I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made.

enter image description here

I believe that this program modifies some files and the registry, but I do not know which files and registry keys.

I checked registries in Google and couldn’t figure out what is exactly the threat of the program to the system? The question is about a kind of modification on the files . I haven’t noticed such kind of modification.

I spent many hours on debugging the program and tracing assembly code, but couldn’t find the damage file.

download the file from here

  • Hi and welcome to RE.SE. Please post the text from that window, instead of a screenshot. – 0xC0000022L Sep 1 at 10:19
  • sha256: 9dc7380aaef46e591a135c9b314cd6bb1c5b014e6b35f8ec187e090e2af66f33
  • md5: fd44253addf0260c33dfb504523a6ad6

When analyzing software suspected to have been designed for criminal purposes, uploading the file to VirusTotal seems to be a good first step. In this case, when this file is uploaded to VirusTotal and we click on the "Behavior" tab, there is a choice of reports from 4 different emulators/sanboxes to look over, all of which list file system interactions and registry interactions.

If you are interested in malware analysis, there are many resources available to help you get started. I have heard Practical Malware Analysis is quite good, but there are many others.

  • Could you please describe in detail the actions of this possible malware ? – shadow Aug 30 at 10:36
  • @shadow I’m afraid I do not have time to perform a full analysis on request – julian Aug 30 at 11:26
  • Thank you for your kindly support. Could you please perform a some ( not Full) analysis on request. because , I can't find any damage on user's files. – shadow Aug 31 at 0:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.