popup

Report - TreeSizePro9.4.1.2001x64.exe

Generic Malware Malicious Library UPX Malicious Packer WinRAR PE File PE64 OS Processor Check PE32 MZP Format DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2025.04.05 01:40 Machine s1_win7_x6401
Filename TreeSizePro9.4.1.2001x64.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score Not founds Behavior Score
7.6
ZERO API file : clean
VT API (file) 23 detected (AIDetectMalware, FilePatcher, grayware, confidence, HackTool, Patcher, AD potentially unsafe, Generic Patcher, Static AI, Suspicious SFX, ApplicUnwnt@#wqbw7r5i29dm, GamePatcher)
md5 b702c0528f4fef973f074fa05f3cc045
sha256 d1a7b13bc7f3c706c082bfe09c2541b41ffe7609bf345d8cb23abbf1b65696ed
ssdeep 786432:cO+bdHC5yyNQuT9Q5MglOKTVCX+0aPHBYxXPm1XMuT:iHcR9QSgO6VcB60/aXt
imphash 1d1d7b60e9c6080cc7df35cc28a027fd
impfuzzy 48:J9jOX8LKc1XFjsX1Pfc++6WQYgebtSXCBinUX:JdJLKc1XFgX1Pfc++VVnbtSXCBinE
  Network IP location

Signature (19cnts)

Level Description
warning File has been identified by 23 AntiVirus engines on VirusTotal as malicious
watch Deletes executed files from disk
watch Detects the presence of Wine emulator
watch Drops a binary and executes it
watch Installs itself for autorun at Windows startup
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice Foreign language identified in PE resource
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Uses Windows utilities for basic Windows functionality
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info This executable has a PDB path

Rules (17cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
watch Win32_WinRAR_SFX_Zero Win32 WinRAR SFX binaries (download)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE64 (no description) binaries (download)
info IsPE64 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (86cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://x1.i.lencr.org/
whois
US AKAMAI-AS 23.35.221.104 clean
https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0RkyFjWVAexg.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/litespeed/js/eb15604231440016eb09a9b16d9ec5d3.js?ver=ec5d3
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/favicon.ico
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/flowx.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/CMPost.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.googletagmanager.com/gtag/js?id=G-LY4YS7SDEK
whois
US GOOGLE 142.250.66.40 clean
https://www.cybermania.ws/wp-content/uploads/neweset.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0RkxhjWVAexg.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/uploads/AnyDesk_logo.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/Cinexplore.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/MapleCalculator.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo.woff
whois
US GOOGLE 142.250.198.99 clean
https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C600italic%2C700italic%2C800italic%2C400%2C300%2C600%2C700%2C800&ver=6.7.2&display=swap
whois
US GOOGLE 142.250.197.10 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdo.woff
whois
US GOOGLE 142.250.198.99 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDQ.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=7.3.0
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk0ZjWVAexg.woff
whois
US GOOGLE 142.250.198.99 clean
https://do0digwedphcm.cloudfront.net/?gidod=1154995
whois
Unknown 3.168.176.204 clean
https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVQ.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/TheSanDiegoUnion.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsiH0B4gaVQ.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/litespeed/css/e58aaa284dee0052ff68912e4d2a0706.css?ver=a0706
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdo.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/uploads/balancemedicationapk.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAexg.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/uploads/elevate.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/uploads/moonreader.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/litespeed/js/330d70a228e020df8165e8d7f3cb42a4.js?ver=b42a4
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.googleapis.com/css?family=Source+Sans+Pro%3A200%2C300%2C400%2C600%2C700%2C900%2C200italic%2C300italic%2C400italic%2C600italic%2C700italic%2C900italic&ver=6.7.2&display=swap
whois
US GOOGLE 142.250.197.10 clean
https://www.cybermania.ws/wp-content/uploads/INKredible.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/litespeed/css/e3477323a4a938133ff0ea5a2fac34b4.css?ver=c34b4
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/MediaMonkey.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/litespeed/js/11267acb0ad080f1c99702d805e8bc45.js?ver=8bc45
whois
US CLOUDFLARENET 172.67.158.91 clean
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
whois
US CLOUDFLARENET 104.16.80.73 clean
https://www.cybermania.ws/wp-content/uploads/weatherradar.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk5hkWVAexg.woff
whois
US GOOGLE 142.250.198.99 clean
https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVQ.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/litespeed/js/0adc36f7f390ea8bf0f1a3f94a676136.js?ver=76136
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdo.woff
whois
US GOOGLE 142.250.198.99 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdo.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/uploads/CyberMania.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/SleepMonitor.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/litespeed/js/ea150143be78b51321156096fafbddca.js?ver=bddca
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/litespeed/js/6985c202c57202ff1ef2b195d2905ab6.js?ver=05ab6
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgshZ1x4gaVQ.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/uploads/IntelDriver.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/themes/CyberMania/images/searchicon.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/Paypalbutton.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18I.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/uploads/btc.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/litespeed/css/e5149a9e47c503b6faee1eab0429bbbf.css?ver=9bbbf
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/CM-150x150.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-includes/js/jquery/jquery.min.js
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18I.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/uploads/PlantParent.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/sleepcycle.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/Repairit.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZklyds18I.woff
whois
US GOOGLE 142.250.198.99 clean
https://www.cybermania.ws/wp-content/uploads/sdmaid2.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/SleepasAndroid.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/themes/CyberMania/images/pt_standard.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://www.cybermania.ws/wp-content/uploads/acrphone.png
whois
US CLOUDFLARENET 172.67.158.91 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCds18I.woff
whois
US GOOGLE 142.250.198.99 clean
https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsg-1x4gaVQ.woff
whois
US GOOGLE 142.250.198.99 clean
https://fonts.gstatic.com/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZYokSds18I.woff
whois
US GOOGLE 142.250.198.99 clean
www.googletagmanager.com
whois
US GOOGLE 172.217.161.232 clean
zb.rafikfangas.com
whois
Unknown 23.109.121.122 clean
storage.ko-fi.com
whois
US CLOUDFLARENET 172.67.8.185 clean
do0digwedphcm.cloudfront.net
whois
Unknown 3.168.176.29 clean
fonts.googleapis.com
whois
US GOOGLE 172.217.25.170 clean
x1.i.lencr.org
whois
US Telenor Norge AS 23.52.33.11 clean
fonts.gstatic.com
whois
US GOOGLE 142.250.206.195 clean
static.cloudflareinsights.com
whois
US CLOUDFLARENET 104.16.79.73 clean
www.cybermania.ws
whois
US CLOUDFLARENET 104.21.74.121 clean
142.250.198.99
whois
US GOOGLE 142.250.198.99 clean
172.67.158.91
whois
US CLOUDFLARENET 172.67.158.91 clean
104.16.80.73
whois
US CLOUDFLARENET 104.16.80.73 clean
142.250.197.10
whois
US GOOGLE 142.250.197.10 clean
23.41.113.98
whois
US NTT DOCOMO, INC. 23.41.113.98 clean
23.109.121.58
whois
Unknown 23.109.121.58 clean
3.168.176.204
whois
Unknown 3.168.176.204 clean
104.22.15.202
whois
US CLOUDFLARENET 104.22.15.202 clean
142.250.66.40
whois
US GOOGLE 142.250.66.40 clean

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x140038000 GetLastError
 0x140038008 SetLastError
 0x140038010 FormatMessageW
 0x140038018 GetCurrentProcess
 0x140038020 DeviceIoControl
 0x140038028 SetFileTime
 0x140038030 CloseHandle
 0x140038038 CreateDirectoryW
 0x140038040 RemoveDirectoryW
 0x140038048 CreateFileW
 0x140038050 DeleteFileW
 0x140038058 CreateHardLinkW
 0x140038060 GetShortPathNameW
 0x140038068 GetLongPathNameW
 0x140038070 MoveFileW
 0x140038078 GetFileType
 0x140038080 GetStdHandle
 0x140038088 WriteFile
 0x140038090 ReadFile
 0x140038098 FlushFileBuffers
 0x1400380a0 SetEndOfFile
 0x1400380a8 SetFilePointer
 0x1400380b0 SetFileAttributesW
 0x1400380b8 GetFileAttributesW
 0x1400380c0 FindClose
 0x1400380c8 FindFirstFileW
 0x1400380d0 FindNextFileW
 0x1400380d8 GetVersionExW
 0x1400380e0 GetCurrentDirectoryW
 0x1400380e8 GetFullPathNameW
 0x1400380f0 FoldStringW
 0x1400380f8 GetModuleFileNameW
 0x140038100 GetModuleHandleW
 0x140038108 FindResourceW
 0x140038110 FreeLibrary
 0x140038118 GetProcAddress
 0x140038120 GetCurrentProcessId
 0x140038128 ExitProcess
 0x140038130 SetThreadExecutionState
 0x140038138 Sleep
 0x140038140 LoadLibraryW
 0x140038148 GetSystemDirectoryW
 0x140038150 CompareStringW
 0x140038158 AllocConsole
 0x140038160 FreeConsole
 0x140038168 AttachConsole
 0x140038170 WriteConsoleW
 0x140038178 GetProcessAffinityMask
 0x140038180 CreateThread
 0x140038188 SetThreadPriority
 0x140038190 InitializeCriticalSection
 0x140038198 EnterCriticalSection
 0x1400381a0 LeaveCriticalSection
 0x1400381a8 DeleteCriticalSection
 0x1400381b0 SetEvent
 0x1400381b8 ResetEvent
 0x1400381c0 ReleaseSemaphore
 0x1400381c8 WaitForSingleObject
 0x1400381d0 CreateEventW
 0x1400381d8 CreateSemaphoreW
 0x1400381e0 GetSystemTime
 0x1400381e8 SystemTimeToTzSpecificLocalTime
 0x1400381f0 TzSpecificLocalTimeToSystemTime
 0x1400381f8 SystemTimeToFileTime
 0x140038200 FileTimeToLocalFileTime
 0x140038208 LocalFileTimeToFileTime
 0x140038210 FileTimeToSystemTime
 0x140038218 GetCPInfo
 0x140038220 IsDBCSLeadByte
 0x140038228 MultiByteToWideChar
 0x140038230 WideCharToMultiByte
 0x140038238 GlobalAlloc
 0x140038240 LockResource
 0x140038248 GlobalLock
 0x140038250 GlobalUnlock
 0x140038258 GlobalFree
 0x140038260 LoadResource
 0x140038268 SizeofResource
 0x140038270 SetCurrentDirectoryW
 0x140038278 GetExitCodeProcess
 0x140038280 GetLocalTime
 0x140038288 GetTickCount
 0x140038290 MapViewOfFile
 0x140038298 UnmapViewOfFile
 0x1400382a0 CreateFileMappingW
 0x1400382a8 OpenFileMappingW
 0x1400382b0 GetCommandLineW
 0x1400382b8 SetEnvironmentVariableW
 0x1400382c0 ExpandEnvironmentStringsW
 0x1400382c8 GetTempPathW
 0x1400382d0 MoveFileExW
 0x1400382d8 GetLocaleInfoW
 0x1400382e0 GetTimeFormatW
 0x1400382e8 GetDateFormatW
 0x1400382f0 GetNumberFormatW
 0x1400382f8 SetFilePointerEx
 0x140038300 GetConsoleMode
 0x140038308 GetConsoleCP
 0x140038310 HeapSize
 0x140038318 SetStdHandle
 0x140038320 GetProcessHeap
 0x140038328 FreeEnvironmentStringsW
 0x140038330 RaiseException
 0x140038338 GetSystemInfo
 0x140038340 VirtualProtect
 0x140038348 VirtualQuery
 0x140038350 LoadLibraryExA
 0x140038358 RtlCaptureContext
 0x140038360 RtlLookupFunctionEntry
 0x140038368 RtlVirtualUnwind
 0x140038370 IsDebuggerPresent
 0x140038378 UnhandledExceptionFilter
 0x140038380 SetUnhandledExceptionFilter
 0x140038388 GetStartupInfoW
 0x140038390 IsProcessorFeaturePresent
 0x140038398 QueryPerformanceCounter
 0x1400383a0 GetCurrentThreadId
 0x1400383a8 GetSystemTimeAsFileTime
 0x1400383b0 InitializeSListHead
 0x1400383b8 RtlUnwindEx
 0x1400383c0 RtlPcToFileHeader
 0x1400383c8 EncodePointer
 0x1400383d0 InitializeCriticalSectionAndSpinCount
 0x1400383d8 TlsAlloc
 0x1400383e0 TlsGetValue
 0x1400383e8 TlsSetValue
 0x1400383f0 TlsFree
 0x1400383f8 LoadLibraryExW
 0x140038400 QueryPerformanceFrequency
 0x140038408 TerminateProcess
 0x140038410 GetModuleHandleExW
 0x140038418 GetModuleFileNameA
 0x140038420 GetACP
 0x140038428 HeapFree
 0x140038430 HeapAlloc
 0x140038438 HeapReAlloc
 0x140038440 GetStringTypeW
 0x140038448 LCMapStringW
 0x140038450 FindFirstFileExA
 0x140038458 FindNextFileA
 0x140038460 IsValidCodePage
 0x140038468 GetOEMCP
 0x140038470 GetCommandLineA
 0x140038478 GetEnvironmentStringsW
gdiplus.dll
 0x140038488 GdiplusStartup
 0x140038490 GdipCreateHBITMAPFromBitmap
 0x140038498 GdiplusShutdown
 0x1400384a0 GdipCreateBitmapFromStream
 0x1400384a8 GdipDisposeImage
 0x1400384b0 GdipCloneImage
 0x1400384b8 GdipFree
 0x1400384c0 GdipAlloc

EAT(Export Address Table) Library


Similarity measure (PE file only) - Checking for service failure