File name:

Flip Installer - 3.4.7.112.exe

Full analysis: https://app.any.run/tasks/12fd1d3a-84b8-436c-921d-22f1db385edd
Verdict: Malicious activity
Analysis date: June 07, 2018, 03:40:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

E4D4A87854F091F2BA56C84B3A263567

SHA1:

BA2FC30B0ADC23456CE39F2EC119D6D95FB49F48

SHA256:

129CF866B949AF4AE315AA84E4A83EBD872C9AF08FBBC34F450B5625BC84E0D1

SSDEEP:

98304:GychTx3g3symedDjAoMmn7G+hx9+r/7HVXzJh6jyHiRknA+Iz+SwmF2iiE/1qfB7:GtrJ44m7fh2r/RzJh6GCRkb3Sn20t6B7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Flip Installer - 3.4.7.112.exe (PID: 1356)
      • javaw.exe (PID: 4076)

    • Application was dropped or rewritten from another process

      • flip.exe (PID: 3172)

  • SUSPICIOUS

    • Creates a software uninstall entry

      • Flip Installer - 3.4.7.112.exe (PID: 1356)

    • Starts Internet Explorer

      • Flip Installer - 3.4.7.112.exe (PID: 1356)

    • Executable content was dropped or overwritten

      • Flip Installer - 3.4.7.112.exe (PID: 1356)

    • Check for Java to be installed

      • iexplore.exe (PID: 3328)

    • Creates files in the program directory

      • Flip Installer - 3.4.7.112.exe (PID: 1356)

    • Executes JAVA applets

      • flip.exe (PID: 3172)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3328)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3504)

    • Dropped object may contain URL's

      • iexplore.exe (PID: 3328)
      • Flip Installer - 3.4.7.112.exe (PID: 1356)
      • iexplore.exe (PID: 3504)

    • Creates files in the user directory

      • iexplore.exe (PID: 3504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:04:27 21:59:40+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x3190
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.4.7.0
ProductVersionNumber: 3.4.7.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: ASCII
CompanyName: Atmel
CompanyWebsite: www.atmel.com
FileDescription: -
FileVersion: -
LegalCopyright: -
ProductName: -
ProductVersion: 3.4.7

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-Apr-2007 19:59:40
Detected languages:
  • English - United States
CompanyName: Atmel
CompanyWebsite: www.atmel.com
FileDescription: -
FileVersion: -
LegalCopyright: -
ProductName: -
ProductVersion: 3.4.7

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 27-Apr-2007 19:59:40
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005B6E
0x00005C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.47324
.rdata
0x00007000
0x00001286
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.04135
.data
0x00009000
0x00025CB8
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.04684
.ndata
0x0002F000
0x00009000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00038000
0x00006A68
0x00006C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.05886

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.10394
533
UNKNOWN
English - United States
RT_MANIFEST
2
5.13165
1384
UNKNOWN
English - United States
RT_ICON
3
3.34146
744
UNKNOWN
English - United States
RT_ICON
4
6.33781
2216
UNKNOWN
English - United States
RT_ICON
5
6.06944
3752
UNKNOWN
English - United States
RT_ICON
6
6.1985
1128
UNKNOWN
English - United States
RT_ICON
7
6.28602
4264
UNKNOWN
English - United States
RT_ICON
8
6.36425
9640
UNKNOWN
English - United States
RT_ICON
103
2.69402
118
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start flip installer - 3.4.7.112.exe iexplore.exe iexplore.exe no specs flip.exe no specs javaw.exe no specs flip installer - 3.4.7.112.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1356"C:\Users\admin\AppData\Local\Temp\Flip Installer - 3.4.7.112.exe" C:\Users\admin\AppData\Local\Temp\Flip Installer - 3.4.7.112.exe
explorer.exe
User:
admin
Company:
Atmel
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\flip installer - 3.4.7.112.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3172"C:\Program Files\Atmel\Flip 3.4.7\bin\flip.exe" C:\Program Files\Atmel\Flip 3.4.7\bin\flip.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\atmel\flip 3.4.7\bin\flip.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3328"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
Flip Installer - 3.4.7.112.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3504"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3328 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3964"C:\Users\admin\AppData\Local\Temp\Flip Installer - 3.4.7.112.exe" C:\Users\admin\AppData\Local\Temp\Flip Installer - 3.4.7.112.exe—explorer.exe
User:
admin
Company:
Atmel
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\flip installer - 3.4.7.112.exe
c:\systemroot\system32\ntdll.dll
4076"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Program Files\Atmel\Flip 3.4.7\bin\flip.exe"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—flip.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
685
Read events
616
Write events
68
Delete events
1

Modification events

(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Atmel\Flip 3.4.7\Components
Operation:writeName:Main
Value:
1
(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Atmel\Flip 3.4.7
Operation:writeName:Path
Value:
C:\Program Files\Atmel\Flip 3.4.7
(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Atmel\Flip 3.4.7
Operation:writeName:StartMenuGroup
Value:
Flip 3.4.7
(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\flip.exe
Operation:writeName:DisplayName
Value:
Flip 3.4.7
(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\flip.exe
Operation:writeName:DisplayVersion
Value:
3.4.7
(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\flip.exe
Operation:writeName:Publisher
Value:
Atmel
(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\flip.exe
Operation:writeName:URLInfoAbout
Value:
www.atmel.com
(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\flip.exe
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Atmel\Flip 3.4.7\uninstall.exe
(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\flip.exe
Operation:writeName:UninstallString
Value:
C:\Program Files\Atmel\Flip 3.4.7\uninstall.exe
(PID) Process:(1356) Flip Installer - 3.4.7.112.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\flip.exe
Operation:writeName:NoModify
Value:
1
Executable files
41
Suspicious files
5
Text files
546
Unknown types
17

Dropped files

PID
Process
Filename
Type
1356Flip Installer - 3.4.7.112.exeC:\Users\admin\AppData\Local\Temp\nsn102C.tmp\modern-wizard.bmpimage
MD5:5BF3A4F24C8AC4EA9D77C357A1599765
SHA256:2C9EC478B9D992EA0ACF7F3800C00F898355DBEBE053113D6F75EF8080D8E18F
1356Flip Installer - 3.4.7.112.exeC:\Users\admin\AppData\Local\Temp\nsn102C.tmp\AdvSplash.dllexecutable
MD5:166F6790B14B42BF785F591C176A6517
SHA256:DACBA23574C50255764909FEA1187A4B0227DFFF39CAA0D162D3496E76843644
1356Flip Installer - 3.4.7.112.exeC:\Users\admin\AppData\Local\Temp\nsn102C.tmp\spltmp.bmpimage
MD5:3C01842C0025E111C262F10F6E224146
SHA256:6C28EFEF7AD55AD74E481260DEB069ACBBFFB568186163350C3CFB887542ADF0
1356Flip Installer - 3.4.7.112.exeC:\Program Files\Atmel\Flip 3.4.7\COPYING_GPL.txttext
MD5:FDAFC691AA5FB7F8E2A9E9521FEF771B
SHA256:19404E184CF45EC991B54E1E6F05F847AD8F13FEE2A51F3A2D9A960C8F7CB26B
1356Flip Installer - 3.4.7.112.exeC:\Program Files\Atmel\Flip 3.4.7\bin\AtCanPeak.dllexecutable
MD5:54B1FD30465F5C67BD48C601F2723DAB
SHA256:F91C2466D78CC63824C376E5F661A236D96BC0E081BF576F515EB241B44D0471
1356Flip Installer - 3.4.7.112.exeC:\Program Files\Atmel\Flip 3.4.7\bin\VCI2_AtCanIxxat.dllexecutable
MD5:04F971B73B3F15A6D32B81E206FCB33D
SHA256:084FDBFB2A38FBCF22D5B49626D9BE71A3B62D559875B331CE9AED4E47AB3505
1356Flip Installer - 3.4.7.112.exeC:\Program Files\Atmel\Flip 3.4.7\bin\Vci11un6.dllexecutable
MD5:D36C57C765592EF85103BF54630947D9
SHA256:DCD568CCE306A2DFE0E3E67CF87535FCFE3A99410D1328F4F7E08591D5951D28
1356Flip Installer - 3.4.7.112.exeC:\Users\admin\AppData\Local\Temp\nsn102C.tmp\ioSpecial.initext
MD5:—
SHA256:—
1356Flip Installer - 3.4.7.112.exeC:\Users\admin\AppData\Local\Temp\nsn102C.tmp\StartMenu.dllexecutable
MD5:EE388FDF6BF27673F7874D26F85724AC
SHA256:F31C16B1ECB01C7AA12F1893EC5935C1D9EDA7F5CACCF1616A0044BFBA4EE3A5
1356Flip Installer - 3.4.7.112.exeC:\Program Files\Atmel\Flip 3.4.7\bin\AtCanIxxat2.dllexecutable
MD5:3E44DF692245BB278F37792342160B47
SHA256:206309A886F3E842811B833EC2AFFEA95D2BA03A27C0D4D4C5747EE330B086C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3328
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3328
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Flip Installer - 3.4.7.112.exe