Analysis date (UTC): 29 October 2019, 19:31Analysis environment: Windows 7 Pro, build 7601, x86

http://download.endicia.com/EndiciaProFullSetup.exe

MD5:6818047C4F8D7CC8797051485C9E42C2

SHA1:D7662AE4F170B2886B88F691F6E8D1794F48F9E8

SHA256:07B9CD16D1B753D318D2F14C8F207085A3096900D4ED7AE65CBAEE57BE9CE849

Analysis result

Threat level:Malicious activity

Tags:

loader

PID	Process	Class	Message
2372	chrome.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
320	EndiciaProFullSetup.exe	Potentially Bad Traffic	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
320	EndiciaProFullSetup.exe	Misc activity	SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
320	EndiciaProFullSetup.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
320	EndiciaProFullSetup.exe	Potentially Bad Traffic	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
320	EndiciaProFullSetup.exe	Misc activity	SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
320	EndiciaProFullSetup.exe	Potentially Bad Traffic	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
320	EndiciaProFullSetup.exe	Misc activity	SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
320	EndiciaProFullSetup.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP