download: | FileZilla_Server-0_9_60_2.exe |
Full analysis: | https://app.any.run/tasks/cf971f04-3b2b-453a-b260-cc26d91378d6 |
Verdict: | Malicious activity |
Analysis date: | June 18, 2019, 22:56:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | CAF318640FE25E065F67ACFDB232F65F |
SHA1: | 3CE9024B1FDA79637B76814C0D23B3F0FD1AC36D |
SHA256: | 036322D9C9AD01047171B8D13EA2CFC65B1D882E122E2F4D11A9B3FB32E9C932 |
SSDEEP: | 49152:YicImiNOZP5uPr1CRRpR2GG8LTjbei5sJmTHROdiq2V:v8ii5aoDSGG8LjesHAdi5V |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
ProductVersion: | beta 0.9.60 |
---|---|
ProductName: | FileZilla Server |
OriginalFileName: | FileZilla_Server-0_9_60.exe |
LegalCopyright: | FileZilla Project |
FileVersion: | beta 0.9.60 |
FileDescription: | FileZilla Server |
CompanyName: | FileZilla Project |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0000 |
ProductVersionNumber: | 0.9.60.0 |
FileVersionNumber: | 0.9.60.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | 6 |
OSVersion: | 4 |
EntryPoint: | 0x33b6 |
UninitializedDataSize: | 2048 |
InitializedDataSize: | 141824 |
CodeSize: | 25088 |
LinkerVersion: | 6 |
PEType: | PE32 |
TimeStamp: | 2016:07:25 02:55:51+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 25-Jul-2016 00:55:51 |
Detected languages: |
|
CompanyName: | FileZilla Project |
FileDescription: | FileZilla Server |
FileVersion: | beta 0.9.60 |
LegalCopyright: | FileZilla Project |
OriginalFilename: | FileZilla_Server-0_9_60.exe |
ProductName: | FileZilla Server |
ProductVersion: | beta 0.9.60 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000C8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 25-Jul-2016 00:55:51 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0000615D | 0x00006200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.45023 |
.rdata | 0x00008000 | 0x000013A4 | 0x00001400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.163 |
.data | 0x0000A000 | 0x00020338 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.9824 |
.ndata | 0x0002B000 | 0x00014000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x0003F000 | 0x00002AF8 | 0x00002C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.07112 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.28717 | 1069 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 4.95598 | 1384 | UNKNOWN | English - United States | RT_ICON |
3 | 4.01369 | 744 | UNKNOWN | English - United States | RT_ICON |
4 | 3.29556 | 296 | UNKNOWN | English - United States | RT_ICON |
102 | 2.71813 | 180 | UNKNOWN | English - United States | RT_DIALOG |
103 | 2.21733 | 62 | UNKNOWN | English - United States | RT_GROUP_ICON |
104 | 2.70411 | 344 | UNKNOWN | English - United States | RT_DIALOG |
105 | 2.73893 | 514 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.91148 | 248 | UNKNOWN | English - United States | RT_DIALOG |
107 | 2.52183 | 160 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3448 | "C:\Users\admin\AppData\Local\Temp\FileZilla_Server-0_9_60_2.exe" | C:\Users\admin\AppData\Local\Temp\FileZilla_Server-0_9_60_2.exe | — | explorer.exe |
User: admin Company: FileZilla Project Integrity Level: MEDIUM Description: FileZilla Server Exit code: 3221226540 Version: beta 0.9.60 | ||||
2752 | "C:\Users\admin\AppData\Local\Temp\FileZilla_Server-0_9_60_2.exe" | C:\Users\admin\AppData\Local\Temp\FileZilla_Server-0_9_60_2.exe | explorer.exe | |
User: admin Company: FileZilla Project Integrity Level: HIGH Description: FileZilla Server Exit code: 0 Version: beta 0.9.60 | ||||
3232 | "C:\Program Files\FileZilla Server\FileZilla Server.exe" /stop | C:\Program Files\FileZilla Server\FileZilla Server.exe | — | FileZilla_Server-0_9_60_2.exe |
User: admin Company: FileZilla Project Integrity Level: HIGH Description: FileZilla Server Exit code: 0 Version: 0, 9, 60, 0 | ||||
3896 | "C:\Program Files\FileZilla Server\FileZilla Server.exe" /compat /stop | C:\Program Files\FileZilla Server\FileZilla Server.exe | — | FileZilla_Server-0_9_60_2.exe |
User: admin Company: FileZilla Project Integrity Level: HIGH Description: FileZilla Server Exit code: 0 Version: 0, 9, 60, 0 | ||||
2076 | "C:\Program Files\FileZilla Server\FileZilla Server.exe" /uninstall | C:\Program Files\FileZilla Server\FileZilla Server.exe | — | FileZilla_Server-0_9_60_2.exe |
User: admin Company: FileZilla Project Integrity Level: HIGH Description: FileZilla Server Exit code: 0 Version: 0, 9, 60, 0 | ||||
3944 | "C:\Program Files\FileZilla Server\FileZilla Server.exe" /adminport 14147 | C:\Program Files\FileZilla Server\FileZilla Server.exe | — | FileZilla_Server-0_9_60_2.exe |
User: admin Company: FileZilla Project Integrity Level: HIGH Description: FileZilla Server Exit code: 0 Version: 0, 9, 60, 0 | ||||
3136 | "C:\Program Files\FileZilla Server\FileZilla Server Interface.exe" /adminport 1 | C:\Program Files\FileZilla Server\FileZilla Server Interface.exe | — | FileZilla_Server-0_9_60_2.exe |
User: admin Company: FileZilla Project Integrity Level: HIGH Description: FileZilla Server Exit code: 0 Version: 0, 9, 59, 0 | ||||
3536 | "C:\Program Files\FileZilla Server\FileZilla Server.exe" /install auto | C:\Program Files\FileZilla Server\FileZilla Server.exe | — | FileZilla_Server-0_9_60_2.exe |
User: admin Company: FileZilla Project Integrity Level: HIGH Description: FileZilla Server Exit code: 0 Version: 0, 9, 60, 0 | ||||
2300 | "C:\Program Files\FileZilla Server\FileZilla Server.exe" /start | C:\Program Files\FileZilla Server\FileZilla Server.exe | — | FileZilla_Server-0_9_60_2.exe |
User: admin Company: FileZilla Project Integrity Level: HIGH Description: FileZilla Server Exit code: 0 Version: 0, 9, 60, 0 | ||||
1792 | "C:\Program Files\FileZilla Server\FileZilla Server Interface.exe" | C:\Program Files\FileZilla Server\FileZilla Server Interface.exe | — | FileZilla_Server-0_9_60_2.exe |
User: admin Company: FileZilla Project Integrity Level: HIGH Description: FileZilla Server Exit code: 0 Version: 0, 9, 59, 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2752 | FileZilla_Server-0_9_60_2.exe | C:\Users\admin\AppData\Local\Temp\nslF5C8.tmp | — | |
MD5:— | SHA256:— | |||
2752 | FileZilla_Server-0_9_60_2.exe | C:\Users\admin\AppData\Local\Temp\nsaF5D8.tmp\InterfaceOptions.ini | text | |
MD5:4161D6AD6F15171FBF2B03F4DF70F3DF | SHA256:6095BDC561225625FFAA2D0DFB1C7A1AD6FCCDB62F09CED0ED6AF112004739DF | |||
2752 | FileZilla_Server-0_9_60_2.exe | C:\Users\admin\AppData\Local\Temp\nsaF5D8.tmp\StartupOptions.ini | text | |
MD5:567C9DBBF342C8C39F04A4D03521B2FF | SHA256:307301F9560EA8AAE2637D30FD01325408D8434CFFCE4CA4AD5DF98AC40CFD15 | |||
2752 | FileZilla_Server-0_9_60_2.exe | C:\Users\admin\AppData\Local\Temp\nsaF5D8.tmp\InstallOptions.dll | executable | |
MD5:5B3EDB39FE9C026322CAF37EA10F6733 | SHA256:A96B1C95F51B088ED5EC476485A6AA562CBE68A88D0261CE88BCB3DCA1F1C8B0 | |||
3944 | FileZilla Server.exe | C:\Program Files\FileZilla Server\FileZilla Server.xml | text | |
MD5:D515C6F1BEDABA70CAF1D4539FBE2C1E | SHA256:D2D75B3FFEF4F3D19D44BE76CDF118DC4D4DBBAB72EFF33A8400C3956EB2BD79 | |||
2752 | FileZilla_Server-0_9_60_2.exe | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla Server\Start FileZilla Server.lnk | lnk | |
MD5:1F420B6FB1866657592198F1954389B3 | SHA256:059E0FB56176903820F3E135007AE857401E45F1AE39DFC3BAB5AF2FCF6E5DD6 | |||
2752 | FileZilla_Server-0_9_60_2.exe | C:\Users\Public\Desktop\FileZilla Server Interface.lnk | lnk | |
MD5:B7C7432404DF7F07A8A744F85C8A822E | SHA256:ABBA47FBDB92A9070910AF8D44C4F7F12ECE8C156DA1417C72EEE353355786A7 | |||
2752 | FileZilla_Server-0_9_60_2.exe | C:\Program Files\FileZilla Server\readme.htm | html | |
MD5:63AD8BFA6710A0648AB5AF70D1CD5112 | SHA256:2A5FC00A42DA5111253F09423F65A77D0800C3213C4034996C4F00B88E1CF515 | |||
2752 | FileZilla_Server-0_9_60_2.exe | C:\Users\admin\AppData\Local\Temp\nsaF5D8.tmp\System.dll | executable | |
MD5:A4DD044BCD94E9B3370CCF095B31F896 | SHA256:2E226715419A5882E2E14278940EE8EF0AA648A3EF7AF5B3DC252674111962BC | |||
2752 | FileZilla_Server-0_9_60_2.exe | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla Server\Uninstall.lnk | lnk | |
MD5:FD4397EAAF6CB62C3254EF942F48C784 | SHA256:947CF35C2B5E7CA019B567912257F908D3FF726E18BD73CF37B6C92E1722BB02 |