File name:

XSpammer - Linkvertise Downloader.zip

Full analysis: https://app.any.run/tasks/7b3234e4-417a-4154-8d90-2c5190b870e4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 16, 2022, 16:47:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

92D233B4BD9C907FB0B88D7658658088

SHA1:

40DFE1680AF4442B38F474EA7FC51F2EC8140006

SHA256:

FFB04D623F7D3B8EEE70D56F48FB1C73414B25EDECD7DA25A0322D4B95BDB1FA

SSDEEP:

49152:Mwt/MYULhNCLvKOFICf+kXf8L6iAvyUSOEq:lt/MvhN2vFx+0f82l5SZq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Application was dropped or rewritten from another process

      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • sbr.exe (PID: 2344)
      • instup.exe (PID: 3224)

    • Changes settings of System certificates

      • saBSI.exe (PID: 3572)

    • Loads dropped or rewritten executable

      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Changes the autorun value in the registry

      • instup.exe (PID: 3224)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 848)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Checks supported languages

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 848)
      • WinRAR.exe (PID: 3212)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 400)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • XSpammer - Linkvertise Downloader_as-fFs1.exe (PID: 3088)
      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)
      • sbr.exe (PID: 2344)

    • Reads the Windows organization settings

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Reads Windows owner or organization settings

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Creates files in the Windows directory

      • cookie_mmm_irs_ppi_005_888_a.exe (PID: 3496)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Creates files in the program directory

      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Adds / modifies Windows certificates

      • saBSI.exe (PID: 3572)

    • Reads CPU info

      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Reads Environment values

      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Creates or modifies windows services

      • instup.exe (PID: 2600)

    • Removes files from Windows directory

      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Starts Internet Explorer

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1228)

    • Starts itself from another location

      • instup.exe (PID: 2600)

    • Creates a directory in Program Files

      • instup.exe (PID: 3224)

  • INFO

    • Application was dropped or rewritten from another process

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 848)
      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Reads settings of System Certificates

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)
      • saBSI.exe (PID: 3572)
      • avast_free_antivirus_setup_online.exe (PID: 3988)
      • instup.exe (PID: 2600)
      • iexplore.exe (PID: 1228)
      • instup.exe (PID: 3224)

    • Loads dropped or rewritten executable

      • XSpammer - Linkvertise Downloader_as-fFs1.tmp (PID: 3656)

    • Checks Windows Trust Settings

      • saBSI.exe (PID: 3572)
      • iexplore.exe (PID: 1228)

    • Reads the hosts file

      • instup.exe (PID: 2600)
      • instup.exe (PID: 3224)

    • Changes internet zones settings

      • iexplore.exe (PID: 3568)

    • Checks supported languages

      • iexplore.exe (PID: 3568)
      • iexplore.exe (PID: 1228)

    • Reads the computer name

      • iexplore.exe (PID: 3568)
      • iexplore.exe (PID: 1228)

    • Application launched itself

      • iexplore.exe (PID: 3568)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3568)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: .. /
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2022:03:23 16:41:23
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
13
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe xspammer - linkvertise downloader_as-ffs1.exe xspammer - linkvertise downloader_as-ffs1.tmp no specs xspammer - linkvertise downloader_as-ffs1.exe xspammer - linkvertise downloader_as-ffs1.tmp cookie_mmm_irs_ppi_005_888_a.exe sabsi.exe avast_free_antivirus_setup_online.exe instup.exe iexplore.exe no specs iexplore.exe instup.exe sbr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
400"C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe
WinRAR.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Linkvertise GmbH & Co. KG
Exit code:
0
Version:
2.0.0.13
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3212.32858\xspammer - linkvertise downloader_as-ffs1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
848"C:\Users\admin\AppData\Local\Temp\is-82DLE.tmp\XSpammer - Linkvertise Downloader_as-fFs1.tmp" /SL5="$30170,1785071,899584,C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe" C:\Users\admin\AppData\Local\Temp\is-82DLE.tmp\XSpammer - Linkvertise Downloader_as-fFs1.tmp—XSpammer - Linkvertise Downloader_as-fFs1.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\is-82dle.tmp\xspammer - linkvertise downloader_as-ffs1.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1228"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3568 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2344"C:\Windows\Temp\asw.bd476eb43a08d577\New_16031778\sbr.exe" 3224 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"C:\Windows\Temp\asw.bd476eb43a08d577\New_16031778\sbr.exe—instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Shutdown blocker
Exit code:
0
Version:
22.3.7108.0
Modules
Images
c:\windows\temp\asw.bd476eb43a08d577\new_16031778\sbr.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
2600"C:\Windows\Temp\asw.bd476eb43a08d577\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.bd476eb43a08d577 /edition:1 /prod:ais /guid:ecb66c6d-032e-40f3-bad9-2e169c02bf3e /ga_clientid:7f5c81d6-32d3-4986-ae01-4810e64b4ab7 /silent /ws /psh:2bJ1khOMmNrPCmgf2Q5gVmYl3uEvqFEjGH2r86B04X7PLwnZBBBbMVJJ9WHMAbK9oTrn1anZ5VR3M /cookie:mmm_irs_ppi_005_888_a /ga_clientid:7f5c81d6-32d3-4986-ae01-4810e64b4ab7 /edat_dir:C:\Windows\Temp\asw.4bcaee902d086e96C:\Windows\Temp\asw.bd476eb43a08d577\instup.exe
avast_free_antivirus_setup_online.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
22.3.7108.0
Modules
Images
c:\windows\temp\asw.bd476eb43a08d577\instup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3088"C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe" /SPAWNWND=$2017A /NOTIFYWND=$30170 C:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exe
XSpammer - Linkvertise Downloader_as-fFs1.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Linkvertise GmbH & Co. KG
Exit code:
0
Version:
2.0.0.13
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3212.32858\xspammer - linkvertise downloader_as-ffs1.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
c:\windows\system32\lpk.dll
3212"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\XSpammer - Linkvertise Downloader.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
3224"C:\Windows\Temp\asw.bd476eb43a08d577\New_16031778\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.bd476eb43a08d577 /edition:1 /prod:ais /guid:ecb66c6d-032e-40f3-bad9-2e169c02bf3e /ga_clientid:7f5c81d6-32d3-4986-ae01-4810e64b4ab7 /silent /ws /psh:2bJ1khOMmNrPCmgf2Q5gVmYl3uEvqFEjGH2r86B04X7PLwnZBBBbMVJJ9WHMAbK9oTrn1anZ5VR3M /cookie:mmm_irs_ppi_005_888_a /edat_dir:C:\Windows\Temp\asw.4bcaee902d086e96 /online_installerC:\Windows\Temp\asw.bd476eb43a08d577\New_16031778\instup.exe
instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
22.3.7108.0
Modules
Images
c:\windows\temp\asw.bd476eb43a08d577\new_16031778\instup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3496"C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod0_extract\cookie_mmm_irs_ppi_005_888_a.exe" /silent /ws /psh:2bJ1khOMmNrPCmgf2Q5gVmYl3uEvqFEjGH2r86B04X7PLwnZBBBbMVJJ9WHMAbK9oTrn1anZ5VR3MC:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod0_extract\cookie_mmm_irs_ppi_005_888_a.exe
XSpammer - Linkvertise Downloader_as-fFs1.tmp
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
2.1.1286.0
Modules
Images
c:\users\admin\appdata\local\temp\is-a0re6.tmp\prod0_extract\cookie_mmm_irs_ppi_005_888_a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
3568"C:\Program Files\Internet Explorer\iexplore.exe" https://universalcheats.com/download/XSpammer_5E914.rarC:\Program Files\Internet Explorer\iexplore.exe—XSpammer - Linkvertise Downloader_as-fFs1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
Total events
28 169
Read events
26 549
Write events
1 615
Delete events
5

Modification events

(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3212) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\XSpammer - Linkvertise Downloader.zip
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3212) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
27
Suspicious files
36
Text files
48
Unknown types
1

Dropped files

PID
Process
Filename
Type
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\XSpammer - Linkvertise Downloader_as-fFs1.exeexecutable
MD5:—
SHA256:—
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_ca.battext
MD5:0D09B103BFDD942902418C76D12878DF
SHA256:5715E37891D2381B6DFC08EFC663417637F6A46E07AE9D0E310DE6B57B0E4E81
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_en.battext
MD5:BB4C5C5379610F8F99B400F67852F21B
SHA256:9F688A0B17E7A0CF48F23B5BAE9F71610E037CBD5CFE3E9C8A6AE7835C03F9A0
400XSpammer - Linkvertise Downloader_as-fFs1.exeC:\Users\admin\AppData\Local\Temp\is-82DLE.tmp\XSpammer - Linkvertise Downloader_as-fFs1.tmpexecutable
MD5:74FAD5C6CD2D3AF1FA257B5E9531993A
SHA256:8DC40627FA4C09F7FD6DF78E3AD03D7DB3767010E15418DBA24E63754DCBC59B
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_ru.battext
MD5:1363340D6BFB7BE813D7C1B02E4FBF65
SHA256:3408A768DE5FCA57E495CF7B31B1CEBAF1141AACD1439B217C14442BFB26511D
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_es.battext
MD5:BF13D224B72FDA6E81ECECE36F5700D4
SHA256:EFA3A7FD6626966A61E6FDD9D50FBC43A9C9F7842C149FC7D21681C9434CAE61
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_ko.battext
MD5:1363340D6BFB7BE813D7C1B02E4FBF65
SHA256:3408A768DE5FCA57E495CF7B31B1CEBAF1141AACD1439B217C14442BFB26511D
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_pt.battext
MD5:D354B2B7D5ECD8A7275CDD0B0A83697A
SHA256:359B5DCB2554CF2142218CA8AF29B74F7483ADE931E588985B5B540292A2F137
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_gb.battext
MD5:0F99A1400A1C269E7C5130E8092CA378
SHA256:E74D310DE606AAA382A81D428C7805C41C0D33013B1C2C071B2A6CD9424388E6
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3212.32858\run_it.battext
MD5:DEB79115D2848C37FE08E37711797775
SHA256:863961B7321822F488F4CB4D220DFA45115B72C041711518DD38039181F0D552
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
45
DNS requests
66
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3496
cookie_mmm_irs_ppi_005_888_a.exe
GET
200
23.48.23.6:80
http://iavs9x.u.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
US
executable
8.24 Mb
whitelisted
3496
cookie_mmm_irs_ppi_005_888_a.exe
POST
204
5.62.40.214:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://h4444966.iavs9x.u.avast.com/iavs9x/servers.def.vpx
unknown
binary
2.40 Kb
whitelisted
3496
cookie_mmm_irs_ppi_005_888_a.exe
POST
204
5.62.40.214:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://n4291289.iavs9x.u.avast.com/iavs9x/avbugreport_ais-9d1.vpx
unknown
binary
1.18 Mb
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://n4291289.iavs9x.u.avast.com/iavs9x/sbr_x86_ais-9d1.vpx
unknown
binary
8.87 Kb
whitelisted
3224
instup.exe
GET
200
95.100.146.56:80
http://g1928587.vps18tiny.u.avcdn.net/vps18tiny/part-jrog2-f6.vpx
unknown
binary
211 b
suspicious
2600
instup.exe
GET
200
95.100.146.51:80
http://n4291289.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
unknown
binary
572 b
whitelisted
2600
instup.exe
GET
200
95.100.146.51:80
http://n4291289.iavs9x.u.avast.com/iavs9x/offertool_ais-9d1.vpx
unknown
binary
350 Kb
whitelisted
3224
instup.exe
GET
200
95.100.146.56:80
http://g1928587.vps18tiny.u.avcdn.net/vps18tiny/jrog2-f6.vpx
unknown
binary
865 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3656
XSpammer - Linkvertise Downloader_as-fFs1.tmp
65.9.58.196:443
d17kz3i6hbr7d3.cloudfront.net
AT&T Services, Inc.
US
suspicious
3496
cookie_mmm_irs_ppi_005_888_a.exe
142.250.186.142:80
www.google-analytics.com
Google Inc.
US
whitelisted
3496
cookie_mmm_irs_ppi_005_888_a.exe
23.48.23.6:80
iavs9x.u.avast.com
TRUE INTERNET Co.,Ltd.
US
suspicious
3496
cookie_mmm_irs_ppi_005_888_a.exe
5.62.40.214:80
v7event.stats.avast.com
AVAST Software s.r.o.
DE
unknown
3572
saBSI.exe
54.68.68.7:443
apis.mosaic.analytics.awscommon.mcafee.com
Amazon.com, Inc.
US
unknown
3572
saBSI.exe
23.35.228.229:443
sadownload.mcafee.com
Zayo Bandwidth Inc
US
suspicious
3988
avast_free_antivirus_setup_online.exe
5.62.40.214:443
v7event.stats.avast.com
AVAST Software s.r.o.
DE
unknown
3572
saBSI.exe
104.208.16.0:443
cu1pehnswad01.servicebus.windows.net
Microsoft Corporation
US
unknown
3988
avast_free_antivirus_setup_online.exe
142.250.186.142:80
www.google-analytics.com
Google Inc.
US
whitelisted
2600
instup.exe
69.94.69.113:443
shepherd.ff.avast.com
OLM, LLC
US
suspicious

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • —
whitelisted
d17kz3i6hbr7d3.cloudfront.net
  • 65.9.58.196
  • 65.9.58.76
  • 65.9.58.186
  • 65.9.58.78
whitelisted
iavs9x.u.avast.com
  • 23.48.23.6
  • 23.48.23.20
whitelisted
www.google-analytics.com
  • 142.250.186.142
whitelisted
v7event.stats.avast.com
  • 5.62.40.214
  • 5.62.40.204
  • 5.62.53.222
  • 5.62.53.225
whitelisted
cu1pehnswad01.servicebus.windows.net
  • 104.208.16.0
whitelisted
apis.mosaic.analytics.awscommon.mcafee.com
  • 54.68.68.7
  • 52.32.96.104
unknown
sadownload.mcafee.com
  • 23.35.228.229
whitelisted
shepherd.ff.avast.com
  • 5.62.40.202
  • 69.94.69.113
whitelisted
b8003600.iavs9x.u.avast.com
  • 95.100.146.51
  • 95.100.146.41
whitelisted

Threats

PID
Process
Class
Message
3496
cookie_mmm_irs_ppi_005_888_a.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3572
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3572
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-A0RE6.tmp\prod1_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
XSpammer - Linkvertise Downloader.zip