Write events
1 615
Delete events
5

Modification events

(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3212) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\XSpammer - Linkvertise Downloader.zip
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
27
Suspicious files
36
Text files
48
Unknown types
1

Dropped files

PID
Process
Filename
Type
3656XSpammer - Linkvertise Downloader_as-fFs1.tmpC:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\is-TB31A.tmpimage
MD5:F4ECF398AC5FD32D7DBE994FA14EA9A4
SHA256:2DF3CAEC100CE3F7943AF62664897866F3A8E65083DDC7A0BCC3CEA5821FC553
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exeexecutable
MD5:65A60530601EEB2A7829B0CF9617F32E
SHA256:1AB394D8109246B5FE4593D3AC085922AA2A019A6EF080D1A945315822121A95
3656XSpammer - Linkvertise Downloader_as-fFs1.tmpC:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\WebAdvisor.pngimage
MD5:F4ECF398AC5FD32D7DBE994FA14EA9A4
SHA256:2DF3CAEC100CE3F7943AF62664897866F3A8E65083DDC7A0BCC3CEA5821FC553
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_ru.battext
MD5:1363340D6BFB7BE813D7C1B02E4FBF65
SHA256:3408A768DE5FCA57E495CF7B31B1CEBAF1141AACD1439B217C14442BFB26511D
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_es.battext
MD5:BF13D224B72FDA6E81ECECE36F5700D4
SHA256:EFA3A7FD6626966A61E6FDD9D50FBC43A9C9F7842C149FC7D21681C9434CAE61
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_it.battext
MD5:DEB79115D2848C37FE08E37711797775
SHA256:863961B7321822F488F4CB4D220DFA45115B72C041711518DD38039181F0D552
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_de.battext
MD5:2343C924740361598B5E719DA474F967
SHA256:7722E8138DFCF53CA24D4246AC8271E237AF186F4EC5848DF6E87D422F8279BC
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_gb.battext
MD5:0F99A1400A1C269E7C5130E8092CA378
SHA256:E74D310DE606AAA382A81D428C7805C41C0D33013B1C2C071B2A6CD9424388E6
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_en.battext
MD5:BB4C5C5379610F8F99B400F67852F21B
SHA256:9F688A0B17E7A0CF48F23B5BAE9F71610E037CBD5CFE3E9C8A6AE7835C03F9A0
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_ko.battext
MD5:1363340D6BFB7BE813D7C1B02E4FBF65
SHA256:3408A768DE5FCA57E495CF7B31B1CEBAF1141AACD1439B217C14442BFB26511D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
45
DNS requests
66
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3496
cookie_mmm_irs_ppi_005_888_a.exe
GET
200
23.48.23.6:80
http://iavs9x.u.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
US
executable
8.24 Mb
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://n4291289.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
unknown
binary
572 b
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://n4291289.iavs9x.u.avast.com/iavs9x/avbugreport_ais-9d1.vpx
unknown
binary
1.18 Mb
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://h4444966.iavs9x.u.avast.com/iavs9x/servers.def.vpx
unknown
binary
2.40 Kb
whitelisted
3496
cookie_mmm_irs_ppi_005_888_a.exe
POST
204
5.62.40.214:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://n4291289.iavs9x.u.avast.com/iavs9x/sbr_x86_ais-9d1.vpx
unknown
binary
8.87 Kb
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://n4291289.iavs9x.u.avast.com/iavs9x/avdump_x86_ais-9d1.vpx
unknown
binary
322 Kb
whitelisted
3496
cookie_mmm_irs_ppi_005_888_a.exe
POST
204
5.62.40.214:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://n4291289.iavs9x.u.avast.com/iavs9x/offertool_ais-9d1.vpx
unknown
binary
350 Kb
whitelisted
3224
instup.exe
GET
200
95.100.146.56:80
http://g1928587.vps18tiny.u.avcdn.net/vps18tiny/part-jrog2-f6.vpx
unknown
binary
211 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3656
XSpammer - Linkvertise Downloader_as-fFs1.tmp
65.9.58.196:443
d17kz3i6hbr7d3.cloudfront.net
AT&T Services, Inc.
US
suspicious
3572
saBSI.exe
54.68.68.7:443
apis.mosaic.analytics.awscommon.mcafee.com
Amazon.com, Inc.
US
unknown
3988
avast_free_antivirus_setup_online.exe
5.62.40.214:443
v7event.stats.avast.com
AVAST Software s.r.o.
DE
unknown
3496
cookie_mmm_irs_ppi_005_888_a.exe
5.62.40.214:80
v7event.stats.avast.com
AVAST Software s.r.o.
DE
unknown
3988
avast_free_antivirus_setup_online.exe
142.250.186.142:80
www.google-analytics.com
Google Inc.
US
whitelisted
3572
saBSI.exe
23.35.228.229:443
sadownload.mcafee.com
Zayo Bandwidth Inc
US
suspicious
2600
instup.exe
69.94.69.113:443
shepherd.ff.avast.com
OLM, LLC
US
suspicious
3496
cookie_mmm_irs_ppi_005_888_a.exe
142.250.186.142:80
www.google-analytics.com
Google Inc.
US
whitelisted
3496
cookie_mmm_irs_ppi_005_888_a.exe
23.48.23.6:80
iavs9x.u.avast.com
TRUE INTERNET Co.,Ltd.
US
suspicious
3572
saBSI.exe
104.208.16.0:443
cu1pehnswad01.servicebus.windows.net
Microsoft Corporation
US
unknown

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • —
whitelisted
d17kz3i6hbr7d3.cloudfront.net
  • 65.9.58.196
  • 65.9.58.76
  • 65.9.58.186
  • 65.9.58.78
whitelisted
iavs9x.u.avast.com
  • 23.48.23.6
  • 23.48.23.20
whitelisted
www.google-analytics.com
  • 142.250.186.142
whitelisted
v7event.stats.avast.com
  • 5.62.40.214
  • 5.62.40.204
  • 5.62.53.222
  • 5.62.53.225
whitelisted
cu1pehnswad01.servicebus.windows.net
  • 104.208.16.0
whitelisted
apis.mosaic.analytics.awscommon.mcafee.com
  • 54.68.68.7
  • 52.32.96.104
unknown
sadownload.mcafee.com
  • 23.35.228.229
whitelisted
shepherd.ff.avast.com
  • 5.62.40.202
  • 69.94.69.113
whitelisted
b8003600.iavs9x.u.avast.com
  • 95.100.146.51
  • 95.100.146.41
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
XSpammer - Linkvertise Downloader.zip